Fix a bug in ASE that incorrectly handled munmap of a buffer.
Wrong level was passed to ASE's internal page table manager, leading
to a SEGV. Tested with MPF/VTP's random tester, which is the only
code that exercies repeated alloc/free of pinned buffers.
@@ -452,7 +452,7 @@ static int ase_pt_pin_page(uint64_t va, uint64_t *iova, int pt_level)
if (pt[idx] != NULL) {
// The page is already pinned. What should we do? mmap() allows overwriting
// existing mappings, so we behave like it for now.
- ase_pt_delete_tree((uint64_t **)pt[idx], level);
+ ase_pt_delete_tree((uint64_t **)pt[idx], level - 1);
}
pt[idx] = (uint64_t *) -1;
