From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E394368D5E for ; Thu, 11 Jun 2026 20:19:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781209172; cv=none; b=JoMVZfIEJalq+kTJ1zfmGojxGsdWkNIeI8yylFpL6h3Pk6dSmN4ZbYvMz6EsMwPvomBX6WHkqJEzYA2SCrS8RqzpyR4pYyiYCNCB6bIH5MQn3ULVTORquto1BMxyk1VqIGU7rzXaIORSS/7XgqrSwdLUek2UGunQOWIrtFs6yA8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781209172; c=relaxed/simple; bh=ZOe2EDXU3HvsveItcr3dovmSWgaERH0mLdAj1V10jA8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=j7VPrMnBIGqua1Z+t+P8U4gal3KLFdxmM0OcFtFZlLdq5wc4vTuUXFD5YqRyoX+CHNICz/CpzJ5xTgrDbzwIk1D/gQdENT5Xnl5zexE1mZLbCvAYipYA/rExTztp3AhAK9/SOvc8gvGewoYiBnnsSfgdRyWbP7kP0QS0HkW/0JE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=BeHWUk6n; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=HXFrf0PH; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="BeHWUk6n"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="HXFrf0PH" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65BJ3EBT4109737 for ; Thu, 11 Jun 2026 20:19:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=xsHObREKbSdD+QU63I499i xe+MAp/Ig/XpnZqBETjO0=; b=BeHWUk6nMly+ArnGiv5yR0XoL5qDVISJ2LohnU 3SWuptIr1ybJRqcUIZ5VbVM74jhT0MUdjXWrt1iOKYs8nKVXQ30O+2OMyKvkt6Qf BsatV9aaA9Io1R60grJ53X25Kv7GbqPQvQhzlM5ivWoXuBrhrXmQIzf1LWEF013y mUcNQ3TQkSDk1r1t1VA8OLdwgBavOM6k52zAdX2vyB6NaiDlin1qzPPsQsPlTfkt PHL7X4QizfKxwWGU2z4hccWkXCRHRepzaGIsbCU7N9vjdjkg1Zh5IUf2gKTEhr2Z 8Gx5lakHdG7nXB0ILB7IGfFk+V355UppxooUh5o5rdLHPH7w== Received: from mail-dl1-f69.google.com (mail-dl1-f69.google.com [74.125.82.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4er014h7v9-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 11 Jun 2026 20:19:30 +0000 (GMT) Received: by mail-dl1-f69.google.com with SMTP id a92af1059eb24-137e49e896aso1247815c88.0 for ; Thu, 11 Jun 2026 13:19:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781209169; x=1781813969; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=xsHObREKbSdD+QU63I499ixe+MAp/Ig/XpnZqBETjO0=; b=HXFrf0PHxue31vR8X0qhRJqWGLSKzz5h6kokDd0739p70g8cxYdOZgaHa4fYcURGdD D49yW/3PalV7eZHTpZcPHqKn1PWssRj46HLIki2gZiVWizcmO9laKoZLYEt/nJ8FxmQY l0fjUiwNhyjqnfWNttE8daVSXbFUlJWhCdRUFS5G157Et9kkUjkUBwhK2Qv3qUlgkn8c HogmlCBE13TuG4kyrN9blWlpWKMTZzU4FWoPw3qfxToIKKkLJl5ND4YN2Z/uajzXE0If jUJ7Vmfis1hZY5mYfO5Y83Irg4iZH1Jk9JlIK1ZtxhsJcfgFx8HkimrgDL1mOUJmEiXj Irtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781209169; x=1781813969; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xsHObREKbSdD+QU63I499ixe+MAp/Ig/XpnZqBETjO0=; b=hMtOMUeW+Uw8SNEeX8g/O/N8AIX+P1YcZzzBQ6ra4TfqN4MFwJdPBp0aPJU9YAOR6Y sOtFPM7yz7gSyf9bPdGk/5+paF1FQPN91tN31JSsal9v1m1GSKfNKoE0KbfOr1+qyfLT