iommu: Fix missing return check of arm_lpae_init_pte
UAF scenario may occur in clients with EL1 privileges for iova mappings when we miss to check the return value of arm_lpae_init_pte which may lead to an PTE be counted as it was set even if it was already existing. This can cause a dangling IOMMU PTE to be left mapped pointing to a freed object and cause UAF in the client if the dangling PTE is accessed after a failed unmap operation. Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47 Fixes: 9913ccceda61 ("qcom-iommu-util: Take a snapshot of the qcom-iommu-util module from msm-5.15") [quic_pbrahma@quicinc.com: Propagated fix to the new file with the bug signature ] Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com> (cherry picked from commit 3cbca5d2 ) Signed-off-by: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
parent
aaf931f1
Please register or sign in to comment