diff options
| author | Pratyush Brahma <quic_pbrahma@quicinc.com> | 2023-09-15 16:14:49 +0530 |
|---|---|---|
| committer | Sambandam Chitra <quic_schitra@quicinc.com> | 2023-09-25 08:21:50 -0700 |
| commit | 90c0b22b18f722de89a32c2bc221319e60bc3c47 (patch) | |
| tree | 5189c9d4a69ada3125ee89a982990653c2873097 /sound/drivers/mtpav.c | |
| parent | e1067566ad54a6a299c182b305449c060e3e8220 (diff) | |
iommu: Fix missing return check of arm_lpae_init_pte
UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.
Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
(cherry picked from commit b1405fc833e94c7b69fd4a63ed204407284a58dc)
Diffstat (limited to 'sound/drivers/mtpav.c')
0 files changed, 0 insertions, 0 deletions