[PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[Sebastian Ene]

Verify the offset to prevent OOB access in the hypervisor
FF-A buffer in case an untrusted large enough value
[U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
is set from the host kernel.

Signed-off-by: Sebastian Ene <sebastianene@google.com>
---
 arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index 4e16f9b96f63..58b7d0c477d7 100644
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -479,7 +479,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
 	struct ffa_mem_region_attributes *ep_mem_access;
 	struct ffa_composite_mem_region *reg;
 	struct ffa_mem_region *buf;
-	u32 offset, nr_ranges;
+	u32 offset, nr_ranges, checked_offset;
 	int ret = 0;
 
 	if (addr_mbz || npages_mbz || fraglen > len ||
@@ -516,7 +516,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
 		goto out_unlock;
 	}
 
-	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
+	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
+		ret = FFA_RET_INVALID_PARAMETERS;
+		goto out_unlock;
+	}
+
+	if (fraglen < checked_offset) {
 		ret = FFA_RET_INVALID_PARAMETERS;
 		goto out_unlock;
 	}
-- 
2.51.0.858.gf9c4a03a3a-goog

Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[Vincent Donnefort]

On Fri, Oct 17, 2025 at 07:57:10AM +0000, Sebastian Ene wrote:
> Verify the offset to prevent OOB access in the hypervisor

I believe that would be just a read, so probably it would be difficult to use
this to compromise anything, except crashing the system?

> FF-A buffer in case an untrusted large enough value
> [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
> is set from the host kernel.
> 
> Signed-off-by: Sebastian Ene <sebastianene@google.com>
> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 4e16f9b96f63..58b7d0c477d7 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -479,7 +479,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>  	struct ffa_mem_region_attributes *ep_mem_access;
>  	struct ffa_composite_mem_region *reg;
>  	struct ffa_mem_region *buf;
> -	u32 offset, nr_ranges;
> +	u32 offset, nr_ranges, checked_offset;
>  	int ret = 0;
>  
>  	if (addr_mbz || npages_mbz || fraglen > len ||
> @@ -516,7 +516,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>  		goto out_unlock;
>  	}
>  
> -	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
> +	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
> +		ret = FFA_RET_INVALID_PARAMETERS;
> +		goto out_unlock;
> +	}
> +
> +	if (fraglen < checked_offset) {
>  		ret = FFA_RET_INVALID_PARAMETERS;
>  		goto out_unlock;
>  

Perhaps this could be easier to reason about by moving this check with the nr_ranges?

        reg = (void *)buf + offset;
        if ((void *)reg->constituents > (void *)buf + fraglen) {
                ret = FFA_RET_INVALID_PARAMETERS;
                goto out_unlock;
        }
 
        nr_ranges = ((void *)buf + fraglen) - (void *)reg->constituents;
        if (nr_ranges % sizeof(reg->constituents[0])) {
                ret = FFA_RET_INVALID_PARAMETERS;

}
> -- 
> 2.51.0.858.gf9c4a03a3a-goog
> 

Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[Sebastian Ene]

On Wed, Oct 22, 2025 at 04:21:41PM +0100, Vincent Donnefort wrote:
> On Fri, Oct 17, 2025 at 07:57:10AM +0000, Sebastian Ene wrote:
> > Verify the offset to prevent OOB access in the hypervisor
> 
> I believe that would be just a read, so probably it would be difficult to use
> this to compromise anything, except crashing the system?

The simplest way is to crash the system but a more advanced one might
lead to a confused deputy attack:

1. Use the original bug to trigger the overflow of the offset variable
which bypasses this check:
https://elixir.bootlin.com/linux/v6.18-rc2/source/arch/arm64/kvm/hyp/nvhe/ffa.c#L519

2. Use the host_share_hyp from the host to create a mapping in the hyp
address space so that : reg from reg = (void *)buf + offset; points to
memory mapped in the hyp address space & controlled from the host.

3. Make the __ffa_host_share_ranges fail (since we control the content of
the reg) to trigger the recovery mechanism for __ffa_host_unshare_ranges
(https://elixir.bootlin.com/linux/v6.18-rc2/source/arch/arm64/kvm/hyp/nvhe/ffa.c#L392)
and replace the content of the reg with pages that we want to remove the
host stage-2 FF-A annotation from.

With step(3) we can remove the host stage-2 FF-A annotation from pages
without having to invoke the FF-A reclaim mechanism. This allows a
confused deputy attack because the pages can be given to another entity
after the annotation is removed (eg. given to a protected VM).

