niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

firmware: arm_ffa: Fix memory corruption in ffa_msg_send2()

Browse source 
The "msg" pointer is a struct and msg->offset is the sizeof(*msg).  The
pointer here math means the memcpy() will write outside the bounds.
Cast "msg" to a u8 pointer to fix this.

Fixes: 02c19d84c7 ("firmware: arm_ffa: Add support for FFA_MSG_SEND2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/cd5fb6b5-81fa-4a6d-b2b8-284ca704bbff@moroto.mountain
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
This commit is contained in:
Dan Carpenter 2024-04-24 14:40:43 +03:00 • committed by Sudeep Holla
parent 02c19d84c7
commit ddfade88f4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/firmware/arm_ffa/driver.c
View file

@ -363,7 +363,7 @@ static int ffa_msg_send2(u16 src_id, u16 dst_id, void *buf, size_t sz)
msg->offset = sizeof(*msg);
msg->send_recv_id = src_dst_ids;
msg->size = sz;
memcpy(msg + msg->offset, buf, sz);
memcpy((u8 *)msg + msg->offset, buf, sz);
/* flags = 0, sender VMID = 0 works for both physical/virtual NS */
invoke_ffa_fn((ffa_value_t){