6.12-stable patches

added patches:
	kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch
	series

diff --git a/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch b/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch
new file mode 100644 (file)
index 0000000..406d5f6
--- /dev/null
+++ b/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch
@@ -0,0 +1,48 @@
+From 103e17aac09cdd358133f9e00998b75d6c1f1518 Mon Sep 17 00:00:00 2001
+From: Sebastian Ene <sebastianene@google.com>
+Date: Fri, 17 Oct 2025 07:57:10 +0000
+Subject: KVM: arm64: Check the untrusted offset in FF-A memory share
+
+From: Sebastian Ene <sebastianene@google.com>
+
+commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream.
+
+Verify the offset to prevent OOB access in the hypervisor
+FF-A buffer in case an untrusted large enough value
+[U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]
+is set from the host kernel.
+
+Signed-off-by: Sebastian Ene <sebastianene@google.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/nvhe/ffa.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/nvhe/ffa.c
++++ b/arch/arm64/kvm/hyp/nvhe/ffa.c
+@@ -437,7 +437,7 @@ static void __do_ffa_mem_xfer(const u64
+       struct ffa_mem_region_attributes *ep_mem_access;
+       struct ffa_composite_mem_region *reg;
+       struct ffa_mem_region *buf;
+-      u32 offset, nr_ranges;
++      u32 offset, nr_ranges, checked_offset;
+       int ret = 0;
+ 
+       if (addr_mbz || npages_mbz || fraglen > len ||
+@@ -474,7 +474,12 @@ static void __do_ffa_mem_xfer(const u64
+               goto out_unlock;
+       }
+ 
+-      if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) {
++      if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) {
++              ret = FFA_RET_INVALID_PARAMETERS;
++              goto out_unlock;
++      }
++
++      if (fraglen < checked_offset) {
+               ret = FFA_RET_INVALID_PARAMETERS;
+               goto out_unlock;
+       }

diff --git a/queue-6.12/series b/queue-6.12/series
new file mode 100644 (file)
index 0000000..361fd04
--- /dev/null
+++ b/queue-6.12/series
@@ -0,0 +1 @@
+kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch