iommu: Fix missing return check of arm_lpae_init_pte
UAF scenario may occur in clients with EL1 privileges for iova mappings when we miss to check the return value of arm_lpae_init_pte which may lead to an PTE be counted as it was set even if it was already existing. This can cause a dangling IOMMU PTE to be left mapped pointing to a freed object and cause UAF in the client if the dangling PTE is accessed after a failed unmap operation. Fixes: 27de1978 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor") Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47 Signed-off-by:Pratyush Brahma <quic_pbrahma@quicinc.com>
Loading
-
mentioned in commit 5b654974
-
mentioned in commit af727f7d
-
mentioned in commit 351c2eb7
-
mentioned in commit 76c88cc6
-
mentioned in commit 264b6876
-
mentioned in commit db3079d8
-
mentioned in commit e69ae8c7
-
mentioned in commit 2ca30a9b
-
mentioned in commit 2b32670c
-
mentioned in commit 7e23ab1a
-
mentioned in commit b0e46129
-
mentioned in commit 10e22d30
-
mentioned in commit 881fbebf
Please sign in to comment