diff options
| author | Pratyush Brahma <quic_pbrahma@quicinc.com> | 2023-09-15 16:14:49 +0530 |
|---|---|---|
| committer | Sambandam Chitra <quic_schitra@quicinc.com> | 2023-09-25 08:21:50 -0700 |
| commit | 90c0b22b18f722de89a32c2bc221319e60bc3c47 (patch) | |
| tree | 5189c9d4a69ada3125ee89a982990653c2873097 | |
| parent | e1067566ad54a6a299c182b305449c060e3e8220 (diff) | |
iommu: Fix missing return check of arm_lpae_init_pte
UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.
Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
(cherry picked from commit b1405fc833e94c7b69fd4a63ed204407284a58dc)
| -rw-r--r-- | drivers/iommu/io-pgtable-arm.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index 3f1617ca2fc0..137062b22ca9 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -642,9 +642,11 @@ static int arm_lpae_map_sg(struct io_pgtable_ops *ops, unsigned long iova, arm_lpae_iopte *ptep = ms.pgtable + ARM_LPAE_LVL_IDX(iova, MAP_STATE_LVL, data); - arm_lpae_init_pte( + ret = arm_lpae_init_pte( data, iova, phys, prot, MAP_STATE_LVL, ptep, ms.prev_pgtable, false); + if (ret) + goto out_err; ms.num_pte++; } else { ret = __arm_lpae_map(data, iova, phys, pgsize, |