tag a2e25e783b35c44afc6a4b48e4e6ebe4a1358674
tagger The Android Open Source Project <initial-contribution@android.com> Tue Feb 06 09:56:29 2024 -0800
object 6283e60455dd7382e9151cf772aaa79d3ebcc6a4

Android 14.0.0 Release 0.46 (UQ1A.240205.002,barbet)

commit 6283e60455dd7382e9151cf772aaa79d3ebcc6a4
author Pindar Yang <pindaryang@google.com> Wed Nov 22 16:58:04 2023 +0800
committer Pindar Yang <pindaryang@google.com> Wed Nov 22 16:58:04 2023 +0800
tree 43a77505ede36f0e3d8ef978fdcf9321739efe53
parent 4017eeae38f06849857a06efb344f25c98ddc0f0

bus: mhi: misc: Add check for dev_rp if it is iommu range or not

er_ctxt->rp pointer is updated by MDM which is untrusted to HLOS,
it could be arbitrary value.

If there is security issue on MDM, and updated pointer which is not
align then driver will never come out of loop where checking against
dev_rp != rp.

So added check to make sure it is in the buffer range & aligned to 128bit.

Bug: 303101658
CRs-Fixed: 3545432
Change-Id: Ib484e07f2c75fcd657a4ccc648a3a20de3edeebc
Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
Signed-off-by: Paras Sharma <quic_parass@quicinc.com>
Signed-off-by: Pindar Yang <pindaryang@google.com>