iommu/io-pgtable: dart: Fix freeing of non-leaf page tables

hoshinolina · jannau · commit 2bb149953793 · 2024-06-15T09:53:07.000+02:00
We increment the ptep to walk the page, so the subsequent free
ended up freeing the *next* page which is not good.

Signed-off-by: Asahi Lina &lt;lina@asahilina.net&gt;
diff --git a/drivers/iommu/io-pgtable-dart.c b/drivers/iommu/io-pgtable-dart.c
@@ -463,6 +463,7 @@ apple_dart_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie)
 static void apple_dart_free_pgtables(struct dart_io_pgtable *data, dart_iopte *ptep, int level)
 {
 	dart_iopte *end;
+	dart_iopte *start = ptep;
 
 	if (level > 1) {
 		end = (void *)ptep + DART_GRANULE(data);
@@ -474,7 +475,7 @@ static void apple_dart_free_pgtables(struct dart_io_pgtable *data, dart_iopte *p
 				apple_dart_free_pgtables(data, iopte_deref(pte, data), level - 1);
 		}
 	}
-	free_pages((unsigned long)ptep, get_order(DART_GRANULE(data)));
+	free_pages((unsigned long)start, get_order(DART_GRANULE(data)));
 }
 
 static void apple_dart_free_pgtable(struct io_pgtable *iop)

Original file line number	Diff line number	Diff line change
`@@ -463,6 +463,7 @@ apple_dart_alloc_pgtable(struct io_pgtable_cfg cfg, void cookie)`
`463`	`463`	`static void apple_dart_free_pgtables(struct dart_io_pgtable data, dart_iopte ptep, int level)`
`464`	`464`	`{`
`465`	`465`	`dart_iopte *end;`
	`466`	`+ dart_iopte *start = ptep;`
`466`	`467`
`467`	`468`	`if (level > 1) {`
`468`	`469`	`end = (void *)ptep + DART_GRANULE(data);`
`@@ -474,7 +475,7 @@ static void apple_dart_free_pgtables(struct dart_io_pgtable data, dart_iopte p`
`474`	`475`	`apple_dart_free_pgtables(data, iopte_deref(pte, data), level - 1);`
`475`	`476`	`}`
`476`	`477`	`}`
`477`		`- free_pages((unsigned long)ptep, get_order(DART_GRANULE(data)));`
	`478`	`+ free_pages((unsigned long)start, get_order(DART_GRANULE(data)));`
`478`	`479`	`}`
`479`	`480`
`480`	`481`	`static void apple_dart_free_pgtable(struct io_pgtable *iop)`