arm_ffa MemDescriptor OOB

Vulnerability analysis

The FF-A memory sharing driver calculates the offset to endpoint memory access descriptors using a fixed structure size instead of the spec-mandated offset field stored in the descriptor itself. Because the descriptor's offset field is not initialized until later in the setup flow, the driver writes endpoint access data at incorrect positions within the transaction buffer. Combined with the absence of bounds checks on the calculated offsets against the buffer's maximum fragment size, a sufficiently large number of endpoints causes writes past the end of the allocated buffer. The fix moves the descriptor initialization earlier so the correct offset field is populated before it is read, uses that field for offset calculation, and adds overflow and bounds checks that reject transactions whose descriptor offsets would exceed the buffer size. The vulnerable code path is reached when a guest VM on an Arm system with FF-A support initiates a memory sharing or lending transaction that the host kernel processes.