iommu/tegra: gart: Fix NULL pointer dereference

Fix NULL pointer dereference on IOMMU domain destruction that happens
because clients list is being iterated unsafely and its elements are
getting deleted during the iteration.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/tegra-gart.c b/drivers/iommu/tegra-gart.c
index a7a9400..7fdd8b1 100644 (file)
--- a/drivers/iommu/tegra-gart.c
+++ b/drivers/iommu/tegra-gart.c
@@ -260,9 +260,9 @@ static void gart_iommu_domain_free(struct iommu_domain *domain)
        if (gart) {
                spin_lock(&gart->client_lock);
                if (!list_empty(&gart->client)) {
-                       struct gart_client *c;
+                       struct gart_client *c, *tmp;
 
-                       list_for_each_entry(c, &gart->client, list)
+                       list_for_each_entry_safe(c, tmp, &gart->client, list)
                                __gart_iommu_detach_dev(domain, c->dev);
                }
                spin_unlock(&gart->client_lock);