From 2483f4365c65373c438e87e4335590799499f67f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 24 Nov 2025 11:53:56 +0100 Subject: [PATCH] 6.12-stable patches added patches: kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch series --- ...ntrusted-offset-in-ff-a-memory-share.patch | 48 +++++++++++++++++++ queue-6.12/series | 1 + 2 files changed, 49 insertions(+) create mode 100644 queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch create mode 100644 queue-6.12/series diff --git a/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch b/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch new file mode 100644 index 0000000000..406d5f66b8 --- /dev/null +++ b/queue-6.12/kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch @@ -0,0 +1,48 @@ +From 103e17aac09cdd358133f9e00998b75d6c1f1518 Mon Sep 17 00:00:00 2001 +From: Sebastian Ene +Date: Fri, 17 Oct 2025 07:57:10 +0000 +Subject: KVM: arm64: Check the untrusted offset in FF-A memory share + +From: Sebastian Ene + +commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream. + +Verify the offset to prevent OOB access in the hypervisor +FF-A buffer in case an untrusted large enough value +[U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] +is set from the host kernel. + +Signed-off-by: Sebastian Ene +Acked-by: Will Deacon +Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kvm/hyp/nvhe/ffa.c ++++ b/arch/arm64/kvm/hyp/nvhe/ffa.c +@@ -437,7 +437,7 @@ static void __do_ffa_mem_xfer(const u64 + struct ffa_mem_region_attributes *ep_mem_access; + struct ffa_composite_mem_region *reg; + struct ffa_mem_region *buf; +- u32 offset, nr_ranges; ++ u32 offset, nr_ranges, checked_offset; + int ret = 0; + + if (addr_mbz || npages_mbz || fraglen > len || +@@ -474,7 +474,12 @@ static void __do_ffa_mem_xfer(const u64 + goto out_unlock; + } + +- if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) { ++ if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) { ++ ret = FFA_RET_INVALID_PARAMETERS; ++ goto out_unlock; ++ } ++ ++ if (fraglen < checked_offset) { + ret = FFA_RET_INVALID_PARAMETERS; + goto out_unlock; + } diff --git a/queue-6.12/series b/queue-6.12/series new file mode 100644 index 0000000000..361fd0455c --- /dev/null +++ b/queue-6.12/series @@ -0,0 +1 @@ +kvm-arm64-check-the-untrusted-offset-in-ff-a-memory-share.patch -- 2.47.3