iommu/vt-d: fix access after free issue in function free_dmar_iommu()

[firefly-linux-kernel-4.4.55.git] / drivers / iommu / intel-iommu.c

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index fd9e369a8cf781b4add2f45c3d43928835b6bbea..dec715c7e525638ba5a8688915ada668aea442a4 100644 (file)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1268,7 +1268,7 @@ static void vm_domain_exit(struct dmar_domain *domain);
 static void free_dmar_iommu(struct intel_iommu *iommu)
 {
        struct dmar_domain *domain;
-       int i;
+       int i, count;
        unsigned long flags;
 
        if ((iommu->domains) && (iommu->domain_ids)) {
@@ -1277,13 +1277,14 @@ static void free_dmar_iommu(struct intel_iommu *iommu)
                        clear_bit(i, iommu->domain_ids);
 
                        spin_lock_irqsave(&domain->iommu_lock, flags);
-                       if (--domain->iommu_count == 0) {
+                       count = --domain->iommu_count;
+                       spin_unlock_irqrestore(&domain->iommu_lock, flags);
+                       if (count == 0) {
                                if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)
                                        vm_domain_exit(domain);
                                else
                                        domain_exit(domain);
                        }
-                       spin_unlock_irqrestore(&domain->iommu_lock, flags);
                }
        }