intel-iommu: Don't free too much in dma_pte_free_pagetable()

The loop condition was wrong -- we should free a PMD only if its
_entire_ range is within the range we're intending to clear. The
early-termination condition was right, but not the loop.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 40ce5a0..35bdd2a 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -815,7 +815,7 @@
 		if (tmp + level_size(level) - 1 > last_pfn)
 			return;
 
-		while (tmp <= last_pfn) {
+		while (tmp + level_size(level) - 1 <= last_pfn) {
 			pte = dma_pfn_level_pte(domain, tmp, level);
 			if (pte) {
 				free_pgtable_page(