linux-kernel - Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory share

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aPj2hTXbGUseUqhE@google.com>
Date: Wed, 22 Oct 2025 16:21:41 +0100
From: Vincent Donnefort <vdonnefort@...gle.com>
To: Sebastian Ene <sebastianene@...gle.com>
Cc: maz@...nel.org, oliver.upton@...ux.dev, will@...nel.org,
	catalin.marinas@....com, suzuki.poulose@....com,
	kvmarm@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org, joey.gouly@....com, ayrton@...gle.com,
	yuzenghui@...wei.com, qperret@...gle.com, kernel-team@...roid.com
Subject: Re: [PATCH] KVM: arm64: Check the untrusted offset in FF-A memory
 share

On Fri, Oct 17, 2025 at 07:57:10AM +0000, Sebastian Ene wrote:
> Verify the offset to prevent OOB access in the hypervisor

I believe that would be just a read, so probably it would be difficult to use
this to compromise anything, except crashing the system?

> FF-A buffer in case an untrusted large enough value
> [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
> is set from the host kernel.
> 
> Signed-off-by: Sebastian Ene <sebastianene@...gle.com>
> ---
>  arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
> index 4e16f9b96f63..58b7d0c477d7 100644
> --- a/arch/arm64/kvm/hyp/nvhe/ffa.c
> +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
> @@ -479,7 +479,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>  	struct ffa_mem_region_attributes *ep_mem_access;
>  	struct ffa_composite_mem_region *reg;
>  	struct ffa_mem_region *buf;
> -	u32 offset, nr_ranges;
> +	u32 offset, nr_ranges, checked_offset;
>  	int ret = 0;
>  
>  	if (addr_mbz || npages_mbz || fraglen > len ||
> @@ -516,7 +516,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
>  		goto out_unlock;
>  	}
>  
> -	if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
> +	if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
> +		ret = FFA_RET_INVALID_PARAMETERS;
> +		goto out_unlock;
> +	}
> +
> +	if (fraglen < checked_offset) {
>  		ret = FFA_RET_INVALID_PARAMETERS;
>  		goto out_unlock;
>  

Perhaps this could be easier to reason about by moving this check with the nr_ranges?

        reg = (void *)buf + offset;
        if ((void *)reg->constituents > (void *)buf + fraglen) {
                ret = FFA_RET_INVALID_PARAMETERS;
                goto out_unlock;
        }
 
        nr_ranges = ((void *)buf + fraglen) - (void *)reg->constituents;
        if (nr_ranges % sizeof(reg->constituents[0])) {
                ret = FFA_RET_INVALID_PARAMETERS;

}
> -- 
> 2.51.0.858.gf9c4a03a3a-goog
>