From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f74.google.com (mail-ej1-f74.google.com [209.85.218.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3951B399377 for ; Thu, 2 Jul 2026 10:39:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782988751; cv=none; b=I6yddApiAbk8LCMGdXSD26rS7ggn+pmHMBdkA9g3T23qe0Uu2yu55q/uGX1G3WE4s3MxTv8+sFvUstc3hyoeyLdC9wiZiUBQ5tqOkInGVcSk59UTXQW//2kfG962XwiVsW9SulQKbNOEtYNmaynk2vSvlyJ0+QrF7ZLxg0wXP3M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782988751; c=relaxed/simple; bh=idCz1yZ2loil4GmAl0CYJHHspFZFLVjff200Ae6fHNk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fJk1hNN8fHawAA4VVMhfLftE/csPdM8JhrReXJ6PJgkq+/zST0kTQL/3u0GiNrWSMh/GaSZoVu2SRhEu8iD8J6LQaSY7qAdR2Aoo8WxptW8w+QuOjulH6y68YcuWZUTS13W1flCKUgvd3w62dxWrM7iSMgI8qKCH4tmwozfRFoI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Wb3fBegS; arc=none smtp.client-ip=209.85.218.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sebastianene.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Wb3fBegS" Received: by mail-ej1-f74.google.com with SMTP id a640c23a62f3a-c126de56711so180436666b.2 for ; Thu, 02 Jul 2026 03:39:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782988749; x=1783593549; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=b5pW2X8dLODkLCHijpyvtLxcjR3119nmpK6U2x+j3Ok=; b=Wb3fBegSUqYdUf3I/cVQGchSQD0murYMAlMZ2DkR8wi2WaWDftz6/paEZ85J3OmMco qqMqeqQi6gAsiCe1qumUynWJVZ69QYztIFXcAiZV8ow8ri630++k/5GN7kkWhsgA9LxN QMl/ilSRpiN9LENwIrYBcCHxgC+8o//RSvoknyLU41SnHAjA7P5ibF9aAuILwGDpPWr8 UEhazDk3MfsHmnacLKk8xgJ9e+8mFeLdFYHIUyt3QlycUV65Wupwdjnhogpxcd7usCZE m8s1O4xGBmGfve5LcIhaubU7RUtv+7pYBnbguKcUcGlgjS7nlK51+PIqk5W4bCg3vlyK bocg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782988749; x=1783593549; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=b5pW2X8dLODkLCHijpyvtLxcjR3119nmpK6U2x+j3Ok=; b=oP42N8136mWqeUou+0jqjTZNQXM8ADLX/ChU0O7T3XZlgUw9UzujcWZGg3uvzo6NVw IpcX9Sdww6q/Tu/fX3r3BqqklhipWT5OfFJxJW2U20X7tvpYSjDW3oASb/1+DleE0QZl StxTeLRfYQFz4Vmghrwc2jcVLV0py4J0nC9luelE5VqEjeMTSiG/KH3E0z1JABYtqKsY MfFyxwBXUpQLVSUbNsjQ4R3hprNJp9j56zZHaWfgT4QTrTs1pgkpUGVYEWJAgv7B+HuA lRVn98FbdYvlkzDehWgRlNl3PjVV/Bh4Ogrz63MNRXTqRrbfRNVHoLVwII7pyjuZn0tu Ir3Q== X-Forwarded-Encrypted: i=1; AHgh+Rr2AT66S9Z5ghUaMmxEyiJr5Y+EUf2BE/GyArGruhNXGinAh4QNL6yfEG5ANOIAoNg7dVvet579dB7+WeA=@vger.kernel.org X-Gm-Message-State: AOJu0YxXWLkxBdSAHXFc8WeCc8IwdRqzzA+yKCc9K5LSxR50zWuUDY0n 1GSTu+EHNKDPemN8NijK/h/MRYG4m3S7VznjgB5lfTsBQ5xm+K2qCGSKVV+Ut/VtJfZ9V1wUX+l ykHhTgJ1IuRM3BhBrDbEX8cIUY9g+Yw== X-Received: from ejbec17.prod.google.com ([2002:a17:906:b6d1:b0:c06:bd7:70c6]) (user=sebastianene job=prod-delivery.src-stubby-dispatcher) by 2002:a17:906:f112:b0:c12:951b:7f1c with SMTP id a640c23a62f3a-c12a9d7a733mr196967366b.21.1782988748201; Thu, 02 Jul 2026 03:39:08 -0700 (PDT) Date: Thu, 2 Jul 2026 10:38:40 +0000 In-Reply-To: <20260702103848.1647249-1-sebastianene@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260702103848.1647249-1-sebastianene@google.com> X-Mailer: git-send-email 2.55.0.rc0.799.gd6f94ed593-goog Message-ID: <20260702103848.1647249-4-sebastianene@google.com> Subject: [PATCH v9 3/6] KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() From: Sebastian Ene To: catalin.marinas@arm.com, oupton@kernel.org, sudeep.holla@kernel.org, will@kernel.org Cc: jens.wiklander@linaro.org, joey.gouly@arm.com, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, android-kvm@google.com, maz@kernel.org, mrigendra.chaubey@gmail.com, op-tee@lists.trustedfirmware.org, perlarsen@google.com, sebastianene@google.com, seiden@linux.ibm.com, smostafa@google.com, sumit.garg@kernel.org, suzuki.poulose@arm.com, vdonnefort@google.com, yuzenghui@huawei.com Content-Type: text/plain; charset="UTF-8" From: Mostafa Saleh Sashiko (locally) reports out of bound write possiblity if SPMD returns an invalid data. While SPMD is considered trusted, pKVM does some basic checks, for offset to be less than or equal len. However, that is incorrect as even if the offset is smaller than len pKVM can still access out of bound memory in the next ffa_host_unshare_ranges(). Split this check into 2: 1- Check that the fixed portion of the descriptor fits. 2- After getting reg, check the variable array size addr_range_cnt fits. Also, drop the WARN_ONs as that will panic the kernel and in the next checks there are no WARNs, so that makes it consistent. Fixes: 0a9f15fd5674 ("KVM: arm64: pkvm: Add support for fragmented FF-A descriptors") Signed-off-by: Mostafa Saleh Reviewed-by: Vincent Donnefort Signed-off-by: Sebastian Ene --- arch/arm64/kvm/hyp/nvhe/ffa.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 1af722771178..41cc4c1bafeb 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -607,8 +607,8 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, * check that we end up with something that doesn't look _completely_ * bogus. */ - if (WARN_ON(offset > len || - fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE)) { + if (offset + CONSTITUENTS_OFFSET(0) > len || + fraglen > KVM_FFA_MBOX_NR_PAGES * PAGE_SIZE) { ret = FFA_RET_ABORTED; ffa_rx_release(res); goto out_unlock; @@ -636,11 +636,16 @@ static void do_ffa_mem_reclaim(struct arm_smccc_1_2_regs *res, ffa_rx_release(res); } + reg = (void *)buf + offset; + if (offset + CONSTITUENTS_OFFSET(reg->addr_range_cnt) > len) { + ret = FFA_RET_ABORTED; + goto out_unlock; + } + ffa_mem_reclaim(res, handle_lo, handle_hi, flags); if (res->a0 != FFA_SUCCESS) goto out_unlock; - reg = (void *)buf + offset; /* If the SPMD was happy, then we should be too. */ WARN_ON(ffa_host_unshare_ranges(reg->constituents, reg->addr_range_cnt)); -- 2.55.0.rc0.799.gd6f94ed593-goog