summaryrefslogtreecommitdiff
path: root/drivers/iommu/tegra-gart.c
diff options
context:
space:
mode:
authorDmitry Osipenko <digetx@gmail.com>2018-12-12 23:39:01 +0300
committerJoerg Roedel <jroedel@suse.de>2019-01-16 15:54:14 +0300
commit8e924910dd07f1614fe534f8bdfdc17f7de3d68b (patch)
tree9db56b79d8ffa3656e171dcabe0cb08b55198667 /drivers/iommu/tegra-gart.c
parentc3086fad2755f5e446f6a69fda3b2a8c16a1b5ce (diff)
downloadlinux-8e924910dd07f1614fe534f8bdfdc17f7de3d68b.tar.xz
iommu/tegra: gart: Fix NULL pointer dereference
Fix NULL pointer dereference on IOMMU domain destruction that happens because clients list is being iterated unsafely and its elements are getting deleted during the iteration. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Acked-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
Diffstat (limited to 'drivers/iommu/tegra-gart.c')
-rw-r--r--drivers/iommu/tegra-gart.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index a7a9400e0cd8..7fdd8b12efd5 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -260,9 +260,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
if (gart) {
spin_lock(&gart->client_lock);
if (!list_empty(&gart->client)) {
- struct gart_client *c;
+ struct gart_client *c, *tmp;
- list_for_each_entry(c, &gart->client, list)
+ list_for_each_entry_safe(c, tmp, &gart->client, list)
__gart_iommu_detach_dev(domain, c->dev);
}
spin_unlock(&gart->client_lock);