[PATCH v6 15/21] iommu/tegra: gart: Fix NULL pointer dereference
From: Dmitry Osipenko <digetx@gmail.com>
Date: 2018-12-09 20:32:03
Also in:
linux-iommu, linux-tegra, lkml
Subsystem:
iommu subsystem, tegra iommu drivers, the rest · Maintainers:
Joerg Roedel, Will Deacon, Thierry Reding, Linus Torvalds
Fix NULL pointer dereference on IOMMU domain destruction that happens because clients list is being iterated unsafely and its elements are getting deleted during the iteration. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Acked-by: Thierry Reding <redacted> --- drivers/iommu/tegra-gart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index d4a642c636f1..bb5303b06845 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c@@ -260,9 +260,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain) if (gart) { spin_lock(&gart->client_lock); if (!list_empty(&gart->client)) { - struct gart_client *c; + struct gart_client *c, *tmp; - list_for_each_entry(c, &gart->client, list) + list_for_each_entry_safe(c, tmp, &gart->client, list) __gart_iommu_detach_dev(domain, c->dev); } spin_unlock(&gart->client_lock);
--
2.19.1