intel_th: Use correct device when freeing buffers

commit 0ed2424b911f3a058dfea01b78817abed767433d upstream.

Commit d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU
domain allocation") changes dma buffer allocation to use the actual
underlying device, but forgets to change the deallocation path, which leads
to (if you've got CAP_SYS_RAWIO):

> # echo 0,0 > /sys/bus/intel_th/devices/0-msc0/nr_pages
> ------------[ cut here ]------------
> kernel BUG at ../linux/drivers/iommu/intel-iommu.c:3670!
> CPU: 3 PID: 231 Comm: sh Not tainted 4.17.0-rc1+ #2729
> RIP: 0010:intel_unmap+0x11e/0x130
...
> Call Trace:
>  intel_free_coherent+0x3e/0x60
>  msc_buffer_win_free+0x100/0x160 [intel_th_msu]

This patch fixes the buffer deallocation code to use the correct device.

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: d5c435df4a890 ("intel_th: msu: Use the real device in case of IOMMU domain allocation")
Reported-by: Baofeng Tian <baofeng.tian@intel.com>
CC: stable@vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index dfb57eaa9f22a94d5e4a3454649f33f64f6a3f1c..58ac786634dccfce1ce27c9fec51b6a6c76964e6 100644 (file)
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -741,8 +741,8 @@ err_nomem:
                /* Reset the page to write-back before releasing */
                set_memory_wb((unsigned long)win->block[i].bdesc, 1);
 #endif
-               dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,
-                                 win->block[i].addr);
+               dma_free_coherent(msc_dev(msc)->parent->parent, size,
+                                 win->block[i].bdesc, win->block[i].addr);
        }
        kfree(win);
 
@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win)
                /* Reset the page to write-back before releasing */
                set_memory_wb((unsigned long)win->block[i].bdesc, 1);
 #endif
-               dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,
+               dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
                                  win->block[i].bdesc, win->block[i].addr);
        }