public inbox for linux-arm-kernel@lists.infradead.org
 help / color / mirror / Atom feed
From: Sudeep Holla <sudeep.holla@kernel.org>
To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org
Cc: Jens Wiklander <jens.wiklander@linaro.org>,
	 Sudeep Holla <sudeep.holla@kernel.org>,
	 Sebastian Ene <sebastianene@google.com>
Subject: [PATCH 0/8] firmware: arm_ffa: Fix cleanup, notification, and discovery paths
Date: Thu, 23 Apr 2026 18:22:50 +0100	[thread overview]
Message-ID: <20260423-ffa_fixes-v1-0-61189661affe@kernel.org> (raw)

Hi all,

This series fixes a set of issues in the FF-A driver around init
cleanup, framework notification handling, v1.0 notifier lifetime, and
partition discovery.

The fixes are all small and localized, but together they tighten a few
important paths:

- fix the early init unwind path when RX buffer allocation fails
- align the stored RX/TX buffer size with the size actually mapped to
  firmware
- ensure the framework notification handler always releases the RX
  buffer correctly
- validate framework notification payload bounds before copying data out
  of the shared RX buffer
- fix the partition lookup used for sched-recv callback registration
- unregister the FF-A v1.0 bus notifier during teardown
- bound the register-based partition discovery copies against the caller
  buffer
- reject FF-A driver registration without an ID table

This is the outcome of the self-initiated review of the entire driver
following the oversight of Sashiko’s review on one of the patches that
was merged.

https://sashiko.dev/#/patchset/20260402113939.930221-1-sebastianene@google.com

Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
---
Sudeep Holla (8):
      firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
      firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
      firmware: arm_ffa: Align RxTx buffer size before mapping
      firmware: arm_ffa: Fix Rx buffer release in fwk notification handler
      firmware: arm_ffa: Validate framework notification payload bounds
      firmware: arm_ffa: Unregister v1.0 bus notifier on teardown
      firmware: arm_ffa: Fix sched-recv callback partition lookup
      firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

 drivers/firmware/arm_ffa/bus.c    |  4 +-
 drivers/firmware/arm_ffa/driver.c | 79 ++++++++++++++++++++++++++++-----------
 2 files changed, 60 insertions(+), 23 deletions(-)
---
base-commit: 2e68039281932e6dc37718a1ea7cbb8e2cda42e6
change-id: 20260423-ffa_fixes-4ad33f0ee250


-- 
Regards,
Sudeep



             reply	other threads:[~2026-04-23 17:23 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-23 17:22 Sudeep Holla [this message]
2026-04-23 17:22 ` [PATCH 1/8] firmware: arm_ffa: Check for NULL FF-A ID table while driver registration Sudeep Holla
2026-04-23 17:22 ` [PATCH 2/8] firmware: arm_ffa: Skip free_pages on RX buffer alloc failure Sudeep Holla
2026-04-23 17:22 ` [PATCH 3/8] firmware: arm_ffa: Align RxTx buffer size before mapping Sudeep Holla
2026-04-23 17:22 ` [PATCH 4/8] firmware: arm_ffa: Fix Rx buffer release in fwk notification handler Sudeep Holla
2026-04-23 17:22 ` [PATCH 5/8] firmware: arm_ffa: Validate framework notification payload bounds Sudeep Holla
2026-04-23 17:22 ` [PATCH 6/8] firmware: arm_ffa: Unregister v1.0 bus notifier on teardown Sudeep Holla
2026-04-23 17:22 ` [PATCH 7/8] firmware: arm_ffa: Fix sched-recv callback partition lookup Sudeep Holla
2026-04-23 17:22 ` [PATCH 8/8] firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies Sudeep Holla

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260423-ffa_fixes-v1-0-61189661affe@kernel.org \
    --to=sudeep.holla@kernel.org \
    --cc=jens.wiklander@linaro.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sebastianene@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox