diff options
| author | Sudeep Holla <sudeep.holla@kernel.org> | 2026-04-28 19:33:25 +0100 |
|---|---|---|
| committer | Sudeep Holla <sudeep.holla@kernel.org> | 2026-04-29 16:50:34 +0100 |
| commit | 0a5e695095c557d2380131b613dea4e8d90371be (patch) | |
| tree | cf64e031b27814487d527ba60bb3d991d5ec0972 | |
| parent | 254f49634ee16a731174d2ae34bc50bd5f45e731 (diff) | |
| download | linux-0a5e695095c557d2380131b613dea4e8d90371be.tar.gz linux-0a5e695095c557d2380131b613dea4e8d90371be.zip | |
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
The bus match callback assumes that every FF-A driver provides an
id_table and dereferences it unconditionally. Enforce that contract at
registration time so a buggy client driver cannot crash the bus during
match.
Fixes: 92743071464f ("firmware: arm_ffa: Ensure drivers provide a probe function")
Link: https://patch.msgid.link/20260428-ffa_fixes-v2-1-8595ae450034@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
| -rw-r--r-- | drivers/firmware/arm_ffa/bus.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/firmware/arm_ffa/bus.c b/drivers/firmware/arm_ffa/bus.c index 9576862d89c4..601c3418e0d9 100644 --- a/drivers/firmware/arm_ffa/bus.c +++ b/drivers/firmware/arm_ffa/bus.c @@ -26,6 +26,8 @@ static int ffa_device_match(struct device *dev, const struct device_driver *drv) id_table = to_ffa_driver(drv)->id_table; ffa_dev = to_ffa_dev(dev); + if (!id_table) + return 0; while (!uuid_is_null(&id_table->uuid)) { /* @@ -123,7 +125,7 @@ int ffa_driver_register(struct ffa_driver *driver, struct module *owner, { int ret; - if (!driver->probe) + if (!driver->probe || !driver->id_table) return -EINVAL; driver->driver.bus = &ffa_bus_type; |