core: spmc: reject too small mem_access_size

The endpoint memory access descriptor array in an FF-A memory transaction
is described by mem_access_size, mem_access_count and mem_access_offs, read
from a normal-world (or SP) descriptor. spmc_read_mem_transaction() checks
that the array fits in the fragment but does not bound mem_access_size from
below.

Each array element is dereferenced as struct ffa_mem_access_common by its
users: get_acc_perms(), spmc_sp_add_share() and ffa_mem_retrieve(). With
mem_access_size smaller than that structure the array-fit check no longer
keeps each element read in range; with mem_access_size 0 and mem_access_offs
equal to frag_len the read lands past the mapped buffer, an out-of-bounds
read in the SPMC.

Check mem_access_size against sizeof(struct ffa_mem_access_common) in each
user of the descriptor, so every site validates the stride is large enough
for what it reads.

Signed-off-by: Guled Hasan <Law.Zoldyck@proton.me>

Author: anarchyj

core/arch/arm/kernel/spmc_sp_handler.c

@@ -344,6 +344,11 @@ int spmc_sp_add_share(struct ffa_mem_transaction_x *mem_trans,
 		goto cleanup;
 	}
 
+	if (mem_acc_size < sizeof(struct ffa_mem_access_common)) {
+		res = FFA_INVALID_PARAMETERS;
+		goto cleanup;
+	}
+
 	/* Store the ffa_mem_transaction */
 	smem->sender_id = sender_id;
 	smem->mem_reg_attr = mem_trans->mem_reg_attr;
@@ -672,6 +677,11 @@ static void ffa_mem_retrieve(struct thread_smc_1_2_regs *args,
 	if (ret)
 		goto err_set;
 
+	if (mem_trans.mem_access_size < sizeof(struct ffa_mem_access_common)) {
+		ret = FFA_INVALID_PARAMETERS;
+		goto err_set;
+	}
+
 	smem = sp_mem_lookup_and_read_lock(mem_trans.global_handle);
 	if (!smem) {
 		DMSG("Incorrect handle");

core/arch/arm/kernel/thread_spmc.c

@@ -1078,6 +1078,9 @@ static int get_acc_perms(vaddr_t mem_acc_base, unsigned int mem_access_size,
 	struct ffa_mem_access_perm *descr = NULL;
 	unsigned int n = 0;
 
+	if (mem_access_size < sizeof(struct ffa_mem_access_common))
+		return FFA_INVALID_PARAMETERS;
+
 	for (n = 0; n < mem_access_count; n++) {
 		mem_acc = (void *)(mem_acc_base + mem_access_size * n);
 		descr = &mem_acc->access_perm;