From: Robin Murphy <robin.murphy@arm.com>
Date: Fri, 11 Nov 2016 17:59:22 +0000 (+0000)
Subject: iommu/arm-smmu: Fix group refcounting
X-Git-Tag: v4.10-rc1~95^2^6~5
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e1b44cbe7b5d4d97e43a1476b68e0adc1aa5e383;p=thirdparty%2Fkernel%2Flinux.git

iommu/arm-smmu: Fix group refcounting

When arm_smmu_device_group() finds an existing group due to Stream ID
aliasing, it should be taking an additional reference on that group.
Otherwise, the caller of iommu_group_get_for_dev() will inadvertently
remove the reference taken by iommu_group_add_device(), and the group
will be freed prematurely if any device is removed.

Reported-by: Sricharan R <sricharan@codeaurora.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
---

diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index c841eb7a1a741..b85fa2471738f 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1466,7 +1466,7 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev)
 	}
 
 	if (group)
-		return group;
+		return iommu_group_ref_get(group);
 
 	if (dev_is_pci(dev))
 		group = pci_device_group(dev);