From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E716376A10 for ; Wed, 20 May 2026 20:49:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779310200; cv=none; b=W4Sfwb+hPCN2AaBlSyKW+Rb8tlHTUlXnCgZUxh8LOMDOSMm8lzgOvCdc3h4VeZ7n889BaJPClHWU3iWqZ01AdJWwzdx3rOPfrAQTB5NGsJVadzvpsScTBWawNSxwU3KEFZfmpZp/G8P30dpmKogUNbcDDAX+WnN72137xK0E94o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779310200; c=relaxed/simple; bh=yDqwfpq2LumKo+eR1zTPgnIkRGiNvFK7fJiI/Swmg4c=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=gcnjGYZIV61+45fgDANnCM2f1tmVNVNBPt+e5mVvmSqY//iDNPDjHBSEGKfxw593QWi1bm3aKQdoHMbeqJitfewBiVM/9/sgBi6hNd/QpBgOZZDi/QH1xAYiAx0G6Cy8FbOWcThl8ZUneqJF3fIIP6q8Rj2PXerzvFhSu3vnfQU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=GcBn5/2C; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="GcBn5/2C" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-48feb8b9acfso31704955e9.3 for ; Wed, 20 May 2026 13:49:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779310198; x=1779914998; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=J5sFw8Sj0s1wSBlDG0qQA5R+qSlafViNaiQqa98n5zM=; b=GcBn5/2Cl/NzAj/fx4XXByU6o9FzuH3DJ95lJDEHVAaFeaxEeIV96seZtX1PA+YRc+ dJFEx435nvMuNTg/Cu5H8pqn66KBcJ8Zns/2g/QLx+75L0zgbSNbF1Cdx2+FT0iCgii0 VhOtQNsG736ItgF383Tsj18EzcQNK1OkKQf8b9oNys5yS2cGkQ3XzS5KZcv7macLPMvX QmpxSBNFdakdRS3s2H4NGxU81iaMDp+lbtbysp9l2koBQAKXCqiADR9Bo3xkB6apzewC rZf2Lcti6P3wBMTnb7T/B5yqbcsSMNkh/k01YXKJkQLSJmVeegyPGDaaTrJiF8ReiSnO EZjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779310198; x=1779914998; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=J5sFw8Sj0s1wSBlDG0qQA5R+qSlafViNaiQqa98n5zM=; b=Vu5cdqEAlS4F6nrAnh/4vrmJEdB17MOv6sq7SCARfpcO3HwdLtH9+xg7R81XQMDQm9 IPr9p94dWAohcE3++SL8avT8bJ4hz7VJwxFIRY/WC2eu0ZayT8Wrs93hA3Pgwgpovh/s 1Pyh4eufUEkd9Zme/VDenbeYg+IneHjzqiCmzOENkvG7JXq5G5wAYLB/slrP53ynzNn8 Afx5RRn6Hu7K+XjDADr0CwBGz0VYe9rR5v2bzrjcqByvgp1uPM9EIv70LuNtqvtf5o/Y Ev87/r7yWVvG91Ehuiwo85xE9gX8zWN6CzvoAQJPMRLr30YZ8PVkZty+ugH+z5zoXYn5 S/Bg== X-Forwarded-Encrypted: i=1; AFNElJ8eSya5cXN1RAHGg/NaMMzX8ma9YAKqni3M/5/4/kqq062olOdU90lZN/ejOMdrwlhOgAgnnGg6WM4MwFc=@vger.kernel.org X-Gm-Message-State: AOJu0Yywd9eYCCLZN3+ERd42EbEwlEGAhVWu2IAvGgMRHnzTkcgqMuOi 9QxXasgNv0+fdGFFhB5U72Mg+qmCPFx86Sr5SL6KgCCCLWBzivS91t6xQnzccYByFR4rMjS4B7W J71DCN6e7kBOYnA== X-Received: from wmlf11.prod.google.com ([2002:a7b:c8cb:0:b0:488:c011:ff58]) (user=smostafa job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8189:b0:48e:89f9:9408 with SMTP id 5b1f17b1804b1-48fe632374fmr370978765e9.20.1779310197436; Wed, 20 May 2026 13:49:57 -0700 (PDT) Date: Wed, 20 May 2026 20:49:47 +0000 In-Reply-To: <20260520204948.2440882-1-smostafa@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260520204948.2440882-1-smostafa@google.com> X-Mailer: git-send-email 2.54.0.669.g59709faab0-goog Message-ID: <20260520204948.2440882-5-smostafa@google.com> Subject: [PATCH v4 4/5] KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() From: Mostafa Saleh To: op-tee@lists.trustedfirmware.org, linux-kernel@vger.kernel.org, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: maz@kernel.org, oupton@kernel.org, joey.gouly@arm.com, suzuki.poulose@arm.com, catalin.marinas@arm.com, jens.wiklander@linaro.org, sumit.garg@kernel.org, sebastianene@google.com, vdonnefort@google.com, sudeep.holla@kernel.org, Mostafa Saleh Content-Type: text/plain; charset="UTF-8" Sashiko (locally) reports out of bound write possiblity if SPMD returns an invalid data. While SPMD is considered trusted, pKVM does some basic checks, for offset to be less than or equal len. However, that is incorrect as even if the offset is smaller than len pKVM can still access out of bound memory in the next ffa_host_unshare_ranges(). Split this check into 2: 1- Check that the fixed portion of the descriptor fits. 2- After getting reg, check the variable array size addr_range_cnt fits. Signed-off-by: Mostafa Saleh --- arch/arm64/kvm/hyp/nvhe/ffa.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 1af722771178..e6aa2bfa63b1 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -607,7 +607,7 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, * check that we end up with something that doesn't look _completely_ * bogus. */ - if (WARN_ON(offset > len || + if (WARN_ON(offset + CONSTITUENTS_OFFSET(0) > len || fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE)) { ret = FFA_RET_ABORTED; ffa_rx_release(res); @@ -641,6 +641,11 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, goto out_unlock; reg = (void *)buf + offset; + if (WARN_ON(offset + CONSTITUENTS_OFFSET(reg->addr_range_cnt) > len)) { + ret = FFA_RET_ABORTED; + goto out_unlock; + } + /* If the SPMD was happy, then we should be too. */ WARN_ON(ffa_host_unshare_ranges(reg->constituents, reg->addr_range_cnt)); -- 2.54.0.669.g59709faab0-goog