summaryrefslogtreecommitdiff
path: root/drivers/firmware
diff options
context:
space:
mode:
authorUnnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com>2026-06-17 16:35:00 -0700
committerSudeep Holla <sudeep.holla@kernel.org>2026-06-23 09:57:38 +0100
commitfa4c1901a34e800b0ad00f3e887c14fb8d67a3c7 (patch)
treed4221bf63364f9b2163be583b2994b521c219d37 /drivers/firmware
parentd0ce5f3f926a700d0329951101acddc85ea7ea99 (diff)
downloadlinux-next-fa4c1901a34e800b0ad00f3e887c14fb8d67a3c7.tar.gz
linux-next-fa4c1901a34e800b0ad00f3e887c14fb8d67a3c7.zip
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 pc : uuid_parse+0x40/0xac lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input. Fixes: d0c0bce83122 ("firmware: arm_ffa: Setup in-kernel users of FFA partitions") Signed-off-by: Unnathi Chalicheemala <unnathi.chalicheemala@oss.qualcomm.com> Link: https://patch.msgid.link/20260617-ffa_partition_nullptr_fix-v2-1-bc801b4ce34c@oss.qualcomm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Diffstat (limited to 'drivers/firmware')
-rw-r--r--drivers/firmware/arm_ffa/driver.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index bc2685331b27..d475ff83132d 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -1142,7 +1142,7 @@ static int ffa_partition_info_get(const char *uuid_str,
uuid_t uuid;
struct ffa_partition_info *pbuf;
- if (uuid_parse(uuid_str, &uuid)) {
+ if (!uuid_str || uuid_parse(uuid_str, &uuid)) {
pr_err("invalid uuid (%s)\n", uuid_str);
return -ENODEV;
}