P1iaYTZnPMIRB5ef+SsvPLRmDatIRlr+KfcJVJeXUB1Q66UJjjrA1oKsCYr4iIsgee4p +pPNLxxSt+gd+Dv34mXx+xIME/69+H4tjp4wBheR9QrfUM0uVuOfX7ZNCEr+e36LMVDo FUw67tBHnE3EPX9+vdOOdJ97JkA814HaoWi+rQ6CkKk1jbKn7qOjYp5JSEcwPwII6MCy EStg== X-Forwarded-Encrypted: i=1; AFNElJ9HRWEqNDH1v05JlMn9opbhwpM0gWITYi1LuoeXwmuZV7b8Jjlt3HBTbPWZha2J+Iy34X0RvTZSVIPlRbw=@vger.kernel.org X-Gm-Message-State: AOJu0Yw6SeeiWO3gMP27w8Hn3WtGvknTXlklcgEqQ0baQBBsI6GJPViu Gy9ZgFGwi2oIngFTVUhWFol0yB4cOS+s3Rg89MX8KzMdkad1E5x+3E1Qx9+1oVJGTMfcXdwYOM8 Kieu5uUh9ylg/K17rTxOBfR561K5OMPru1BsHrCXdzvxJXXJC97kOnljh8NGuPBHD+21NsYZKCl w= X-Gm-Gg: Acq92OGX46oIfKFHi3/RsOoParl0L8Hbw3Mm4+U9qIElw6IOzjInoFejv8ZwVd4eELT KhtLt9hHe/iwl1YM1/xgxM8OkLYBuDTIj6Q5K+tEW0SZZyMxcNRcrVi17QnjQSOFgWzqshOfqEo YCaDfyXoJFsdaUjh/wng3V4iuhUVxrpkiGBiRK6bPI3BmAash4p3J0m17v7lFDPAgdDiLJf7TR7 DZs4ToTJz+1bx7fcuhyENUTwpQr//mK/uQ2IPYOZ3Du3iYIki1yTklEpBwNrlfQvGoMoqJs0vPO /gvIM6PSiqnImWH2XSWijbufyJCkMhLyhC6v3X+24FmeHu6mq+spvI2DmOEwaP4VFE4fPdFnnz2 eJvFQRUEmWSCCtbEvTHsSe/fSjeEPm5RGvF3l5Yet4/lZXGHhGK5rD2hQ396UWkK/fj55HbPDyi axjQDNRBBDrarH X-Received: by 2002:a05:7022:684:b0:138:e4:c4b5 with SMTP id a92af1059eb24-1384b41db5cmr168609c88.17.1781209169461; Thu, 11 Jun 2026 13:19:29 -0700 (PDT) X-Received: by 2002:a05:7022:684:b0:138:e4:c4b5 with SMTP id a92af1059eb24-1384b41db5cmr168584c88.17.1781209168884; Thu, 11 Jun 2026 13:19:28 -0700 (PDT) Received: from hu-uchalich-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1384302569dsm2658204c88.10.2026.06.11.13.19.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Jun 2026 13:19:28 -0700 (PDT) From: Unnathi Chalicheemala Date: Thu, 11 Jun 2026 13:19:17 -0700 Subject: [PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20260611-ffa_partition_nullptr_fix-v1-1-ec2b7ef7e130@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAEQYK2oC/yWMUQrCMBAFr1L220BMZQteRSQkddOulBg2qQild 3e1n/N4MxtUEqYK124DoTdXfmWF86mDcQ55IsMPZXDWoUV7MSkFX4I0bvr0eV2W0sQn/hjE1A8 xOuxtBPWLkM7/9u1+cF3jk8b2C8K+fwEThrsxfQAAAA== X-Change-ID: 20260604-ffa_partition_nullptr_fix-66f37bb2630b To: Sudeep Holla , Jens Wiklander Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org, kernel@oss.qualcomm.com, Trilok Soni , Satya Durga Srinivasu Prabhala , Unnathi Chalicheemala X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1781209168; l=1739; i=unnathi.chalicheemala@oss.qualcomm.com; s=20240202; h=from:subject:message-id; bh=ZOe2EDXU3HvsveItcr3dovmSWgaERH0mLdAj1V10jA8=; b=CZMhPQ3XeMogd808DQ+L5MTnTajxIAoKl+ZCFcUm46ejXXYUO9Pe3NeRdx4uXtIv77FJ67O9k awkaH8lBTMSCmpe46Wc9bROjAghTcsxdOBOi3kGJU8aODjwdv3Wiz0v X-Developer-Key: i=unnathi.chalicheemala@oss.qualcomm.com; a=ed25519; pk=8n+IFmsCDcEIg91sUP/julv9kf7kmyIKT2sR+1yFd4A= X-Proofpoint-GUID: