Skip to content
Commit 8376c870 authored by Pratyush Brahma's avatar Pratyush Brahma Committed by Arun Ashok Deore
Browse files

iommu: Fix missing return check of arm_lpae_init_pte

UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.

Fixes: 27de1978

 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: default avatarPratyush Brahma <quic_pbrahma@quicinc.com>
parent cea98f86
Please register or to comment