> 
> > FF-A buffer in case an untrusted large enough value
> > [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
> > is set from the host kernel.
> > 
> > Signed-off-by: Sebastian Ene <sebastianene@google.com>
> > ---
> >  arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> > index 4e16f9b96f63..58b7d0c477d7 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> > @@ -479,7 +479,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
> >  	struct ffa_mem_region_attributes *ep_mem_access;
> >  	struct ffa_composite_mem_region *reg;
> >  	struct ffa_mem_region *buf;
> > -	u32 offset, nr_ranges;
> > +	u32 offset, nr_ranges, checked_offset;
> >  	int ret = 0;
> >  
> >  	if (addr_mbz || npages_mbz || fraglen > len ||
> > @@ -516,7 +516,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
> >  		goto out_unlock;
> >  	}
> >  
> > -	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
> > +	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
> > +		ret = FFA_RET_INVALID_PARAMETERS;
> > +		goto out_unlock;
> > +	}
> > +
> > +	if (fraglen < checked_offset) {
> >  		ret = FFA_RET_INVALID_PARAMETERS;
> >  		goto out_unlock;
> >  
> 
> Perhaps this could be easier to reason about by moving this check with the nr_ranges?

I found it a bit more clear to use the helper on the offset variable, I
would like to keep it in this way if you are ok with this.


> 
>         reg = (void *)buf + offset;
>         if ((void *)reg->constituents > (void *)buf + fraglen) {
>                 ret = FFA_RET_INVALID_PARAMETERS;
>                 goto out_unlock;
>         }
>  
>         nr_ranges = ((void *)buf + fraglen) - (void *)reg->constituents;
>         if (nr_ranges % sizeof(reg->constituents[0])) {
>                 ret = FFA_RET_INVALID_PARAMETERS;
> 

Thanks,
Sebastian

> }
> > -- 
> > 2.51.0.858.gf9c4a03a3a-goog
> > 

Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[Will Deacon]

On Wed, Oct 29, 2025 at 10:27:27AM +0000, Sebastian Ene wrote:
> On Wed, Oct 22, 2025 at 04:21:41PM +0100, Vincent Donnefort wrote:
> > On Fri, Oct 17, 2025 at 07:57:10AM +0000, Sebastian Ene wrote:
> > > Verify the offset to prevent OOB access in the hypervisor
> > 
> > I believe that would be just a read, so probably it would be difficult to use
> > this to compromise anything, except crashing the system?
> 
> The simplest way is to crash the system but a more advanced one might
> lead to a confused deputy attack:
> 
> 1. Use the original bug to trigger the overflow of the offset variable
> which bypasses this check:
> https://elixir.bootlin.com/linux/v6.18-rc2/source/arch/arm64/kvm/hyp/nvhe/ffa.c#L519
> 
> 2. Use the host_share_hyp from the host to create a mapping in the hyp
> address space so that : reg from reg = (void *)buf + offset; points to
> memory mapped in the hyp address space & controlled from the host.
> 
> 3. Make the __ffa_host_share_ranges fail (since we control the content of
> the reg) to trigger the recovery mechanism for __ffa_host_unshare_ranges
> (https://elixir.bootlin.com/linux/v6.18-rc2/source/arch/arm64/kvm/hyp/nvhe/ffa.c#L392)
> and replace the content of the reg with pages that we want to remove the
> host stage-2 FF-A annotation from.
> 
> With step(3) we can remove the host stage-2 FF-A annotation from pages
> without having to invoke the FF-A reclaim mechanism. This allows a
> confused deputy attack because the pages can be given to another entity
> after the annotation is removed (eg. given to a protected VM).

Crikey, it's convoluted but I think your reasoning is correct and I also
think that the patch fixes the issue:

Acked-by: Will Deacon <will@kernel.org>

Cheers,

Will

Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

[Marc Zyngier]

On Fri, 17 Oct 2025 07:57:10 +0000, Sebastian Ene wrote:
> Verify the offset to prevent OOB access in the hypervisor
> FF-A buffer in case an untrusted large enough value
> [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
> is set from the host kernel.
> 
> 

Applied to fixes, thanks!

[1/1] KVM: arm64: Check the untrusted offset in FF-A memory share
      commit: 103e17aac09cdd358133f9e00998b75d6c1f1518

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.