From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 434462F8E9A for ; Tue, 26 May 2026 15:19:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779808790; cv=none; b=hKfXlKH2WNbiH0UguPl6mist00usQLAWLUmYshchoyb/1YOoDdxvNS2K9/LcInOfJ+6IHgyxkP6Jv4OQNhwIxza/dPQYNh+H8szsA3706+qteri5R5TgHkN9dpuP4u26fEsX7kpnQ1pmqPAsyVFjUOdEnH2tD89WEm7XKfjcdwQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779808790; c=relaxed/simple; bh=EdC0W0VohOtxX3lnJG6sv4pnvdbySAnfsJeVaWHFx0w=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=RizYGAYgfzusDn+exDQOCBKREj8NJSMR+ZGf3u2j06tPATd7ySpAzvTXD2+UlDx1q98yzoPUgrWRIz0IICXR8OoaFwRTz8WhczAeLzzsyG/NPd6BiLKV6GPJfyTAyEoFAe+uMbfEBcTZPNZu4PfmHf4DI7RKKCaGkD8zRgPVZpA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=TBdeX8i5; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="TBdeX8i5" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-49048bcbeb8so48530715e9.2 for ; Tue, 26 May 2026 08:19:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779808788; x=1780413588; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=iM960fEPaAF4GKD2H7L6vb8i4u8uWo0JTw5z3e0opLs=; b=TBdeX8i5vhSuWMCPR/z85++QICGX0lH7GAbC42v/K6waIffcOP1ycHjF8pmFHk0dLE KK5nl1UL9Zonxq4VSVfQrTwY9fzKIzW/fBav13BZbn0TaNoT4/EILDVXCDRFTvxqsw8B SMgzspnBjMejsWQbjHxIGK+tUmWkobKhva0QFsdysORBCMzGBeCZ2abh1ojteZuYncvJ /oiFetqFbcJquVNhb6n6xrL+oZM4oHbZ1XoE3+omL8o0KegjZB54Qm7E0oHB3RDmSXy2 tnmArJKUAtxQxvjF5eSRDbXQd+bfBbbRDa/XvkvyPDJWlgCKBg/0kyo+Zb/8GTi4jRYn Z6sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779808788; x=1780413588; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=iM960fEPaAF4GKD2H7L6vb8i4u8uWo0JTw5z3e0opLs=; b=hEYkKJK4ei8qdmuIrjXn59PpFeubWJ+gDtCvv+WTJpvk54irBJBt3dEWrRhq2zpCaE 652MsdC2bliwJ2jbuU4T0i/OVCXy40N50fphCdHmH7NDlQlmbtbYMZS3X8bTfkBdh5W3 6XEFfTZt30zQ9VtwrbYepflfM4TGQnrgFVywOVYIWCtlJ4sPLYWOAk1nKMwJ2b3UVyr7 u0dZNAPT7JVMmAmHmjEwonGc6Tao9suZ8/fY7aai5icD8EYAxnO+B5+XgvuvkXI3l2XR KvM91PtjDCSktlw4TcOcH/pEc0ElnCX/rzwi7TG6IedKwTo0YrQTzSiVrFyOXOk4kSMA /HOA== X-Forwarded-Encrypted: i=1; AFNElJ8C8h6a8/pXcyv5OR++l65fH1awO2sg7ymNFkxHaoXdgFhYE6TuIJmNIX8ozexa0yTWxOlJOed7dHiJ1vU=@vger.kernel.org X-Gm-Message-State: AOJu0YzbEVrjvhQjiG+WPgQtI6dbjWZktmR4VqeNT8kGF6R0DXmw0m32 NGU+XR4tmDZXPe8+OE5CQtDkgwKWmstvAv4r6ZPPdpFIVefTpMS/FlEz4lamia4kcANpFsJY4CH UfyJFywPvSyuX1w== X-Received: from wmni10.prod.google.com ([2002:a05:600c:70a:b0:48a:5334:11e]) (user=smostafa job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:83c8:b0:490:601f:d783 with SMTP id 5b1f17b1804b1-490601fd8f3mr182526495e9.4.1779808787137; Tue, 26 May 2026 08:19:47 -0700 (PDT) Date: Tue, 26 May 2026 15:19:30 +0000 In-Reply-To: <20260526151934.3783707-1-smostafa@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260526151934.3783707-1-smostafa@google.com> X-Mailer: git-send-email 2.54.0.746.g67dd491aae-goog Message-ID: <20260526151934.3783707-3-smostafa@google.com> Subject: [PATCH v5 2/6] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() From: Mostafa Saleh To: op-tee@lists.trustedfirmware.org, linux-kernel@vger.kernel.org, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: maz@kernel.org, oupton@kernel.org, joey.gouly@arm.com, suzuki.poulose@arm.com, catalin.marinas@arm.com, jens.wiklander@linaro.org, sumit.garg@kernel.org, sebastianene@google.com, vdonnefort@google.com, sudeep.holla@kernel.org, Mostafa Saleh Content-Type: text/plain; charset="UTF-8" Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable. Reviewed-by: Sudeep Holla Signed-off-by: Mostafa Saleh --- drivers/firmware/arm_ffa/driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index b9f17fda7243..059e2aae7ca0 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -715,11 +715,10 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, for (idx = 0; idx < args->nattrs; idx++) { ep_mem_access = buffer + ffa_mem_desc_offset(buffer, idx, drv_info->version); + memset(ep_mem_access, 0, ffa_emad_size_get(drv_info->version)); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; - ep_mem_access->flag = 0; - ep_mem_access->reserved = 0; ffa_emad_impdef_value_init(drv_info->version, ep_mem_access->impdef_val, args->attrs[idx].impdef_val); @@ -759,7 +758,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } - if ((void *)constituents - buffer > max_fragsize) { + if ((void *)constituents + sizeof(*constituents) - buffer > max_fragsize) { pr_err("Memory Region Fragment > Tx Buffer size\n"); return -EFAULT; } @@ -768,7 +767,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; constituents->reserved = 0; constituents++; - frag_len += sizeof(struct ffa_mem_region_addr_range); + frag_len += sizeof(*constituents); } while ((args->sg = sg_next(args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len, -- 2.54.0.746.g67dd491aae-goog