[PATCH] powerpc/iommu: Fix an RCU read lock leak in mm_iommu_is_devmem()

[Bart Van Assche]

mm_iommu_is_devmem() returns true from inside its RCU read-side
critical section without calling rcu_read_unlock(). Neither caller,
iommu_tce_xchg_no_kill() nor tce_page_is_contained(), drops the RCU
read lock, so every successful lookup leaks one RCU read lock. Fix this
by calling rcu_read_unlock() before returning true. The pointer to the
list element is not used after the RCU read lock is dropped.

Fixes: b5952f8125ae ("powerpc/mm/book3s64/iommu: fix some RCU-list locks")
Signed-off-by: Bart Van Assche <bvanassche@xxxxxxx>
---
 arch/powerpc/mm/book3s64/iommu_api.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/mm/book3s64/iommu_api.c b/arch/powerpc/mm/book3s64/iommu_api.c
index 60d00c9e7f19..e1e43573e8a8 100644
--- a/arch/powerpc/mm/book3s64/iommu_api.c
+++ b/arch/powerpc/mm/book3s64/iommu_api.c
@@ -371,6 +371,7 @@ bool mm_iommu_is_devmem(struct mm_struct *mm, unsigned long hpa,
 			 * and the caller needs to distinguish this situation.
 			 */
 			*size = min(1UL << pageshift, end - hpa);
+			rcu_read_unlock();
 			return true;
 		}
 	}