On Tue, Sep 1, 2026 at 3:23 PM Harman Kalra <[email protected]> wrote:
>
> When the PF forwards a VF mailbox message to the AF, it computes the
> message size from an offset supplied by the VF without validating it. A
> malicious VF can pick a small offset that wraps the size to a huge value
> used as the copy length, so the copy overruns the mailbox region and
> crashes the PF. Validate the size before use, as other paths already do.
>
> Bugzilla ID: 2024
> Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
> Cc: [email protected]
>
> Signed-off-by: Harman Kalra <[email protected]>
Applied to dpdk-next-net-mrvl/for-main. Thanks
> ---
> drivers/common/cnxk/roc_dev.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
> index 61aa4b3075..433aca1dd3 100644
> --- a/drivers/common/cnxk/roc_dev.c
> +++ b/drivers/common/cnxk/roc_dev.c
> @@ -286,6 +286,17 @@ vf_pf_process_msgs(struct dev *dev, uint16_t vf)
> msg = (struct mbox_msghdr *)((uintptr_t)mdev->mbase + offset);
> size = mbox->rx_start + msg->next_msgoff - offset;
>
> + /*
> + * next_msgoff is VF-controlled. Reject a message whose size
> is
> + * smaller than the header or larger than the maximum request
> so
> + * an underflowed size cannot be used as the copy length
> below.
> + */
> + if (size < sizeof(struct mbox_msghdr) ||
> + (size - sizeof(struct mbox_msghdr)) >
> MBOX_MSG_REQ_SIZE_MAX) {
> + plt_err("VF%d: invalid mbox msg size %zu", vf, size);
> + break;
> + }
> +
> /* RVU_PF_FUNC_S */
> msg->pcifunc = dev_pf_func(dev->pf, vf);
>
> --
> 2.43.0
>
