[PATCH] Intel-IOMMU Alignment Issue in dma_pte_clear_range()

[PATCH] Intel-IOMMU Alignment Issue in dma_pte_clear_range()

[Fenghua Yu]

This issue was pointed out by Linus.

In dma_pte_clear_range() in intel-iommu.c

start = PAGE_ALIGN(start);
end &= PAGE_MASK;
npages = (end - start) / VTD_PAGE_SIZE;

In partial page case, start could be bigger than end and npages will be
negative.

Currently the issue doesn't show up as a real bug in testing because start and
end have been aligned to page boundary already by all callers. So the issue has
been hiden. But it is dangerous programming practice.

The following patch fixes the issue. It's applied on iommu-2.6.git tree.

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>

---

 intel-iommu.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index fd7472f..bce4f6e 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -732,8 +732,8 @@ static void dma_pte_clear_range(struct dmar_domain *domain, u64 start, u64 end)
 	start &= (((u64)1) << addr_width) - 1;
 	end &= (((u64)1) << addr_width) - 1;
 	/* in case it's partial page */
-	start = PAGE_ALIGN(start);
-	end &= PAGE_MASK;
+	start &= PAGE_MASK;
+	end = PAGE_ALIGN(end);
 	npages = (end - start) / VTD_PAGE_SIZE;
 
 	/* we don't need lock here, nobody else touches the iova range */

Re: [PATCH] Intel-IOMMU Alignment Issue in dma_pte_clear_range()

[David Woodhouse]

On Mon, 2009-04-06 at 11:21 -0700, Fenghua Yu wrote:
> This issue was pointed out by Linus.
> 
> In dma_pte_clear_range() in intel-iommu.c
> 
> start = PAGE_ALIGN(start);
> end &= PAGE_MASK;
> npages = (end - start) / VTD_PAGE_SIZE;
> 
> In partial page case, start could be bigger than end and npages will be
> negative.
> 
> Currently the issue doesn't show up as a real bug in testing because start and
> end have been aligned to page boundary already by all callers. So the issue has
> been hiden. But it is dangerous programming practice.
> 
> The following patch fixes the issue. It's applied on iommu-2.6.git tree.
> 
> Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>

Applied to git://git.infradead.org/iommu-2.6.git; thanks.

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation