From: Keir Fraser <keir.fraser@citrix.com>
Date: Mon, 4 Jan 2010 09:06:36 +0000 (+0000)
Subject: VT-d: fix iommu_domain_destroy
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~12794
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https://%22%22/%22http:/www.example.com/cgi/%22https:/%22%22?a=commitdiff_plain;h=07d20ae391d1cc8acd3f8d0c9bcbd9aa109dced5;p=xen.git

VT-d: fix iommu_domain_destroy

Currently, g2m_ioport list and mapped_rmrrs always won't be released
in iommu_domain_destroy, because the function returns before those
code. It causes potential leak. This patch releases them, and thus
avoid the potential leak.

Signed-off-by: Weidong Han <Weidong.han@intel.com>
---

diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
index 2ec6d5802e..7558c8729f 100644
--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -195,34 +195,25 @@ void iommu_domain_destroy(struct domain *d)
     if ( !iommu_enabled || !hd->platform_ops )
         return;
 
-    if ( !need_iommu(d)  )
-        return;
-
     if ( need_iommu(d) )
     {
         d->need_iommu = 0;
         hd->platform_ops->teardown(d);
-        return;
     }
 
-    if ( hd )
+    list_for_each_safe ( ioport_list, tmp, &hd->g2m_ioport_list )
     {
-        list_for_each_safe ( ioport_list, tmp, &hd->g2m_ioport_list )
-        {
-            ioport = list_entry(ioport_list, struct g2m_ioport, list);
-            list_del(&ioport->list);
-            xfree(ioport);
-        }
-
-        list_for_each_safe ( rmrr_list, tmp, &hd->mapped_rmrrs )
-        {
-            mrmrr = list_entry(rmrr_list, struct mapped_rmrr, list);
-            list_del(&mrmrr->list);
-            xfree(mrmrr);
-        }
+        ioport = list_entry(ioport_list, struct g2m_ioport, list);
+        list_del(&ioport->list);
+        xfree(ioport);
     }
 
-    return hd->platform_ops->teardown(d);
+    list_for_each_safe ( rmrr_list, tmp, &hd->mapped_rmrrs )
+    {
+        mrmrr = list_entry(rmrr_list, struct mapped_rmrr, list);
+        list_del(&mrmrr->list);
+        xfree(mrmrr);
+    }
 }
 
 int iommu_map_page(struct domain *d, unsigned long gfn, unsigned long mfn)