diff options
| author | Pratyush Brahma <quic_pbrahma@quicinc.com> | 2023-09-15 16:14:49 +0530 |
|---|---|---|
| committer | Georg Veichtlbauer <georg@vware.at> | 2023-11-08 17:53:52 +0100 |
| commit | a5f115be51ad8f5b1a714ca786ac517b3dc452f8 (patch) | |
| tree | 1c13cb980cb92548f53c61624d2506bab8cdf477 /tools/perf/scripts/python | |
| parent | 51b6076835ef093f89aca3d819156b7d8f06752d (diff) | |
iommu: Fix missing return check of arm_lpae_init_pte
UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.
Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
(cherry picked from commit b1405fc833e94c7b69fd4a63ed204407284a58dc)
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions