From: Rupesh Chiluka <[email protected]> In cn10k_cpt_tls12_trim_mac() and cn20k_cpt_tls12_trim_mac(), the pad length comes from the decrypted record and the record length from hardware. Neither was fully validated against the mbuf. Padding larger than the record made the MAC and pad offsets underflow. That caused out-of-bounds reads in direct mode and a walk past the end of the segment chain in SG mode.
Fail the op with an error and skip trimming when trim_len exceeds the record length, or when the record length exceedds pkt_len. Signed-off-by: Rupesh Chiluka <[email protected]> --- drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 2 +- drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c index 30ef0d14c2..365e3a8535 100644 --- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c @@ -943,7 +943,7 @@ cn10k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn10k_res_s *res, pad_len = pad_val + 1; trim_len = pad_len + mac_len; - if (trim_len > m_len) { + if (trim_len > m_len || m_len > mbuf->pkt_len) { cop->status = RTE_CRYPTO_OP_STATUS_ERROR; cop->aux_flags = res->uc_compcode; return; diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c index f91e56f3ed..bb3384023f 100644 --- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c @@ -705,7 +705,7 @@ cn20k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn20k_res_s *res, pad_len = pad_val + 1; trim_len = pad_len + mac_len; - if (trim_len > m_len) { + if (trim_len > m_len || m_len > mbuf->pkt_len) { cop->status = RTE_CRYPTO_OP_STATUS_ERROR; cop->aux_flags = res->uc_compcode; return; -- 2.43.0
