From: Rupesh Chiluka <[email protected]> The IPsec SA builders copy the cipher key into the fixed 32-byte SA context field via memcpy. The per-algorithm length validation only runs for AES/DES/3DES and AES-GMAC, so a NULL-cipher SA with a non-zero, oversized key.length skips every check.
Reject any key longer than the SA cipher key field with -EINVAL. Signed-off-by: Rupesh Chiluka <[email protected]> --- drivers/common/cnxk/cnxk_security.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c index 228ff2781d..9f734c16b1 100644 --- a/drivers/common/cnxk/cnxk_security.c +++ b/drivers/common/cnxk/cnxk_security.c @@ -170,6 +170,10 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2, uint8_t *cipher_k w2->s.spi = ipsec_xfrm->spi; if (key != NULL && length != 0) { + if (length > ROC_CTX_MAX_CKEY_LEN) { + plt_err("Invalid cipher key length"); + return -EINVAL; + } /* Validate key length and set AES key len before copy to avoid overflow */ if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC || w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR || @@ -1012,8 +1016,13 @@ on_fill_ipsec_common_sa(struct rte_security_ipsec_xform *ipsec, } } - if (cipher_key_len != 0) + if (cipher_key_len != 0) { + if (cipher_key_len > (int)sizeof(common_sa->cipher_key)) { + plt_err("Invalid cipher key length"); + return -EINVAL; + } memcpy(common_sa->cipher_key, cipher_key, cipher_key_len); + } return 0; } @@ -1403,6 +1412,10 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k w2->s.spi = ipsec_xfrm->spi; if (key != NULL && length != 0) { + if (length > ROC_CTX_MAX_CKEY_LEN) { + plt_err("Invalid cipher key length"); + return -EINVAL; + } /* Validate key length and set AES key len before copy to avoid overflow */ if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC || w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR || -- 2.43.0
