diff options
| author | Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com> | 2026-06-17 16:35:00 -0700 |
|---|---|---|
| committer | Sudeep Holla <sudeep.holla@kernel.org> | 2026-06-23 09:57:38 +0100 |
| commit | fa4c1901a34e800b0ad00f3e887c14fb8d67a3c7 (patch) | |
| tree | d4221bf63364f9b2163be583b2994b521c219d37 /drivers/firmware | |
| parent | d0ce5f3f926a700d0329951101acddc85ea7ea99 (diff) | |
| download | linux-next-fa4c1901a34e800b0ad00f3e887c14fb8d67a3c7.tar.gz linux-next-fa4c1901a34e800b0ad00f3e887c14fb8d67a3c7.zip | |
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
ffa_partition_info_get() passes uuid_str directly to uuid_parse()
without a NULL check. When a caller passes NULL, uuid_parse() ->
__uuid_parse() -> uuid_is_valid() dereferences the pointer, causing
a kernel panic:
Unable to handle kernel NULL pointer dereference at virtual address
0000000000000040
pc : uuid_parse+0x40/0xac
lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns
-ENODEV instead of crashing. Callers are expected to always supply
a valid partition UUID, so NULL is not a supported input.
Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions")
Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>
Link: https://patch.msgid.link/20260617-ffa_partition_nullptr_fix-v2-1-bc801b4ce34c@oss.qualcomm.com
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Diffstat (limited to 'drivers/firmware')
| -rw-r--r-- | drivers/firmware/arm_ffa/driver.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index bc2685331b27..d475ff83132d 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -1142,7 +1142,7 @@ static int ffa_partition_info_get(const char *uuid_str, uuid_t uuid; struct ffa_partition_info *pbuf; - if (uuid_parse(uuid_str, &uuid)) { + if (!uuid_str || uuid_parse(uuid_str, &uuid)) { pr_err("invalid uuid (%s)\n", uuid_str); return -ENODEV; } |
