drm/i915/gvt: Avoid use-after-free iterating the gtt list

Found by smatch:

drivers/gpu/drm/i915/gvt/gtt.c:2452 intel_vgpu_destroy_ggtt_mm() error: dereferencing freed memory 'pos'

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>

diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 919de5a1bafb75c3a2a318bf8c3b135ddc23367f..3b32e69beac670d5031295bd4a0662fa7e431a9e 100644 (file)
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -2443,10 +2443,11 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu)
 
 static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu)
 {
-       struct intel_gvt_partial_pte *pos;
+       struct intel_gvt_partial_pte *pos, *next;
 
-       list_for_each_entry(pos,
-                       &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, list) {
+       list_for_each_entry_safe(pos, next,
+                                &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list,
+                                list) {
                gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n",
                        pos->offset, pos->data);
                kfree(pos);