linux-kernel - Re: [PATCH] tee: fix tee_ioctl_object_invoke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45b5f14b-3746-4b05-a4b4-dc9f88e89e52@oss.qualcomm.com>
Date: Fri, 5 Dec 2025 19:15:26 +0530
From: Harshal Dev <harshal.dev@....qualcomm.com>
To: Jens Wiklander <jens.wiklander@...aro.org>,
        Arnd Bergmann <arnd@...nel.org>
Cc: Paul Walmsley <pjw@...nel.org>, Palmer Dabbelt <palmer@...belt.com>,
        Albert Ou <aou@...s.berkeley.edu>,
        Amirreza Zarrabi <amirreza.zarrabi@....qualcomm.com>,
        Sumit Garg <sumit.garg@....qualcomm.com>,
        Arnd Bergmann <arnd@...db.de>, Sumit Garg <sumit.garg@...nel.org>,
        Alexandre Ghiti <alex@...ti.fr>,
        Etienne Carriere <etienne.carriere@...s.st.com>,
        Randy Dunlap <rdunlap@...radead.org>, op-tee@...ts.trustedfirmware.org,
        linux-kernel@...r.kernel.org, linux-riscv@...ts.infradead.org
Subject: Re: [PATCH] tee: fix tee_ioctl_object_invoke_arg padding

Hi,

On 12/4/2025 6:57 PM, Jens Wiklander wrote:
> Hi,
> 
> On Thu, Dec 4, 2025 at 11:17 AM Arnd Bergmann <arnd@...nel.org> wrote:
>>
>> From: Arnd Bergmann <arnd@...db.de>
>>
>> The tee_ioctl_object_invoke_arg structure has padding on some
>> architectures but not on x86-32 and a few others:
>>
>> include/linux/tee.h:474:32: error: padding struct to align 'params' [-Werror=padded]
>>
>> I expect that all current users of this are on architectures that do
>> have implicit padding here (arm64, arm, x86, riscv), so make the padding
>> explicit in order to avoid surprises if this later gets used elsewhere.
>>
>> Fixes: d5b8b0fa1775 ("tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF")
>> Signed-off-by: Arnd Bergmann <arnd@...db.de>
>> ---
>> The new interface showed up in 6.18, but I only came across this after
>> that was released. Changing it now is technically an ABI change on
>> architectures with unusual padding rules, so please consider carefully
>> whether we want to do it this way or not.
>>
>> Working around the ABI differences without an ABI change is possible,
>> but adds a lot of complexity for compat handling.
> 
> This is currently only used by the recently introduced qcomtee backend
> driver. So it's only used on a few arm64 Qualcomm platforms right now.
> 
> I think we should take this patch, but let's hear what others think.
> 
> Thanks,
> Jens
> 
The only user-space client which is currently using this ABI (as per our knowledge)
is the libqcomtee library: https://github.com/quic/quic-teec/blob/main/libqcomtee/src/linux/tee.h#L432

If I understand Arnd's concern correctly, if a compiler used to build the user-space
client skips the padding for tee_ioctl_object_invoke_arg, it could lead to issues.

Let's wait for Amir's view here as well, however I do think the explicit padding would
benefit here.

Regards,
Harshal

>> ---
>>  include/uapi/linux/tee.h | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h
>> index cab5cadca8ef..5203977ed35d 100644
>> --- a/include/uapi/linux/tee.h
>> +++ b/include/uapi/linux/tee.h
>> @@ -470,6 +470,7 @@ struct tee_ioctl_object_invoke_arg {
>>         __u32 op;
>>         __u32 ret;
>>         __u32 num_params;
>> +       __u32 :32;
>>         /* num_params tells the actual number of element in params */
>>         struct tee_ioctl_param params[];
>>  };
>> --
>> 2.39.5
>>