]> git.ipfire.org Git - thirdparty/linux.git/commit
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
authorSudeep Holla <sudeep.holla@kernel.org>
Tue, 28 Apr 2026 18:33:30 +0000 (19:33 +0100)
committerSudeep Holla <sudeep.holla@kernel.org>
Tue, 5 May 2026 15:40:41 +0000 (16:40 +0100)
commit3974ea1938406f9bfa7c1f48d4e43533f447bb08
treebc14d0032b0017df5b92098422e10afc994e05d6
parent6d3daa9b8d313f42d52e75590310f26a29b61b44
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided
indices when copying partition descriptors into the caller buffer.
Reject inconsistent counts or index progressions so the copy loop cannot
write past the allocated array.

Fixes: ba85c644ac8d ("firmware: arm_ffa: Add support for FFA_PARTITION_INFO_GET_REGS")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-6-8595ae450034@kernel.org
(fixed cur_idx when exactly one descriptor in the first fragment)
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
drivers/firmware/arm_ffa/driver.c