6 files changed, 15 insertions, 8 deletions

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index c949520bd196..57068e8035b5 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3999,7 +3999,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
         iommu_flush_dte(iommu, devid);
         if (devid != alias) {
                 irq_lookup_table[alias] = table;
-                set_dte_irq_entry(devid, table);
+                set_dte_irq_entry(alias, table);
                 iommu_flush_dte(iommu, alias);
         }
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index b76c58dbe30c..0e08545d7298 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -788,7 +788,7 @@ static void __init set_device_exclusion_range(u16 devid, struct ivmd_header *m)
                  * per device. But we can enable the exclusion range per
                  * device. This is done here
                  */
-                set_dev_entry_bit(m->devid, DEV_ENTRY_EX);
+                set_dev_entry_bit(devid, DEV_ENTRY_EX);
                 iommu->exclusion_start = m->range_start;
                 iommu->exclusion_length = m->range_length;
         }
diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
index 5208828792e6..203b2e6a91cf 100644
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -504,8 +504,10 @@ static void do_fault(struct work_struct *work)
 
         write = !!(fault->flags & PPR_FAULT_WRITE);
 
+        down_read(&fault->state->mm->mmap_sem);
         npages = get_user_pages(fault->state->task, fault->state->mm,
                                 fault->address, 1, write, 0, &page, NULL);
+        up_read(&fault->state->mm->mmap_sem);
 
         if (npages == 1) {
                 put_page(page);
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 8b89e33a89fe..647c3c7fd742 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1381,7 +1381,7 @@ static int arm_smmu_alloc_init_pmd(struct arm_smmu_device *smmu, pud_t *pud,
 
         do {
                 next = pmd_addr_end(addr, end);
-                ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, end, pfn,
+                ret = arm_smmu_alloc_init_pte(smmu, pmd, addr, next, pfn,
                                               prot, stage);
                 phys += next - addr;
         } while (pmd++, addr = next, addr < end);
@@ -1499,7 +1499,7 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
 
         ret = arm_smmu_handle_mapping(smmu_domain, iova, 0, size, 0);
         arm_smmu_tlb_inv_context(&smmu_domain->root_cfg);
-        return ret ? ret : size;
+        return ret ? 0 : size;
 }
 
 static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index f445c10df8df..39f8b717fe84 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -152,7 +152,8 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event)
         info->seg = pci_domain_nr(dev->bus);
         info->level = level;
         if (event == BUS_NOTIFY_ADD_DEVICE) {
-                for (tmp = dev, level--; tmp; tmp = tmp->bus->self) {
+                for (tmp = dev; tmp; tmp = tmp->bus->self) {
+                        level--;
                         info->path[level].device = PCI_SLOT(tmp->devfn);
                         info->path[level].function = PCI_FUNC(tmp->devfn);
                         if (pci_is_root_bus(tmp->bus))
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 69fa7da5e48b..f256ffc02e29 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1009,11 +1009,13 @@ static struct page *dma_pte_list_pagetables(struct dmar_domain *domain,
         if (level == 1)
                 return freelist;
 
-        for (pte = page_address(pg); !first_pte_in_page(pte); pte++) {
+        pte = page_address(pg);
+        do {
                 if (dma_pte_present(pte) && !dma_pte_superpage(pte))
                         freelist = dma_pte_list_pagetables(domain, level - 1,
                                                            pte, freelist);
-        }
+                pte++;
+        } while (!first_pte_in_page(pte));
 
         return freelist;
 }
@@ -2235,7 +2237,9 @@ static struct dmar_domain *get_domain_for_dev(struct device *dev, int gaw)
                                 bridge_devfn = dev_tmp->devfn;
                         }
                         spin_lock_irqsave(&device_domain_lock, flags);
-                        info = dmar_search_domain_by_dev_info(segment, bus, devfn);
+                        info = dmar_search_domain_by_dev_info(segment,
+                                                              bridge_bus,
+                                                              bridge_devfn);
                         if (info) {
                                 iommu = info->iommu;
                                 domain = info->domain;