core: spmc: reject too small mem_access_size

The endpoint memory access descriptor array in an FF-A memory
transaction is described by mem_access_size, mem_access_count and
mem_access_offs, read from a normal-world (or SP) descriptor.
spmc_read_mem_transaction() checks that the array fits in the fragment
but does not bound mem_access_size from below.

Each array element is dereferenced as struct ffa_mem_access_common by
its users: get_acc_perms(), spmc_sp_add_share(), ffa_mem_retrieve(),
is_sp_op() and thread_spmc_populate_mobj_from_rx(). With mem_access_size
smaller than that structure the array-fit check no longer keeps each
element read in range; with mem_access_size 0 and mem_access_offs equal
to frag_len the read lands past the mapped buffer, an out-of-bounds read
in the SPMC.

Check mem_access_size against sizeof(struct ffa_mem_access_common) in
each user of the descriptor. Also reject mem_access_count 0 in
ffa_mem_retrieve() and thread_spmc_populate_mobj_from_rx(), which
dereference the first descriptor before the count is otherwise checked.

Signed-off-by: Guled Hasan <Law.Zoldyck@proton.me>

Author: anarchyj

core/arch/arm/kernel/spmc_sp_handler.c

@@ -344,6 +344,11 @@ int spmc_sp_add_share(struct ffa_mem_transaction_x *mem_trans,
 		goto cleanup;
 	}
 
+	if (mem_acc_size < sizeof(struct ffa_mem_access_common)) {
+		res = FFA_INVALID_PARAMETERS;
+		goto cleanup;
+	}
+
 	/* Store the ffa_mem_transaction */
 	smem->sender_id = sender_id;
 	smem->mem_reg_attr = mem_trans->mem_reg_attr;
@@ -672,6 +677,12 @@ static void ffa_mem_retrieve(struct thread_smc_1_2_regs *args,
 	if (ret)
 		goto err_set;
 
+	if (mem_trans.mem_access_size < sizeof(struct ffa_mem_access_common) ||
+	    mem_trans.mem_access_count < 1) {
+		ret = FFA_INVALID_PARAMETERS;
+		goto err_set;
+	}
+
 	smem = sp_mem_lookup_and_read_lock(mem_trans.global_handle);
 	if (!smem) {
 		DMSG("Incorrect handle");

core/arch/arm/kernel/thread_spmc.c

@@ -1078,6 +1078,9 @@ static int get_acc_perms(vaddr_t mem_acc_base, unsigned int mem_access_size,
 	struct ffa_mem_access_perm *descr = NULL;
 	unsigned int n = 0;
 
+	if (mem_access_size < sizeof(struct ffa_mem_access_common))
+		return FFA_INVALID_PARAMETERS;
+
 	for (n = 0; n < mem_access_count; n++) {
 		mem_acc = (void *)(mem_acc_base + mem_access_size * n);
 		descr = &mem_acc->access_perm;
@@ -1207,6 +1210,9 @@ static bool is_sp_op(struct ffa_mem_transaction_x *mem_trans, void *buf)
 	if (mem_trans->mem_access_count < 1)
 		return false;
 
+	if (mem_trans->mem_access_size < sizeof(struct ffa_mem_access_common))
+		return false;
+
 	mem_acc = (void *)((vaddr_t)buf + mem_trans->mem_access_offs);
 	perm = &mem_acc->access_perm;
 
@@ -2867,6 +2873,10 @@ struct mobj_ffa *thread_spmc_populate_mobj_from_rx(uint64_t cookie,
 	if (!IS_ALIGNED_WITH_TYPE(frag_len, struct ffa_address_range) ||
 	    !IS_ALIGNED_WITH_TYPE(tot_len, struct ffa_address_range))
 		goto out;
+	if (retrieve_desc.mem_access_size <
+	    sizeof(struct ffa_mem_access_common) ||
+	    retrieve_desc.mem_access_count < 1)
+		goto out;
 	mem_acc = (void *)((vaddr_t)buf + retrieve_desc.mem_access_offs);
 	/*
 	 * We assume struct ffa_mem_region is well aligned.