All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sudeep Holla <sudeep.holla@kernel.org>
To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org
Cc: Jens Wiklander <jens.wiklander@linaro.org>,
	 Sudeep Holla <sudeep.holla@kernel.org>,
	 Sebastian Ene <sebastianene@google.com>
Subject: [PATCH 0/8] firmware: arm_ffa: Fix cleanup, notification, and discovery paths
Date: Thu, 23 Apr 2026 18:22:50 +0100	[thread overview]
Message-ID: <20260423-ffa_fixes-v1-0-61189661affe@kernel.org> (raw)

Hi all,

This series fixes a set of issues in the FF-A driver around init
cleanup, framework notification handling, v1.0 notifier lifetime, and
partition discovery.

The fixes are all small and localized, but together they tighten a few
important paths:

- fix the early init unwind path when RX buffer allocation fails
- align the stored RX/TX buffer size with the size actually mapped to
  firmware
- ensure the framework notification handler always releases the RX
  buffer correctly
- validate framework notification payload bounds before copying data out
  of the shared RX buffer
- fix the partition lookup used for sched-recv callback registration
- unregister the FF-A v1.0 bus notifier during teardown
- bound the register-based partition discovery copies against the caller
  buffer
- reject FF-A driver registration without an ID table

This is the outcome of the self-initiated review of the entire driver
following the oversight of Sashiko’s review on one of the patches that
was merged.

https://sashiko.dev/#/patchset/20260402113939.930221-1-sebastianene@google.com

Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
---
Sudeep Holla (8):
      firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
      firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
      firmware: arm_ffa: Align RxTx buffer size before mapping
      firmware: arm_ffa: Fix Rx buffer release in fwk notification handler
      firmware: arm_ffa: Validate framework notification payload bounds
      firmware: arm_ffa: Unregister v1.0 bus notifier on teardown
      firmware: arm_ffa: Fix sched-recv callback partition lookup
      firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

 drivers/firmware/arm_ffa/bus.c    |  4 +-
 drivers/firmware/arm_ffa/driver.c | 79 ++++++++++++++++++++++++++++-----------
 2 files changed, 60 insertions(+), 23 deletions(-)
---
base-commit: 2e68039281932e6dc37718a1ea7cbb8e2cda42e6
change-id: 20260423-ffa_fixes-4ad33f0ee250


-- 
Regards,
Sudeep



             reply	other threads:[~2026-04-23 17:23 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-23 17:22 Sudeep Holla [this message]
2026-04-23 17:22 ` [PATCH 1/8] firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Sudeep Holla
2026-04-23 17:22 ` [PATCH 2/8] firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla
2026-04-23 17:22 ` [PATCH 3/8] firmware: arm_ffa: Align RxTx buffer size before mapping Sudeep Holla
2026-04-27  9:30   ` Sebastian Ene
2026-04-27 12:42     ` Sudeep Holla
2026-04-23 17:22 ` [PATCH 4/8] firmware: arm_ffa: Fix Rx buffer release in fwk notification handler Sudeep Holla
2026-04-23 17:22 ` [PATCH 5/8] firmware: arm_ffa: Validate framework notification payload bounds Sudeep Holla
2026-04-23 17:22 ` [PATCH 6/8] firmware: arm_ffa: Unregister v1.0 bus notifier on teardown Sudeep Holla
2026-04-23 17:22 ` [PATCH 7/8] firmware: arm_ffa: Fix sched-recv callback partition lookup Sudeep Holla
2026-04-23 17:22 ` [PATCH 8/8] firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies Sudeep Holla

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260423-ffa_fixes-v1-0-61189661affe@kernel.org \
    --to=sudeep.holla@kernel.org \
    --cc=jens.wiklander@linaro.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sebastianene@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.