From 9fbae8cca426284ddbc1d35e2aa5752de52ffd4d Mon Sep 17 00:00:00 2001 From: Sebastian Ene Date: Fri, 8 Aug 2025 08:49:44 +0000 Subject: [PATCH] ANDROID: KVM: Reset the free ffa handle entry When kvm-arm.ffa-unmap-on-lend is used, clearing an ff-a handle from the list keeps an address pointing to the free object. Once we make use of that object in a sub-sequent allocation make sure that wwe clear the free reference. Bug: 430896873 Change-Id: I4e707d4c692e190292103ad56ce5dba16cabd5af Signed-off-by: Sebastian Ene --- arch/arm64/kvm/hyp/nvhe/ffa.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 93c82a834774..1f06bd5d9885 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -121,9 +121,11 @@ static int ffa_host_store_handle(u64 ffa_handle, bool is_lend) if (!static_branch_unlikely(&kvm_ffa_unmap_on_lend)) return 0; - if (spm_free_handle >= spm_handles && - spm_free_handle < (spm_handles + num_spm_handles)) { + if (spm_free_handle) { + WARN_ON(spm_free_handle < spm_handles || + spm_free_handle >= (spm_handles + num_spm_handles)); free_handle = spm_free_handle; + spm_free_handle = NULL; } else { for (i = 0; i < num_spm_handles; i++) if (spm_handles[i].handle == FFA_INVALID_SPM_HANDLE)