]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
KVM: arm64: Validate the offset to the mem access descriptor
authorSebastian Ene <sebastianene@google.com>
Thu, 2 Jul 2026 10:38:41 +0000 (10:38 +0000)
committerMarc Zyngier <maz@kernel.org>
Tue, 7 Jul 2026 10:25:50 +0000 (11:25 +0100)
commita6b49d27c17909608d54523220bb6f3498d4a1df
tree6b695db4f2840700c134d453d5df31d1b9dc5918
parent8c6db30d79528279abbeb416e4f533f1f91b8724
KVM: arm64: Validate the offset to the mem access descriptor

Prevent the pKVM hypervisor from making assumptions that the
endpoint memory access descriptor (EMAD) comes right after the
FF-A memory region header.
Prior to FF-A version 1.1 the header of the memory region
didn't contain an offset to the endpoint memory access descriptor.
The layout of a memory transaction looks like this from 1.1 onward:
Type | Field name | Offset
[ Header | ffa_mem_region  | 0
  EMAD 1 | ffa_mem_region_attributes) | ffa_mem_region.ep_mem_offset
]
Verify that the offset to the first endpoint memory access descriptor
is within the mailbox buffer bounds.

Also, fix one hardcoded sizeof(struct ffa_mem_region_attributes) that
should be replaced ffa_emad_size_get() for compatibility with FFA v1.0.

Fixes: 42fb33dde42b ("KVM: arm64: Use FF-A 1.1 with pKVM")
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Sebastian Ene <sebastianene@google.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Link: https://patch.msgid.link/20260702103848.1647249-5-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
arch/arm64/kvm/hyp/nvhe/ffa.c
include/linux/arm_ffa.h