diff options
| author |   Sudeep Holla <sudeep.holla@kernel.org> | 2026-04-28 19:33:32 +0100 |
|---|---|---|
| committer | Sudeep Holla <sudeep.holla@kernel.org> | 2026-05-05 16:42:48 +0100 |
| commit | 4a1cc9e96b311d2609a6f963a5e35bd4ae730d97 (patch) | |
| tree | 87594a9d3f4153a24bf3391fa0f91eba2cb1ab61 /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | firmware: arm_ffa: Keep framework RX release under lock (diff) | |
firmware: arm_ffa: Validate framework notification message layout
Framework notifications carry an indirect message in the shared RX
buffer. Validate the reported offset and size before using them, reject
zero-length payloads, and ensure that any non-header payload starts at
the UUID field rather than in the middle of the message header.
Use the validated offset and size values for both kmemdup() and the UUID
parsing path so malformed firmware data cannot drive an out-of-bounds
read or an oversized allocation.
Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-8-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions