Skip to content
Commit f7caa0d0 authored by Pratyush Brahma's avatar Pratyush Brahma Committed by Bibek Kumar Patro
Browse files

iommu: Fix missing return check of arm_lpae_init_pte


UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.

Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Fixes: 9913ccceda61 ("qcom-iommu-util: Take a snapshot of the qcom-iommu-util module from msm-5.15")
[quic_pbrahma@quicinc.com: Propagated fix to the new file
 with the bug signature ]
Signed-off-by: default avatarPratyush Brahma <quic_pbrahma@quicinc.com>
(cherry picked from commit 3cbca5d2

)
Signed-off-by: default avatarBibek Kumar Patro <quic_bibekkum@quicinc.com>
parent aaf931f1
Please register or to comment