From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9BCE3939C2 for ; Thu, 2 Jul 2026 10:39:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782988743; cv=none; b=V8I9Ksz1V7zTeEobXie6ScQI4W3gb4Ot+PxlU649chnjWrq9q4NUoHoAGcwYNLuTc12CAOJDXvGkvpB24mBywu1SfCsZgkFvjvkmLo0eYb6F/oCkxKAFVEFiCiuSWoqq9cCraNd2l3U7AxuHb8WVqC//EfBs0hiAcgcRSVnB4zY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782988743; c=relaxed/simple; bh=cqpqWComKRWiCpCFlRr5CCe1UaqVwupCKxUEyOVLkh0=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=HGOl5EY2bLapfwzmjnRrF+0Efo7OPxSk00v4nrZaBlAoYhi0wteaJqOcQXYOoBB69S4hFGPey0B67LL3OwnSK3tInWjeolMJTYcyzhEW/4eSiZY9Hp25AwNhNPEjQSqJHSBgNndzRKRh4U5U8f0Iqtcl4ptu9j5vgUSUBxTTuYM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ItdnAR7z; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ItdnAR7z" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490a767c7dcso15170395e9.2 for ; Thu, 02 Jul 2026 03:39:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782988740; x=1783593540; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=3srY3du6pUShZyOw/nlifUO0efjUMM7goX5s1Ul3bUU=; b=ItdnAR7zsKCrVLxo5+a0QIYu9wCDlCm42KLz792kwdM9E0ey2Y84abTH8rIp8wWKPk 19C3NF0LE3TlfTfM+aJ6pNOUmGU3fnEYiXXhlr+N3U6AwKgypZrW1v723YVut0WT2vO4 pU/x80VljhoRqBvlz8S5pZRSyBLLyrXkR5XQr/2WPuR6sYlHUlY13VuLqMWOH8yapDS0 BfdhySUholwDPE2mv/GqsibMAi2UP/YGZ9GYKFounT8ceF2RELBQUmZwNGe6b0o2P5+E jwrtzlBRwzqAv5MpKJ3I46+TJYdWJM9WIyKMv1N+xk7jNSuKQeNY5aeN6+jkVJev9sDF x/BQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782988740; x=1783593540; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=3srY3du6pUShZyOw/nlifUO0efjUMM7goX5s1Ul3bUU=; b=lNEhwBmcbwYBpgfbv1k59zh90puHpUIhGgJlaiwdQuqylIxHa0zDhisAauUpEcxBCL cgsCWVWOSXOAbpNsyqeJJ36AI6lfD8LQXy5GxVg0FP/jcXmUF4mrH5TphZf9fNl5gTsa jFkBFr/UtIe4owv9eamcpZqZtODdE/iBpRQA36Hx0T4jybT7eOmWWMkFKponqdn5ejnG dogCBzH9BGlUMKMqyRueSMTmaJ7KwOdCyOkSBa43usZ6KodE+SXrBsfWe/4QIuXc9g60 mb7Uy4a+5r2nUtHh/eAWNhottimlsNH+vAkHXkqp4m9wh//w7OwMVYrLjbaVmY+1884z w9dQ== X-Forwarded-Encrypted: i=1; AFNElJ8+8rMeJ3xvFeSFtdSid4q/JKwPnJNWj3qulj31NhBXbio4WF4fc+wmg6mBGw0+H3RQKdmUS36R8ZnW0kA=@vger.kernel.org X-Gm-Message-State: AOJu0YzqtYK+0fo1dCpMg9U01tFlGZbpme+SdKIgGLaJwI4uMBlK6Nqv wxiozfRsP/zVqt4uo7pyy1cSdxqy1bjTbzxxCcnmF/ajzcYMuCp8nf9oAHraRgAMrzZ59kdvq81 SXGNg6atih2kDOAD8gUbqMSMfhX22Wg== X-Received: from wmpf36.prod.google.com ([2002:a05:600c:4924:b0:493:b275:289d]) (user=sebastianene job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:6087:b0:492:1eed:3e67 with SMTP id 5b1f17b1804b1-493c2b96d7emr80737895e9.26.1782988739807; Thu, 02 Jul 2026 03:38:59 -0700 (PDT) Date: Thu, 2 Jul 2026 10:38:38 +0000 In-Reply-To: <20260702103848.1647249-1-sebastianene@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260702103848.1647249-1-sebastianene@google.com> X-Mailer: git-send-email 2.55.0.rc0.799.gd6f94ed593-goog Message-ID: <20260702103848.1647249-2-sebastianene@google.com> Subject: [PATCH v9 1/6] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() From: Sebastian Ene To: catalin.marinas@arm.com, oupton@kernel.org, sudeep.holla@kernel.org, will@kernel.org Cc: jens.wiklander@linaro.org, joey.gouly@arm.com, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, android-kvm@google.com, maz@kernel.org, mrigendra.chaubey@gmail.com, op-tee@lists.trustedfirmware.org, perlarsen@google.com, sebastianene@google.com, seiden@linux.ibm.com, smostafa@google.com, sumit.garg@kernel.org, suzuki.poulose@arm.com, vdonnefort@google.com, yuzenghui@huawei.com Content-Type: text/plain; charset="UTF-8" From: Mostafa Saleh Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable. Reviewed-by: Sudeep Holla Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") Signed-off-by: Mostafa Saleh Signed-off-by: Sebastian Ene --- drivers/firmware/arm_ffa/driver.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index 0f468362c288..01301213896a 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -725,11 +725,10 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, for (idx = 0; idx < args->nattrs; idx++) { ep_mem_access = buffer + ffa_mem_desc_offset(buffer, idx, drv_info->version); + memset(ep_mem_access, 0, ffa_emad_size_get(drv_info->version)); ep_mem_access->receiver = args->attrs[idx].receiver; ep_mem_access->attrs = args->attrs[idx].attrs; ep_mem_access->composite_off = composite_offset; - ep_mem_access->flag = 0; - ep_mem_access->reserved = 0; ffa_emad_impdef_value_init(drv_info->version, ep_mem_access->impdef_val, args->attrs[idx].impdef_val); @@ -769,7 +768,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents = buffer; } - if ((void *)constituents - buffer > max_fragsize) { + if ((void *)constituents + sizeof(*constituents) - buffer > max_fragsize) { pr_err("Memory Region Fragment > Tx Buffer size\n"); return -EFAULT; } @@ -778,7 +777,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; constituents->reserved = 0; constituents++; - frag_len += sizeof(struct ffa_mem_region_addr_range); + frag_len += sizeof(*constituents); } while ((args->sg = sg_next(args->sg))); return ffa_transmit_fragment(func_id, addr, buf_sz, frag_len, -- 2.55.0.rc0.799.gd6f94ed593-goog