| From 8b408fe4f853dcfa18d133aa4cf1d7546b4c3870 Mon Sep 17 00:00:00 2001 |
| From: Joerg Roedel <joerg.roedel@amd.com> |
| Date: Mon, 8 Mar 2010 14:20:07 +0100 |
| Subject: x86/amd-iommu: Use helper function to destroy domain |
| |
| From: Joerg Roedel <joerg.roedel@amd.com> |
| |
| commit 8b408fe4f853dcfa18d133aa4cf1d7546b4c3870 upstream. |
| |
| In the amd_iommu_domain_destroy the protection_domain_free |
| function is partly reimplemented. The 'partly' is the bug |
| here because the domain is not deleted from the domain list. |
| This results in use-after-free errors and data-corruption. |
| Fix it by just using protection_domain_free instead. |
| |
| Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| arch/x86/kernel/amd_iommu.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| --- a/arch/x86/kernel/amd_iommu.c |
| +++ b/arch/x86/kernel/amd_iommu.c |
| @@ -2239,9 +2239,7 @@ static void amd_iommu_domain_destroy(str |
| |
| free_pagetable(domain); |
| |
| - domain_id_free(domain->id); |
| - |
| - kfree(domain); |
| + protection_domain_free(domain); |
| |
| dom->priv = NULL; |
| } |
