Re: [PATCH 6.6.y] KVM: arm64: Check the untrusted offset in FF-A memory share

[Sasha Levin <sashal@kernel.org>]

On Mon, Nov 24, 2025 at 03:00:00PM +0000, Sebastian Ene wrote:
>On Mon, Nov 24, 2025 at 03:50:45PM +0100, Greg KH wrote:
>> On Mon, Nov 24, 2025 at 09:11:34AM -0500, Sasha Levin wrote:
>> > From: Sebastian Ene <sebastianene@google.com>
>> >
>> > [ Upstream commit 103e17aac09cdd358133f9e00998b75d6c1f1518 ]
>> >
>> > Verify the offset to prevent OOB access in the hypervisor
>> > FF-A buffer in case an untrusted large enough value
>> > [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
>> > is set from the host kernel.
>> >
>> > Signed-off-by: Sebastian Ene <sebastianene@google.com>
>> > Acked-by: Will Deacon <will@kernel.org>
>> > Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com
>> > Signed-off-by: Marc Zyngier <maz@kernel.org>
>> > Signed-off-by: Sasha Levin <sashal@kernel.org>
>> > ---
>> >  arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++--
>> >  1 file changed, 7 insertions(+), 2 deletions(-)
>> >
>> > diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
>> > index 8d21ab904f1a9..eacf4ba1d88e9 100644
>> > --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
>> > +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
>> > @@ -425,7 +425,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>> >  	DECLARE_REG(u32, npages_mbz, ctxt, 4);
>> >  	struct ffa_composite_mem_region *reg;
>> >  	struct ffa_mem_region *buf;
>> > -	u32 offset, nr_ranges;
>> > +	u32 offset, nr_ranges, checked_offset;
>> >  	int ret = 0;
>> >
>> >  	if (addr_mbz || npages_mbz || fraglen > len ||
>> > @@ -460,7 +460,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>> >  		goto out_unlock;
>> >  	}
>> >
>> > -	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
>> > +	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
>> > +		ret = FFA_RET_INVALID_PARAMETERS;
>> > +		goto out_unlock;
>> > +	}
>
>hello Greg,
>
>>
>> I was told that a "straight" backport like this was not correct, so we
>> need a "better" one :(
>>
>> Sebastian, can you provide the correct backport for 6.6.y please?
>>
>
>I think Sasha's patch is doing the right thing. Sasha thanks for
>posting it so fast.

For the record, my patch just adjusted line numbers a bit, there were no
conflicts.

>I looked up the other faild patches on stable and the reason why the patch doesn't
>apply is because we don't have the FF-A proxy inthe following versions:
> - 5.4, 5.10, 5.15, 6.1

Right, I noticed that and assumed that this isn't needed on those older trees.

-- 
Thanks,
Sasha