[PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

[PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

[Unnathi Chalicheemala]

ffa_partition_info_get() passes uuid_str directly to uuid_parse()
without a NULL check. When a caller passes NULL (or an empty string),
uuid_parse() → __uuid_parse() → uuid_is_valid() dereferences the
pointer, causing a kernel panic:

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000040
pc : uuid_parse+0x40/0xac
lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]

Per the FF-A spec, the all-zeros UUID is the defined wildcard that
instructs the SPMC to return information for all partitions. Map NULL
and empty string to uuid_null rather than crashing in uuid_parse(),
preserving the intended "return all partitions" semantics for callers
that pass NULL.

Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions")
Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
---
 drivers/firmware/arm_ffa/driver.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index b9f17fda7243..dd500fb81b79 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -1129,7 +1129,9 @@ static int ffa_partition_info_get(const char *uuid_str,
 	uuid_t uuid;
 	struct ffa_partition_info *pbuf;
 
-	if (uuid_parse(uuid_str, &uuid)) {
+	if (!uuid_str || uuid_str[0] == '\0') {
+		uuid = uuid_null;
+	} else if (uuid_parse(uuid_str, &uuid)) {
 		pr_err("invalid uuid (%s)\n", uuid_str);
 		return -ENODEV;
 	}

---
base-commit: ba3e43a9e601636f5edb54e259a74f96ca3b8fd8
change-id: 20260604-ffa_partition_nullptr_fix-66f37bb2630b

Best regards,
--  
Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>

Re: [PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

[Sudeep Holla]

On Thu, Jun 11, 2026 at 01:19:17PM -0700, Unnathi Chalicheemala wrote:
> ffa_partition_info_get() passes uuid_str directly to uuid_parse()
> without a NULL check. When a caller passes NULL (or an empty string),
> uuid_parse() → __uuid_parse() → uuid_is_valid() dereferences the
> pointer, causing a kernel panic:
> 
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000040
> pc : uuid_parse+0x40/0xac
> lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
> 

The above is very valid issue and needs to be addressed.

> Per the FF-A spec, the all-zeros UUID is the defined wildcard that
> instructs the SPMC to return information for all partitions. Map NULL
> and empty string to uuid_null rather than crashing in uuid_parse(),
> preserving the intended "return all partitions" semantics for callers
> that pass NULL.
> 

Agreed on the spec part but not w.r.t the interface. Where is the driver
using this call and why is it sending null or wants to extract all the
partition information ?

> Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions")
> Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
> ---
>  drivers/firmware/arm_ffa/driver.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
> index b9f17fda7243..dd500fb81b79 100644
> --- a/drivers/firmware/arm_ffa/driver.c
> +++ b/drivers/firmware/arm_ffa/driver.c
> @@ -1129,7 +1129,9 @@ static int ffa_partition_info_get(const char *uuid_str,
>  	uuid_t uuid;
>  	struct ffa_partition_info *pbuf;
>  
> -	if (uuid_parse(uuid_str, &uuid)) {
> +	if (!uuid_str || uuid_str[0] == '\0') {
> +		uuid = uuid_null;

I object to make it uuid_null. Below check is enough to check NULL
dereference.

-       if (uuid_parse(uuid_str, &uuid)) {
+       if (!uuid_str || uuid_parse(uuid_str, &uuid)) {


I don't think we need to service NULL as valid argument via this interface
as the callee driver needs to pass its partition UUID here.

-- 
Regards,
Sudeep

Re: [PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

[Unnathi Chalicheemala]

On 6/12/2026 3:55 AM, Sudeep Holla wrote:
> 
>> Per the FF-A spec, the all-zeros UUID is the defined wildcard that
>> instructs the SPMC to return information for all partitions. Map NULL
>> and empty string to uuid_null rather than crashing in uuid_parse(),
>> preserving the intended "return all partitions" semantics for callers
>> that pass NULL.
>>
> 
> Agreed on the spec part but not w.r.t the interface. Where is the driver
> using this call and why is it sending null or wants to extract all the
> partition information ?
> 

A developer wanting all partitions might reasonably pass the all-zeros string
"00000000-0000-0000-0000-000000000000"? 

>> Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions")
>> Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
>> ---
>>  drivers/firmware/arm_ffa/driver.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
>> index b9f17fda7243..dd500fb81b79 100644
>> --- a/drivers/firmware/arm_ffa/driver.c
>> +++ b/drivers/firmware/arm_ffa/driver.c
>> @@ -1129,7 +1129,9 @@ static int ffa_partition_info_get(const char *uuid_str,
>>  	uuid_t uuid;
>>  	struct ffa_partition_info *pbuf;
>>  
>> -	if (uuid_parse(uuid_str, &uuid)) {
>> +	if (!uuid_str || uuid_str[0] == '\0') {
>> +		uuid = uuid_null;
> 
> I object to make it uuid_null. Below check is enough to check NULL
> dereference.
> 
> -       if (uuid_parse(uuid_str, &uuid)) {
> +       if (!uuid_str || uuid_parse(uuid_str, &uuid)) {
> 
> 
> I don't think we need to service NULL as valid argument via this interface
> as the callee driver needs to pass its partition UUID here.
> 
I agree with you, NULL doesn't seem like a valid use case.

Will send another version with your suggestion, thank you for the review.

Regards,
Unnathi

Re: [PATCH] firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

[Sudeep Holla]

On Tue, Jun 16, 2026 at 02:14:59PM -0700, Unnathi Chalicheemala wrote:
> On 6/12/2026 3:55 AM, Sudeep Holla wrote:
> > 
> >> Per the FF-A spec, the all-zeros UUID is the defined wildcard that
> >> instructs the SPMC to return information for all partitions. Map NULL
> >> and empty string to uuid_null rather than crashing in uuid_parse(),
> >> preserving the intended "return all partitions" semantics for callers
> >> that pass NULL.
> >>
> > 
> > Agreed on the spec part but not w.r.t the interface. Where is the driver
> > using this call and why is it sending null or wants to extract all the
> > partition information ?
> > 
> 
> A developer wanting all partitions might reasonably pass the all-zeros string
> "00000000-0000-0000-0000-000000000000"?

I understand that and the core driver does exactly this when initialising
to enumerate all the partitions on the system. But you didn't answer my
question as where is the FF-A client driver pass NULL ? You just expressed
the possibility here.


[...]

> > I object to make it uuid_null. Below check is enough to check NULL
> > dereference.
> > 
> > -       if (uuid_parse(uuid_str, &uuid)) {
> > +       if (!uuid_str || uuid_parse(uuid_str, &uuid)) {
> > 
> > 
> > I don't think we need to service NULL as valid argument via this interface
> > as the callee driver needs to pass its partition UUID here.
> > 
> I agree with you, NULL doesn't seem like a valid use case.
> 
> Will send another version with your suggestion, thank you for the review.
> 

Thanks!

-- 
Regards,
Sudeep