linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dmitry Osipenko <digetx@gmail.com>
To: Thierry Reding <thierry.reding@gmail.com>,
	Jonathan Hunter <jonathanh@nvidia.com>,
	Joerg Roedel <joro@8bytes.org>,
	Robin Murphy <robin.murphy@arm.com>
Cc: iommu@lists.linux-foundation.org, devicetree@vger.kernel.org,
	linux-tegra@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v5 15/21] iommu/tegra: gart: Fix NULL pointer dereference
Date: Mon,  1 Oct 2018 01:48:27 +0300	[thread overview]
Message-ID: <20180930224833.28809-16-digetx@gmail.com> (raw)
In-Reply-To: <20180930224833.28809-1-digetx@gmail.com>

Fix NULL pointer dereference on IOMMU domain destruction that happens
because clients list is being iterated unsafely and its elements are
getting deleted during the iteration.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Thierry Reding <treding@nvidia.com>
---
 drivers/iommu/tegra-gart.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index e6fe139576c3..1d45b023adea 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -258,9 +258,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
 	if (gart) {
 		spin_lock(&gart->client_lock);
 		if (!list_empty(&gart->client)) {
-			struct gart_client *c;
+			struct gart_client *c, *tmp;
 
-			list_for_each_entry(c, &gart->client, list)
+			list_for_each_entry_safe(c, tmp, &gart->client, list)
 				__gart_iommu_detach_dev(domain, c->dev);
 		}
 		spin_unlock(&gart->client_lock);
-- 
2.19.0


  parent reply	other threads:[~2018-09-30 22:49 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-30 22:48 [PATCH v5 00/21] IOMMU: Tegra GART driver clean up and optimization Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 01/21] iommu/tegra: gart: Remove pr_fmt and clean up includes Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 02/21] iommu/tegra: gart: Clean up driver probe errors handling Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 03/21] iommu/tegra: gart: Ignore devices without IOMMU phandle in DT Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 04/21] iommu: Introduce iotlb_sync_map callback Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 05/21] iommu/tegra: gart: Optimize mapping / unmapping performance Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 06/21] dt-bindings: memory: tegra: Squash tegra20-gart into tegra20-mc Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 07/21] ARM: dts: tegra20: Update Memory Controller node to the new binding Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 08/21] memory: tegra: Don't invoke Tegra30+ specific memory timing setup on Tegra20 Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 09/21] memory: tegra: Adapt to Tegra20 device-tree binding changes Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 10/21] memory: tegra: Read client ID on GART page fault Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 11/21] memory: tegra: Use of_device_get_match_data() Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 12/21] memory: tegra: Use relaxed versions of readl/writel Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 13/21] iommu/tegra: gart: Integrate with Memory Controller driver Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 14/21] iommu/tegra: gart: Fix spinlock recursion Dmitry Osipenko
2018-09-30 22:48 ` Dmitry Osipenko [this message]
2018-09-30 22:48 ` [PATCH v5 16/21] iommu/tegra: gart: Allow only one active domain at a time Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 17/21] iommu/tegra: gart: Don't use managed resources Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 18/21] iommu/tegra: gart: Prepend error/debug messages with "gart:" Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 19/21] iommu/tegra: gart: Don't detach devices from inactive domains Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 20/21] iommu/tegra: gart: Simplify clients-tracking code Dmitry Osipenko
2018-09-30 22:48 ` [PATCH v5 21/21] iommu/tegra: gart: Perform code refactoring Dmitry Osipenko
2018-11-16 12:13 ` [PATCH v5 00/21] IOMMU: Tegra GART driver clean up and optimization Dmitry Osipenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180930224833.28809-16-digetx@gmail.com \
    --to=digetx@gmail.com \
    --cc=devicetree@vger.kernel.org \
    --cc=iommu@lists.linux-foundation.org \
    --cc=jonathanh@nvidia.com \
    --cc=joro@8bytes.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tegra@vger.kernel.org \
    --cc=robin.murphy@arm.com \
    --cc=thierry.reding@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).