From 93e644714da679151cb922b44abe65a5219fff30 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Tue, 4 Nov 2014 14:53:51 +0100 Subject: [PATCH] iommu: Do more input validation in iommu_map_sg() The IOMMU-API works on page boundarys, unlike the DMA-API which can work with sub-page buffers. The sg->offset field does not make sense on the IOMMU level, so force it to be 0. Do some error-path consolidation while at it. Signed-off-by: Joerg Roedel --- drivers/iommu/iommu.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 1e3a0198e7e7..b72ea9dee90b 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -1195,26 +1195,33 @@ EXPORT_SYMBOL_GPL(iommu_unmap); size_t default_iommu_map_sg(struct iommu_domain *domain, unsigned long iova, struct scatterlist *sg, unsigned int nents, int prot) { - int ret; + struct scatterlist *s; size_t mapped = 0; unsigned int i; - struct scatterlist *s; + int ret; for_each_sg(sg, s, nents, i) { phys_addr_t phys = page_to_phys(sg_page(s)); - size_t page_len = s->offset + s->length; - ret = iommu_map(domain, iova + mapped, phys, page_len, prot); - if (ret) { - /* undo mappings already done */ - iommu_unmap(domain, iova, mapped); - mapped = 0; - break; - } - mapped += page_len; + /* We are mapping on page boundarys, so offset must be 0 */ + if (s->offset) + goto out_err; + + ret = iommu_map(domain, iova + mapped, phys, s->length, prot); + if (ret) + goto out_err; + + mapped += s->length; } return mapped; + +out_err: + /* undo mappings already done */ + iommu_unmap(domain, iova, mapped); + + return 0; + } EXPORT_SYMBOL_GPL(default_iommu_map_sg); -- 2.11.0