| commit | 2eb97c78613082f308c0b39366c034cb589b8ee9 | |
| author | Robin Murphy <robin.murphy@arm.com> | |
| Fri, 4 Dec 2015 17:52:58 +0000 (4 17:52 +0000) | ||
| committer | Will Deacon <will.deacon@arm.com> | |
| Thu, 17 Dec 2015 12:05:34 +0000 (17 12:05 +0000) | ||
| tree | 02407e2cd82ce289806c55c5cc3325e25a397f46 | treesnapshot (tar.gz zip) |
| parent | a0d5c04c6053d8c47cca37384ae472f6b2ee0dee | commitdiff |
iommu/io-pgtable-arm: Avoid dereferencing bogus PTEs
In the case of corrupted page tables, or when an invalid size is given,
__arm_lpae_unmap() may recurse beyond the maximum number of levels.
Unfortunately the detection of this error condition only happens *after*
calculating a nonsense offset from something which might not be a valid
table pointer and dereferencing that to see if it is a valid PTE.
Make things a little more robust by checking the level is valid before
doing anything which depends on it being so.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
In the case of corrupted page tables, or when an invalid size is given,
__arm_lpae_unmap() may recurse beyond the maximum number of levels.
Unfortunately the detection of this error condition only happens *after*
calculating a nonsense offset from something which might not be a valid
table pointer and dereferencing that to see if it is a valid PTE.
Make things a little more robust by checking the level is valid before
doing anything which depends on it being so.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
| drivers/iommu/io-pgtable-arm.c | diffblobblamehistory |