diff options
| author | Joerg Roedel <joerg.roedel@amd.com> | 2010-01-22 16:45:31 +0100 |
|---|---|---|
| committer | Joerg Roedel <joerg.roedel@amd.com> | 2010-01-22 17:32:31 +0100 |
| commit | 2ca762790caf822f7b61430fbaffa3ae4219977f (patch) | |
| tree | 66a4633af764df377f9915b63d8fbbba3f6ed4b6 /arch | |
| parent | d91afd15b041f27d34859c79afa9e172018a86f4 (diff) | |
| download | linux-2ca762790caf822f7b61430fbaffa3ae4219977f.tar.gz linux-2ca762790caf822f7b61430fbaffa3ae4219977f.tar.bz2 linux-2ca762790caf822f7b61430fbaffa3ae4219977f.zip | |
x86/amd-iommu: Fix NULL pointer dereference in __detach_device()
In the __detach_device function the reference count for a
device-domain binding may become zero. This results in the
device being removed from the domain and dev_data->domain
will be NULL. This is bad because this pointer is
dereferenced when trying to unlock the domain->lock. This
patch fixes the issue by keeping the domain in a seperate
variable.
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/kernel/amd_iommu.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c index c2ccbd7b862f..4478a48198a8 100644 --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -1489,11 +1489,14 @@ static void __detach_device(struct device *dev) { struct iommu_dev_data *dev_data = get_dev_data(dev); struct iommu_dev_data *alias_data; + struct protection_domain *domain; unsigned long flags; BUG_ON(!dev_data->domain); - spin_lock_irqsave(&dev_data->domain->lock, flags); + domain = dev_data->domain; + + spin_lock_irqsave(&domain->lock, flags); if (dev_data->alias != dev) { alias_data = get_dev_data(dev_data->alias); @@ -1504,7 +1507,7 @@ static void __detach_device(struct device *dev) if (atomic_dec_and_test(&dev_data->bind)) do_detach(dev); - spin_unlock_irqrestore(&dev_data->domain->lock, flags); + spin_unlock_irqrestore(&domain->lock, flags); /* * If we run in passthrough mode the device must be assigned to the |