NXDzjVbb6jEzuHBCyHAc1FmsPcCpZyxp X-Proofpoint-Spam-Info: AW1haW4tMjYwNjExMDIwNCBTYWx0ZWRfX5AiVc8ZER0mj xEBiGRoDNj9v905CMFTMbuGrPTsbCySzE8x9tA+3IMYtmrAq3yupCRoWxPkEG+rYI4KpyuwxTxt gceNG+iuieK85n4e//ASJVXyVtB/Nvg= X-Authority-Analysis: v=2.4 cv=Qp9uG1yd c=1 sm=1 tr=0 ts=6a2b1852 cx=c_pps a=kVLUcbK0zfr7ocalXnG1qA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=EUspDBNiAAAA:8 a=DNyTkGw6iCim7eFMS8gA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=vr4QvYf-bLy2KjpDp97w:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjExMDIwNCBTYWx0ZWRfX6cJ75+y4EB6s y3G0xt5SIguz+b8SJUMjmGi7RoZvxKAcXIMYFrnqFN+eGaXk2U4RiWM30eSAkOm2J+PQJzffmZ4 ZkbHa2aUKgVrOSIoQQsywZdhqPKZ41bqJZOCX4VEytuJ8xmBVt4agXwg9Lw9vcEnFJKwKYEUuam BiZ4GO2z8QYaBdmIBiE+n74+N1aIKHj9Qi3guNd4YRcy00r/lk2sHYavOY3UTOHu3udK3zHm/lq F/Pkuo/bzwOaC1+pem61WntOJWc9cb92HdbRSrMAyqVX4ZyWwJ0u7ofmwSAabeGtZRzWJiSvLbO nBP57DX3UZ4CRFr66V8T9cNakOe4mtmaF8z1F6YR7PZCgoioJ1UceVvT1D13JCEb9lIU+UHyOgp tHTsHjLyATGmSAtDe7EYd316VbgNfof7mXsXLzbOC+5X/70/lRocWeeWkdx9rZMPx1AQRrlnvdY akRuS9buQNxNtze0Y8A== X-Proofpoint-ORIG-GUID: NXDzjVbb6jEzuHBCyHAc1FmsPcCpZyxp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-11_04,2026-06-11_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 adultscore=0 bulkscore=0 clxscore=1011 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606040000 definitions=main-2606110204 ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL (or an empty string), uuid_parse() → __uuid_parse() → uuid_is_valid() dereferences the pointer, causing a kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 pc : uuid_parse+0x40/0xac lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Per the FF-A spec, the all-zeros UUID is the defined wildcard that instructs the SPMC to return information for all partitions. Map NULL and empty string to uuid_null rather than crashing in uuid_parse(), preserving the intended "return all partitions" semantics for callers that pass NULL. Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions") Signed-off-by: Unnathi Chalicheemala --- drivers/firmware/arm_ffa/driver.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index b9f17fda7243..dd500fb81b79 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -1129,7 +1129,9 @@ static int ffa_partition_info_get(const char *uuid_str, uuid_t uuid; struct ffa_partition_info *pbuf; - if (uuid_parse(uuid_str, &uuid)) { + if (!uuid_str || uuid_str[0] == '\0') { + uuid = uuid_null; + } else if (uuid_parse(uuid_str, &uuid)) { pr_err("invalid uuid (%s)\n", uuid_str); return -ENODEV; } --- base-commit: ba3e43a9e601636f5edb54e259a74f96ca3b8fd8 change-id: 20260604-ffa_partition_nullptr_fix-66f37bb2630b Best regards, -- Unnathi Chalicheemala