intel-iommu: Don't free too much in dma_pte_free_pagetable()

The loop condition was wrong -- we should free a PMD only if its
_entire_ range is within the range we're intending to clear. The
early-termination condition was right, but not the loop.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

drivers/pci/intel-iommu.c

@@ -815,7 +815,7 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
 		if (tmp + level_size(level) - 1 > last_pfn)
 			return;
 
-		while (tmp <= last_pfn) {
+		while (tmp + level_size(level) - 1 <= last_pfn) {
 			pte = dma_pfn_level_pte(domain, tmp, level);
 			if (pte) {
 				free_pgtable_page(