From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f73.google.com (mail-ej1-f73.google.com [209.85.218.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 973A82D9484 for ; Tue, 30 Jun 2026 10:21:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782814884; cv=none; b=AZSuX6OKUy1cne3OxMQvsCdRtmfqwHbmMRK88QGS65ocYW+Jd+gRdRpGGe/+bzbCUeWPZodgPimuBJvNYLD9iRlgjV8gc2Fr2Fnqp/MVgpGfROqgyYIOnpJ8ny+EUPXr/sgodBqdXxsQ78Lo8KY2Nf9uLD8gpBX0UA7iur9fSy4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782814884; c=relaxed/simple; bh=cqpqWComKRWiCpCFlRr5CCe1UaqVwupCKxUEyOVLkh0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=SO/VGA7vJcSiCCkpmb0wtNvRY7HfHk1nfgSvo2ltp9Hxq4/Rt70zZ0YbLKiRaBNE/HUmsdlhGKu4Tvk+CUwbkjKpICcrbcQXQJb+/E0YmvKIEQ0H+0VvTKiLFUuhpUprkJNWpJ2eVoWg0aQvjwa73CqPrhUfFLiMufC0pv6dQSI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=cD8GPSpi; arc=none smtp.client-ip=209.85.218.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="cD8GPSpi" Received: by mail-ej1-f73.google.com with SMTP id a640c23a62f3a-c126f9928f6so173457266b.0 for ; Tue, 30 Jun 2026 03:21:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782814881; x=1783419681; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=3srY3du6pUShZyOw/nlifUO0efjUMM7goX5s1Ul3bUU=; b=cD8GPSpimSi9etGzIJeagxk6gQZ3A01DxFFqPkxTCBlUPyyIS+oL+2LRo1rX4GYI4S yg4Ice4buFUAWnXGVchNrLXDy19cCFE93uXzxTpBSaOZpX6gKRA8+v9n83TF3/K0SnBA OzlnszkneICVo2ulpDfTHxep3Szff02wbP1SpVBQiwUU2nTKDjLYOpUMquyFOM5U3/kj lnwX8Ej44J8HdHl5DrKIGI4wQolwhmljUYeYHFXsWZ1b5iBi/L5/vwqe+QUBkFZb7gAL 9ck03eeF+WkdsDe1xTFDwj2ESVE/94Nx/VypxRKb66xk5BO0TONBpmQZQUG/NspTPgY+ QVBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782814881; x=1783419681; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=3srY3du6pUShZyOw/nlifUO0efjUMM7goX5s1Ul3bUU=; b=M9NjMXZH/XBgZty5zqY0qn87N5EJaosL9eLF02yD01xFVlSqelKy02v1ngc67PQoPF lofdRkdbToIT8y6XUtAtUBTIrLLmO8MdIuY1iU9U2/Urjfk/W7JaulXBoqMqBLvFQ9bN 1pHqGRZ9kywoeKGCB+4V0rrzPygjts3OKcbVszrF0x3YJZb8WsKeYhsWyY5kYdfTta1S 145f0U11bOp/jxHL2mgjdUZGhVVXBwH203fMJF4cPKjY3V9YPFCCsoCFwr9/4LfqBE2x gvxGgCpIO6psc7SsVfE8MJ3TEMD2G5aPb0RlxjKd83ks02WP02AyotcF9vhtwlt6o2p5 G09Q== X-Forwarded-Encrypted: i=1; AHgh+RrqJxZs3k1MKlgdxiEMehQuWBbPPG+/MKt3IzcteacU0WWF8tcdXhkol6Wzow3ViLACzD1sf2Vyg+0rfTI=@vger.kernel.org X-Gm-Message-State: AOJu0YyR7abPixMaBBiPh67jRUVMaHN6F1+hypDWMHi9Kw5SpMoQY4XS iZxwehtH39h52LedAFyabjTwE5bCcgschTm4OrFHBotoTeVTMfNdzqG3cYzb9T1kWsoPrWCqEFd EqgHlPMDZb/Cu3/xZpskEU7rkIxlgKQ== X-Received: from ejbgw23.prod.google.com ([2002:a17:906:f157:b0:c12:5da6:868c]) (user=sebastianene job=prod-delivery.src-stubby-dispatcher) by 2002:a17:906:fe46:b0:c12:8d49:48cd with SMTP id a640c23a62f3a-c128d4953fbmr93701066b.37.1782814880689; Tue, 30 Jun 2026 03:21:20 -0700 (PDT) Date: Tue, 30 Jun 2026 10:20:54 +0000 In-Reply-To: <20260630102058.3219867-2-sebastianene@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260630102058.3219867-2-sebastianene@google.com> X-Mailer: git-send-email 2.55.0.rc0.799.gd6f94ed593-goog Message-ID: <20260630102058.3219867-3-sebastianene@google.com> Subject: [PATCH v8 1/6] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() From: Sebastian Ene To: catalin.marinas@arm.com, oupton@kernel.org, sudeep.holla@kernel.org, will@kernel.org Cc: jens.wiklander@linaro.org, joey.gouly@arm.com, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, android-kvm@google.com, maz@kernel.org, mrigendra.chaubey@gmail.com, op-tee@lists.trustedfirmware.org, perlarsen@google.com, sebastianene@google.com, seiden@linux.ibm.com, smostafa@google.com, sumit.garg@kernel.org, suzuki.poulose@arm.com, vdonnefort@google.com, yuzenghui@huawei.com Content-Type: text/plain; charset="UTF-8" From: Mostafa Saleh Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable. Reviewed-by: Sudeep Holla Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") Signed-off-by: Mostafa Saleh Signed-off-by: Sebastian Ene --- drivers/firmware/arm_ffa/driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index 0f468362c288..01301213896a 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -725,11 +725,10 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, for (idx = 0; idx < args->nattrs; idx++) { ep_mem_access = buffer + ffa_mem_desc_offset(buffer, idx, drv_info->version); + memset(ep_mem_access, 0, ffa_emad_size_get(drv_info->version)); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; - ep_mem_access->flag = 0; - ep_mem_access->reserved = 0; ffa_emad_impdef_value_init(drv_info->version, ep_mem_access->impdef_val, args->attrs[idx].impdef_val); @@ -769,7 +768,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } - if ((void *)constituents - buffer > max_fragsize) { + if ((void *)constituents + sizeof(*constituents) - buffer > max_fragsize) { pr_err("Memory Region Fragment > Tx Buffer size\n"); return -EFAULT; } @@ -778,7 +777,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; constituents->reserved = 0; constituents++; - frag_len += sizeof(struct ffa_mem_region_addr_range); + frag_len += sizeof(*constituents); } while ((args->sg = sg_next(args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len, -- 2.55.0.rc0.799.gd6f94ed593-goog