From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f74.google.com (mail-ej1-f74.google.com [209.85.218.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20EAB3F0761 for ; Wed, 17 Jun 2026 14:51:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781707905; cv=none; b=oyNeIEtrbaOhXZ6dG5QW0Gs/n1d7skl0kyb34wGvnrM+81pD2NkoP6T5AkF3ZQ2Bb00uBHno8wyYhuDMeLYY1syFG41J3yFkVwpPlQtPIZkeIMzAwNWT124v9xR8otvFcuS2aLTPRU2BlVEBOftQP+ze2IT8TcHgMdH7KXYTaLw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781707905; c=relaxed/simple; bh=jloxISYPa8ecyFqGXdFDjWOsBC/fPOUeJSLTxLHPu20=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=LiZHX+S3ry5woBJYKWWFug82sZkoRrXmkxZzFPL1RNyOKqOUm0FX6pttEKAaejvDJHfeynNgDvuK20l9HipWXa0iK/i9khlSbAtkdKoOOzJSeBotin0aIGOpHhBcqIvmV0VE2MM19dWIMd2kURb/Fg6L+KK6f/R9t6bw+16pab0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=OSkYAoMb; arc=none smtp.client-ip=209.85.218.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="OSkYAoMb" Received: by mail-ej1-f74.google.com with SMTP id a640c23a62f3a-bf2dfdc0582so595877366b.3 for ; Wed, 17 Jun 2026 07:51:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781707902; x=1782312702; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=fif2f/B/gn5RkPcFE+VYhypuB1774zSDWaedB+gVp/0=; b=OSkYAoMbHu/tuNwRtMr2nLCgz5pUH/mRATpTawJDtZZY1qVnHxnmmgL8JC6IBdEjes NeG1LLRC0f96qeeE4MBctHz506KkeFCLlg9Naw10NPrh+3O0BAWwTaI8rvB8XFqPHzhq MDBY8pOgK7SkJ0w+r4/gZO0DAbQgC8PQ9jYq6L4G8UOAfzpULKdjoKmmzbrM6LwyyBm1 LOHENFZVChr9F5dcdl1A8gjg6xKAivrCb30jt82gizLdorO/8JXZcpI4nD5bIPF5ycew 4qks3Woe+neVIuPOKxEgthYm3adTm7zx7zB+IL0u9XeGTuuq/DqcmLsbqA3bQlflMcI1 BfCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781707902; x=1782312702; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=fif2f/B/gn5RkPcFE+VYhypuB1774zSDWaedB+gVp/0=; b=IQMSMil7FNi0AQWoN0eyQaom6ituzVj57Nvndi+fkXKa5+S1hLZLsspRQ1h2Fmv2zP aYqrUNOV4xSzDE/kVfnmlbJTVdbzJ4Qekdx1QWXXzmS1EasWl+0LowFKxz5tpbbNuICE VuveUizTeziWrJOpD0DdivvzQ+h0ceza1d1SKK4JVGNWvEuuXkR9ecZsnxuUbJbLjU0i jYkH7ONlcEwf0Devgen3+hQ7Zpkzokn4M7whpe60AtjG2Z00v+2Tp26zRn/tbQqPyl9v F3HrtpBhFtZyF3VefNqnUCrp+GxqrFlg5ThymtWp94IYunl0kFNE94twA2h+u+b0Wzkc mN6Q== X-Forwarded-Encrypted: i=1; AFNElJ/s6Fu8mOFEXM/oS6DBHNxJ/30+Zi726PUCqCVns9bHPPRnZqxZm32M8Y5hDD/JmQM2DnErD/zcCs3VwJw=@vger.kernel.org X-Gm-Message-State: AOJu0YxmcR94PnX96knaHkmUYQz0sMi1hJGVs3/YtGtaELMLjshvL7t2 /0w4z3gqncXjle4Efxp1J3mdtihpH4koCiY5w26u7Rhf4zmmHsEMVGwModLZqzUPQZb1gSflT7N PDYmn4and8qxXDzys0InBft0XyM54Aw== X-Received: from ejbw3.prod.google.com ([2002:a17:906:1303:b0:b9d:975a:28a8]) (user=sebastianene job=prod-delivery.src-stubby-dispatcher) by 2002:a17:906:209a:b0:bee:ec3b:6a93 with SMTP id a640c23a62f3a-c05d2182e75mr113081366b.2.1781707901976; Wed, 17 Jun 2026 07:51:41 -0700 (PDT) Date: Wed, 17 Jun 2026 14:51:25 +0000 In-Reply-To: <20260617145130.3729015-1-sebastianene@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260617145130.3729015-1-sebastianene@google.com> X-Mailer: git-send-email 2.54.0.1136.gdb2ca164c4-goog Message-ID: <20260617145130.3729015-3-sebastianene@google.com> Subject: [PATCH v7 2/7] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() From: Sebastian Ene To: catalin.marinas@arm.com, oupton@kernel.org, sudeep.holla@kernel.org, will@kernel.org Cc: jens.wiklander@linaro.org, joey.gouly@arm.com, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, android-kvm@google.com, maz@kernel.org, mrigendra.chaubey@gmail.com, op-tee@lists.trustedfirmware.org, perlarsen@google.com, sebastianene@google.com, seiden@linux.ibm.com, smostafa@google.com, sumit.garg@kernel.org, suzuki.poulose@arm.com, vdonnefort@google.com, yuzenghui@huawei.com Content-Type: text/plain; charset="UTF-8" From: Mostafa Saleh From: Mostafa Saleh Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable. Reviewed-by: Sudeep Holla Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") Signed-off-by: Mostafa Saleh Signed-off-by: Sebastian Ene --- drivers/firmware/arm_ffa/driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index b9f17fda7243..059e2aae7ca0 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -715,11 +715,10 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, for (idx = 0; idx < args->nattrs; idx++) { ep_mem_access = buffer + ffa_mem_desc_offset(buffer, idx, drv_info->version); + memset(ep_mem_access, 0, ffa_emad_size_get(drv_info->version)); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; - ep_mem_access->flag = 0; - ep_mem_access->reserved = 0; ffa_emad_impdef_value_init(drv_info->version, ep_mem_access->impdef_val, args->attrs[idx].impdef_val); @@ -759,7 +758,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } - if ((void *)constituents - buffer > max_fragsize) { + if ((void *)constituents + sizeof(*constituents) - buffer > max_fragsize) { pr_err("Memory Region Fragment > Tx Buffer size\n"); return -EFAULT; } @@ -768,7 +767,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; constituents->reserved = 0; constituents++; - frag_len += sizeof(struct ffa_mem_region_addr_range); + frag_len += sizeof(*constituents); } while ((args->sg = sg_next(args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len, -- 2.54.0.1136.gdb2ca164c4-goog