Re: [PATCH v7 7/7] KVM: arm64: Zero out the stack initialized data in the FFA handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Downgrade responses from EL3 during FF-A version negotiation are silently ignored and used as a higher version.
--

commit 0d02d44ef9bc090a9ae03e08d6cec358827371ce
Author: Sebastian Ene <sebastianene@google.com>

KVM: arm64: Zero out the stack initialized data in the FFA handler

This commit prevents leaking hypervisor stack data to the host when using
the FFA_VERSION call by explicitly zeroing the stack-allocated variable
before returning data.

Link: https://lore.kernel.org/all/20260616160016.C62C81F000E9@smtp.kernel.org/

> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -883,7 +883,7 @@ static void do_ffa_part_get(struct arm_smccc_1_2_regs *res,
>  
>  bool kvm_host_ffa_handler(struct kvm_cpu_context *host_ctxt, u32 func_id)
>  {
> -	struct arm_smccc_1_2_regs res;
> +	struct arm_smccc_1_2_regs res = {0};

[Severity: High]
This isn't a bug introduced by this patch, but while looking at the FF-A
version handling, I noticed an issue with version negotiation in
do_ffa_version().

When EL2 queries EL3 during version negotiation, does the code correctly
handle downgrade responses?

It appears EL2 only checks if the response is FFA_RET_NOT_SUPPORTED:

arch/arm64/kvm/hyp/nvhe/ffa.c:do_ffa_version() {
        hyp_smccc_1_2_smc(&(struct arm_smccc_1_2_regs) {
                .a0 = FFA_VERSION,
                .a1 = ffa_req_version,
        }, res);
        if ((s32)res->a0 == FFA_RET_NOT_SUPPORTED)
                goto unlock;

        hyp_ffa_version = ffa_req_version;
}

If EL3 returns a version smaller than the requested ffa_req_version
(a downgrade response), should res->a0 be validated against ffa_req_version
before unconditionally setting hyp_ffa_version = ffa_req_version?

Silently using a higher version than EL3 actually supports might cause
struct layout misinterpretations (like mismatched offsets) leading to
memory corruption or out-of-bounds reads during subsequent memory sharing
calls.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617145130.3729015-1-sebastianene@google.com?part=7