Commit 881fbebf authored by Sahitya Puligadda's avatar Sahitya Puligadda
Browse files

iommu: Fix missing return check of arm_lpae_init_pte



UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.

Fixes: 27de1978 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
(cherry picked from commit de59b74d)

Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: default avatarSahitya Puligadda <quic_spuligad@quicinc.com>
parent d5ac61bd
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment