KVM: arm64: Check the untrusted offset in FF-A memory share

commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream.

Verify the offset to prevent OOB access in the hypervisor
FF-A buffer in case an untrusted large enough value
[U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
is set from the host kernel.

Signed-off-by: Sebastian Ene <sebastianene@google.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c
index e433dfab882aa5e1a6a86e1e4d708b828e526357..2e0ef68668d736ea54925afec8528228a739a8a2 100644 (file)
--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
+++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
@@ -437,7 +437,7 @@ static void __do_ffa_mem_xfer(const u64 func_id,
        struct ffa_mem_region_attributes *ep_mem_access;
        struct ffa_composite_mem_region *reg;
        struct ffa_mem_region *buf;
-       u32 offset, nr_ranges;
+       u32 offset, nr_ranges, checked_offset;
        int ret = 0;
 
        if (addr_mbz || npages_mbz || fraglen > len ||
@@ -474,7 +474,12 @@ static void __do_ffa_mem_xfer(const u64 func_id,
                goto out_unlock;
        }
 
-       if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
+       if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
+               ret = FFA_RET_INVALID_PARAMETERS;
+               goto out_unlock;
+       }
+
+       if (fraglen < checked_offset) {
                ret = FFA_RET_INVALID_PARAMETERS;
                goto out_unlock;
        }