Commit 8e924910 authored Dec 12, 2018 by Dmitry Osipenko Committed by Joerg Roedel Jan 16, 2019

iommu/tegra: gart: Fix NULL pointer dereference



Fix NULL pointer dereference on IOMMU domain destruction that happens
because clients list is being iterated unsafely and its elements are
getting deleted during the iteration.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>

parent c3086fad

drivers/iommu/tegra-gart.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -260,9 +260,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
		if (gart) {
		spin_lock(&gart->client_lock);
		if (!list_empty(&gart->client)) {
		struct gart_client *c;
		struct gart_client c, tmp;

		list_for_each_entry(c, &gart->client, list)
		list_for_each_entry_safe(c, tmp, &gart->client, list)
		__gart_iommu_detach_dev(domain, c->dev);
		}
		spin_unlock(&gart->client_lock);

Admin message