[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Dec 2018 23:39:01 +0300
From: Dmitry Osipenko <digetx@...il.com>
To: Thierry Reding <thierry.reding@...il.com>,
Jonathan Hunter <jonathanh@...dia.com>,
Joerg Roedel <joro@...tes.org>
Cc: Robin Murphy <robin.murphy@....com>,
iommu@...ts.linux-foundation.org, devicetree@...r.kernel.org,
linux-tegra@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v7 18/24] iommu/tegra: gart: Fix NULL pointer dereference
Fix NULL pointer dereference on IOMMU domain destruction that happens
because clients list is being iterated unsafely and its elements are
getting deleted during the iteration.
Signed-off-by: Dmitry Osipenko <digetx@...il.com>
Acked-by: Thierry Reding <treding@...dia.com>
---
drivers/iommu/tegra-gart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index a7a9400e0cd8..7fdd8b12efd5 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -260,9 +260,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
if (gart) {
spin_lock(&gart->client_lock);
if (!list_empty(&gart->client)) {
- struct gart_client *c;
+ struct gart_client *c, *tmp;
- list_for_each_entry(c, &gart->client, list)
+ list_for_each_entry_safe(c, tmp, &gart->client, list)
__gart_iommu_detach_dev(domain, c->dev);
}
spin_unlock(&gart->client_lock);
--
2.20.0
Powered by blists - more mailing lists