core: spmc: reject too small mem_access_size - #7945
Open
anarchyj wants to merge 1 commit into
Open
Conversation
jenswikl
reviewed
Aug 25, 2026
anarchyj
force-pushed
the
anarchyj-patch-2
branch
3 times, most recently
from
August 26, 2026 10:38
65ffe80 to
ebc1b3d
Compare
jenswikl
reviewed
Aug 27, 2026
anarchyj
force-pushed
the
anarchyj-patch-2
branch
2 times, most recently
from
August 27, 2026 16:24
8782f5d to
93bd7a2
Compare
jenswikl
reviewed
Aug 28, 2026
anarchyj
force-pushed
the
anarchyj-patch-2
branch
from
August 28, 2026 07:52
93bd7a2 to
231b64f
Compare
Contributor
|
|
The endpoint memory access descriptor array in an FF-A memory transaction is described by mem_access_size, mem_access_count and mem_access_offs, read from a normal-world (or SP) descriptor. spmc_read_mem_transaction() checks that the array fits in the fragment but does not bound mem_access_size from below. Each array element is dereferenced as struct ffa_mem_access_common by its users: get_acc_perms(), spmc_sp_add_share(), ffa_mem_retrieve(), is_sp_op() and thread_spmc_populate_mobj_from_rx(). With mem_access_size smaller than that structure the array-fit check no longer keeps each element read in range; with mem_access_size 0 and mem_access_offs equal to frag_len the read lands past the mapped buffer, an out-of-bounds read in the SPMC. Check mem_access_size against sizeof(struct ffa_mem_access_common) in each user of the descriptor. Also reject mem_access_count 0 in ffa_mem_retrieve() and thread_spmc_populate_mobj_from_rx(), which dereference the first descriptor before the count is otherwise checked. Signed-off-by: Guled Hasan <Law.Zoldyck@proton.me> Reviewed-by: Jens Wiklander <jens.wiklander@oss.qualcomm.com>
anarchyj
force-pushed
the
anarchyj-patch-2
branch
from
August 28, 2026 13:30
231b64f to
c30cba0
Compare
Contributor
Author
|
Applied. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
spmc_read_mem_transaction() reads mem_access_size, mem_access_count and mem_access_offs from a normal-world memory transaction descriptor and checks that the endpoint memory access descriptor array fits within the fragment (mem_access_offs + mem_access_size * mem_access_count <= frag_len). mem_access_size is bounded from above but not from below.
The array elements are dereferenced as struct ffa_mem_access_common, in get_acc_perms() and, on the S-EL0 secure partition path, in spmc_sp_add_share(). With mem_access_size smaller than that structure the array-fit check no longer keeps each element read in range; with mem_access_size 0 and mem_access_offs equal to frag_len the read lands past the mapped buffer. The descriptor comes from the normal world, so this is an out-of-bounds read in the SPMC.
Reject a mem_access_size smaller than struct ffa_mem_access_common. Both dereference sites take mem_access_size from this function, so the single check covers both.