From: Dmitry Osipenko <digetx@gmail.com>
To: Thierry Reding <thierry.reding@gmail.com>,
Jonathan Hunter <jonathanh@nvidia.com>,
Joerg Roedel <joro@8bytes.org>, Rob Herring <robh+dt@kernel.org>,
Robin Murphy <robin.murphy@arm.com>
Cc: iommu@lists.linux-foundation.org, devicetree@vger.kernel.org,
linux-tegra@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v4 14/20] iommu/tegra: gart: Fix NULL pointer dereference
Date: Mon, 24 Sep 2018 03:41:47 +0300 [thread overview]
Message-ID: <20180924004153.8232-15-digetx@gmail.com> (raw)
In-Reply-To: <20180924004153.8232-1-digetx@gmail.com>
Fix NULL pointer dereference on IOMMU domain destruction that happens
because clients list is being iterated unsafely and its elements are
getting deleted during the iteration.
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
---
drivers/iommu/tegra-gart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index e6fe139576c3..1d45b023adea 100644
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -258,9 +258,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
if (gart) {
spin_lock(&gart->client_lock);
if (!list_empty(&gart->client)) {
- struct gart_client *c;
+ struct gart_client *c, *tmp;
- list_for_each_entry(c, &gart->client, list)
+ list_for_each_entry_safe(c, tmp, &gart->client, list)
__gart_iommu_detach_dev(domain, c->dev);
}
spin_unlock(&gart->client_lock);
--
2.19.0
next prev parent reply other threads:[~2018-09-24 0:47 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-24 0:41 [PATCH v4 00/20] IOMMU: Tegra GART driver clean up and optimization Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 01/20] iommu/tegra: gart: Remove pr_fmt and clean up includes Dmitry Osipenko
2018-09-24 10:02 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 02/20] iommu/tegra: gart: Clean up driver probe errors handling Dmitry Osipenko
2018-09-24 10:02 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 03/20] iommu/tegra: gart: Ignore devices without IOMMU phandle in DT Dmitry Osipenko
2018-09-24 10:05 ` Thierry Reding
2018-09-24 18:41 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 04/20] iommu: Introduce iotlb_sync_map callback Dmitry Osipenko
2018-09-24 10:06 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 05/20] iommu/tegra: gart: Optimize mapping / unmapping performance Dmitry Osipenko
2018-09-24 10:07 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 06/20] dt-bindings: memory: tegra: Squash tegra20-gart into tegra20-mc Dmitry Osipenko
2018-09-24 9:55 ` Thierry Reding
2018-09-27 18:41 ` Rob Herring
2018-09-27 18:41 ` Rob Herring
2018-09-24 0:41 ` [PATCH v4 07/20] ARM: dts: tegra20: Update Memory Controller node to the new binding Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 08/20] memory: tegra: Don't invoke Tegra30+ specific memory timing setup on Tegra20 Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 09/20] memory: tegra: Adapt to Tegra20 device-tree binding changes Dmitry Osipenko
2018-09-24 10:02 ` Thierry Reding
2018-09-24 13:22 ` Dmitry Osipenko
2018-09-25 12:16 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 10/20] memory: tegra: Read client ID on GART page fault Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 11/20] memory: tegra: Use of_device_get_match_data() Dmitry Osipenko
2018-09-24 10:13 ` Thierry Reding
2018-09-24 18:39 ` Dmitry Osipenko
2018-09-25 10:00 ` Thierry Reding
2018-09-25 13:53 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 12/20] iommu/tegra: gart: Integrate with Memory Controller driver Dmitry Osipenko
2018-09-24 10:23 ` Thierry Reding
2018-09-24 18:22 ` Dmitry Osipenko
2018-09-25 10:02 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 13/20] iommu/tegra: gart: Fix spinlock recursion Dmitry Osipenko
2018-09-24 10:49 ` Thierry Reding
2018-09-24 0:41 ` Dmitry Osipenko [this message]
2018-09-24 10:49 ` [PATCH v4 14/20] iommu/tegra: gart: Fix NULL pointer dereference Thierry Reding
2018-09-24 0:41 ` [PATCH v4 15/20] iommu/tegra: gart: Allow only one active domain at a time Dmitry Osipenko
2018-09-24 10:50 ` Thierry Reding
2018-09-24 0:41 ` [PATCH v4 16/20] iommu/tegra: gart: Don't use managed resources Dmitry Osipenko
2018-09-24 10:52 ` Thierry Reding
2018-09-24 18:57 ` Dmitry Osipenko
2018-09-25 10:03 ` Thierry Reding
2018-09-25 13:41 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 17/20] iommu/tegra: gart: Prepend error/debug messages with "GART:" Dmitry Osipenko
2018-09-24 10:57 ` Thierry Reding
2018-09-24 18:09 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 18/20] iommu/tegra: gart: Don't detach devices from inactive domains Dmitry Osipenko
2018-09-24 11:00 ` Thierry Reding
2018-09-24 18:05 ` Dmitry Osipenko
2018-09-25 10:04 ` Thierry Reding
2018-09-25 13:41 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 19/20] iommu/tegra: gart: Simplify clients-tracking code Dmitry Osipenko
2018-09-24 11:10 ` Thierry Reding
2018-09-24 17:50 ` Dmitry Osipenko
2018-09-25 10:09 ` Thierry Reding
2018-09-25 13:47 ` Dmitry Osipenko
2018-09-24 0:41 ` [PATCH v4 20/20] iommu/tegra: gart: Perform code refactoring Dmitry Osipenko
2018-09-24 11:34 ` Thierry Reding
2018-09-24 17:11 ` Dmitry Osipenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180924004153.8232-15-digetx@gmail.com \
--to=digetx@gmail.com \
--cc=devicetree@vger.kernel.org \
--cc=iommu@lists.linux-foundation.org \
--cc=jonathanh@nvidia.com \
--cc=joro@8bytes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=robh+dt@kernel.org \
--cc=robin.murphy@arm.com \
--cc=thierry.reding@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).