[PATCH] powerpc/iommu: Fix an RCU read lock leak in mm_iommu_is_devmem()

[Bart Van Assche]

mm_iommu_is_devmem() returns true from inside its RCU read-side
critical section without calling rcu_read_unlock(). Neither caller,
iommu_tce_xchg_no_kill() nor tce_page_is_contained(), drops the RCU
read lock, so every successful lookup leaks one RCU read lock. Fix this
by calling rcu_read_unlock() before returning true. The pointer to the
list element is not used after the RCU read lock is dropped.

Fixes: b5952f8125ae ("powerpc/mm/book3s64/iommu: fix some RCU-list locks")
Signed-off-by: Bart Van Assche <bvanass...@acm.org>
---
 arch/powerpc/mm/book3s64/iommu_api.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/mm/book3s64/iommu_api.c 
b/arch/powerpc/mm/book3s64/iommu_api.c
index 60d00c9e7f19..e1e43573e8a8 100644
--- a/arch/powerpc/mm/book3s64/iommu_api.c
+++ b/arch/powerpc/mm/book3s64/iommu_api.c
@@ -371,6 +371,7 @@ bool mm_iommu_is_devmem(struct mm_struct *mm, unsigned long 
hpa,
                         * and the caller needs to distinguish this situation.
                         */
                        *size = min(1UL << pageshift, end - hpa);
+                       rcu_read_unlock();
                        return true;
                }
        }