From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f73.google.com (mail-ej1-f73.google.com [209.85.218.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA8A12F3C0E for ; Tue, 26 May 2026 15:19:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779808793; cv=none; b=roCrbnHBjogFz3MDnapvxsPDxuEYI7cmlPXbqcTjiQxs9rzM/S81HVlj6QT1M7sgHY0i/32JVXwPw6wzWvrY8WykIDp0pEhTXzsMp+cRRi1p5WkFwZUdE7AKiPiyomGbEn7+/mlDor3s7nMEGiGiTLMaFBu+PWvVs3PWLh4QB/8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779808793; c=relaxed/simple; bh=QF3GgHGmqxOc2ZiHSwTIFp/SPXOTLWdRiKhIV8Khm7E=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=dfOLUryUanrr+no5Ap0tlO8j3BZFu6/YIH5rck6BIMtoArrYjxmvchbDuymQxH31mTzRbXhlmcrZoCRRhX+AiUYk30ogMt57LJr12Hhc1zKa0VNe2fJ9LR2wnNrHUVFR4JuP33mR0b6cVWaXtTZ7rBYsQvrdRgW+j0uVvY8r44g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=FzO5bKw1; arc=none smtp.client-ip=209.85.218.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--smostafa.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="FzO5bKw1" Received: by mail-ej1-f73.google.com with SMTP id a640c23a62f3a-bd81e585e5fso968625366b.1 for ; Tue, 26 May 2026 08:19:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779808790; x=1780413590; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=UeoRdqb2W8o2rKYS6Num15n8gkt/ODkSyZpzjjpRQD8=; b=FzO5bKw1CuiSa77NGiVOBK0Jh6PoPPE+6ZRGAbCUOT2oFLc3xXO/lfWuVCWaSTWglN Lev+JciHzOervVGjzfDaIEbwORZgdMEf/nj9buZljDIxaMf3RxRyheNCTVTgEd6ZZoLf gMSf9INNkAnLhbqBHnLHwxE7kvpvz2Duul90Qg2rZEt3MHJtSZr5cpmYjI0viQQaANYv FHEFBX4k9lbj+xzKoNx666syaFl7o77EigP9zNT3OonNgjGDVurSCkgWQyZAX0meW86y mwRJGAIGqWiB0oTXPJe6n3LsUrFhg3JnV4IWt7PJpbQ18X2o7hT3a1wwPveFC2rm8BYu nnxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779808790; x=1780413590; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=UeoRdqb2W8o2rKYS6Num15n8gkt/ODkSyZpzjjpRQD8=; b=gAwd1XIgWA9+56/2j1fuvPTKbiMAzCMbT26Kgz9gpsvgOUg/IT9WWTBl7smYL3Hg77 6cVo9y5hXwIqXN20s9ZJ26i/aiCatuglH5QldK38/F2QMTbL2mdXfh5qR0IEmQbMH0qH woSTe+f/0+carLOCbULT9RDqTwlWZKUoeCxYq/JtwtufemGlqEnaSydjB8zIeJ9kutP0 FR+ybUhzDkS+I2ar6MSWx0assSex9CuP5Et5KurtC17PXb1AR7F9BbplNAiUufestZ5P MrICjvTPpLS/f4zcRZKly+PwQC3aPXm3xNMumPJ7fvuoOEcZzIHSeTTVTmucKEFxO+i8 ub9Q== X-Forwarded-Encrypted: i=1; AFNElJ/XxqjUaQ/SWKe7EHa06aD+2hjbPfcwL5s/yCQVIB755EwhQR4Xr9lFDHy2ZMS1ScZyKGjnqQyP3AJf9Ok=@vger.kernel.org X-Gm-Message-State: AOJu0YxQ2h0o+dRCY2myupfuy21j7AECyhlzdEr8zXJ7LAKaW/ANy+YY 42V7S7m7mZmi3EeBgw0rTVAy7bCDcduvbtvvM2vBlQDrQ/6rbj7xoQWsOqwbMT77Qzaso9dvZVV Zo2HMW+PA5jrniw== X-Received: from edbcr16.prod.google.com ([2002:a05:6402:2230:b0:687:17de:d8b5]) (user=smostafa job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:5107:b0:67e:96a8:40d0 with SMTP id 4fb4d7f45d1cf-6889cc429a0mr6652238a12.21.1779808790002; Tue, 26 May 2026 08:19:50 -0700 (PDT) Date: Tue, 26 May 2026 15:19:32 +0000 In-Reply-To: <20260526151934.3783707-1-smostafa@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260526151934.3783707-1-smostafa@google.com> X-Mailer: git-send-email 2.54.0.746.g67dd491aae-goog Message-ID: <20260526151934.3783707-5-smostafa@google.com> Subject: [PATCH v5 4/6] KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() From: Mostafa Saleh To: op-tee@lists.trustedfirmware.org, linux-kernel@vger.kernel.org, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: maz@kernel.org, oupton@kernel.org, joey.gouly@arm.com, suzuki.poulose@arm.com, catalin.marinas@arm.com, jens.wiklander@linaro.org, sumit.garg@kernel.org, sebastianene@google.com, vdonnefort@google.com, sudeep.holla@kernel.org, Mostafa Saleh Content-Type: text/plain; charset="UTF-8" Sashiko (locally) reports out of bound write possiblity if SPMD returns an invalid data. While SPMD is considered trusted, pKVM does some basic checks, for offset to be less than or equal len. However, that is incorrect as even if the offset is smaller than len pKVM can still access out of bound memory in the next ffa_host_unshare_ranges(). Split this check into 2: 1- Check that the fixed portion of the descriptor fits. 2- After getting reg, check the variable array size addr_range_cnt fits. Also, drop the WARN_ONs as that will panic the kernel and in the next checks there are no WARNs, so that makes it consistent. Signed-off-by: Mostafa Saleh --- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 1af722771178..b6cf9ad82e12 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -607,8 +607,8 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, * check that we end up with something that doesn't look _completely_ * bogus. */ - if (WARN_ON(offset > len || - fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE)) { + if (offset + CONSTITUENTS_OFFSET(0) > len || + fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) { ret = FFA_RET_ABORTED; ffa_rx_release(res); goto out_unlock; @@ -641,6 +641,11 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, goto out_unlock; reg = (void *)buf + offset; + if (offset + CONSTITUENTS_OFFSET(reg->addr_range_cnt) > len) { + ret = FFA_RET_ABORTED; + goto out_unlock; + } + /* If the SPMD was happy, then we should be too. */ WARN_ON(ffa_host_unshare_ranges(reg->constituents, reg->addr_range_cnt)); -- 2.54.0.746.g67dd491aae-goog