From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97F27322C67 for ; Wed, 20 May 2026 20:49:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779310198; cv=none; b=mOKK9yvM8AUWkZMrS9dbR+yrl1pGbgcqyb5JRizZyPLJQRwbouLw6LgE4++HIFSWg/fvzwM46uuEzQsfTH7lcNsSdGe0sGqWLAcnqAD8RB9n3YhNq4o7om5KQg7kjuOcDxPP5IK0Zy3EYrcQcd2Zu+HbI2kYn8IROWqqc022D6c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779310198; c=relaxed/simple; bh=+odcoytO7t3DOoLwKe5U/Z+LXQDQFnA0EDO6/U8yfWg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Y8KAdgWkEnseBljOJx5pdxqOfKjiBs0SZ4DJ5TJUfLZ0ZuKrAuI4DddjgrUYJ4W7Pgnk2I8fFqmqXYEmrP8JJuqZKPX4b3uNCn+qiEKg5xp61dIAjipgoB4yKxzVcSoibs5wpg/luA86jkubwZNchEL6tb8SLlQoGCZryHgWslg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RhmosyOo; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RhmosyOo" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-48fd2b502e2so46231105e9.2 for ; Wed, 20 May 2026 13:49:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779310195; x=1779914995; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=Ov2SNTUzKC8oN0Fvl8Z8REa9PXSOlA6pzj2Ni/hPKe8=; b=RhmosyOod/9IyXpshdKPHjwnjsIRHNUOMmit3h07e9CkZI4Nj8TkkaF6VPcBv6UbQI Qkqp++gVz7MRWY9gXnsWcGXzObgc+aC0ZB+Us0v1OAhBZyYxSNuly8Jo4GGhgQRb2NJp vED69QHpjaKRIXwNEihiYQ+gF94AB3mVr0SCJ3PK5lFRbjsCMVr1psl5nNE9dj0QT/xk Zod2ds5Mmp6xn99JuHDov7iYbC450zhqezFbpxnP+GfgCpZRKmyffGgY0KRAGYtB6wsv lXpclCLiifCiWpEJxx1rgMsPsKTDxX5f2bBokiGrLGkOpiJmPv+YXfdc7/H/2BeokCN+ zajg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779310195; x=1779914995; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Ov2SNTUzKC8oN0Fvl8Z8REa9PXSOlA6pzj2Ni/hPKe8=; b=bRj26w/eddQ+1SxhvyFVemN82d6ProEpPScafXmAXeJntSVoK4XqcoKmA9e2sRRZXJ 78xQI23EBtaEM8blIeK7A63+6F6nhzYg/YkyOXoaxwKHHgwzXSwKl7DGBhyYx39b1QGY LJE/QmgtVgR2sN1x/7KvvigT2+44epAvkGuaxwnQcsJZgZGPvuMUqaRL62iYXUGdkRAg +ARlXHshAx7I0gzNwhmHmGzZs+g/X6i6UGc/7fyAKH7HKeTAzNJdvy7dwBJSRUVvRYdD tM2A9MXqZ5b8jGgTlawFfWzWANS+DegAKEjqvuPxUUFXHJH/UqZ8jifq8Pk05n/ykCVO Zl8A== X-Forwarded-Encrypted: i=1; AFNElJ+Nqgg1+i5TSM/8bRo2zCQeru4XALX/BTgelugNs2dRpJXmly8IoV1mo75TpDORM74+A0JepX51spNgFd0=@vger.kernel.org X-Gm-Message-State: AOJu0YzJYuXaNlWYssNw2IQlKdDjZR9lHoyRN503NnJPuXOCqYcltv4Q xuW2vxptgiJA9DEAsftEKe5mZL5CarhITuOV3KQVMNB/pPIUxWvfqirMY87EetX1tKQ0ggivoiC LemgG0O2RD77MKw== X-Received: from wmrc10.prod.google.com ([2002:a05:600c:aca:b0:485:3a2f:2f7e]) (user=smostafa job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8b75:b0:488:7ff6:1f75 with SMTP id 5b1f17b1804b1-48fe6321cdamr430534835e9.21.1779310195138; Wed, 20 May 2026 13:49:55 -0700 (PDT) Date: Wed, 20 May 2026 20:49:45 +0000 In-Reply-To: <20260520204948.2440882-1-smostafa@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260520204948.2440882-1-smostafa@google.com> X-Mailer: git-send-email 2.54.0.669.g59709faab0-goog Message-ID: <20260520204948.2440882-3-smostafa@google.com> Subject: [PATCH v4 2/5] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() From: Mostafa Saleh To: op-tee@lists.trustedfirmware.org, linux-kernel@vger.kernel.org, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: maz@kernel.org, oupton@kernel.org, joey.gouly@arm.com, suzuki.poulose@arm.com, catalin.marinas@arm.com, jens.wiklander@linaro.org, sumit.garg@kernel.org, sebastianene@google.com, vdonnefort@google.com, sudeep.holla@kernel.org, Mostafa Saleh Content-Type: text/plain; charset="UTF-8" Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable. Signed-off-by: Mostafa Saleh --- drivers/firmware/arm_ffa/driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index eb2782848283..b700b2e93e72 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -697,11 +697,10 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, for (idx = 0; idx < args->nattrs; idx++) { ep_mem_access = buffer + ffa_mem_desc_offset(buffer, idx, drv_info->version); + memset(ep_mem_access, 0, ffa_emad_size_get(drv_info->version)); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; - ep_mem_access->flag = 0; - ep_mem_access->reserved = 0; ffa_emad_impdef_value_init(drv_info->version, ep_mem_access->impdef_val, args->attrs[idx].impdef_val); @@ -741,7 +740,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } - if ((void *)constituents - buffer > max_fragsize) { + if ((void *)constituents + sizeof(*constituents) - buffer > max_fragsize) { pr_err("Memory Region Fragment > Tx Buffer size\n"); return -EFAULT; } @@ -750,7 +749,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; constituents->reserved = 0; constituents++; - frag_len += sizeof(struct ffa_mem_region_addr_range); + frag_len += sizeof(*constituents); } while ((args->sg = sg_next(args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len, -- 2.54.0.669.g59709faab0-goog