tf_msg_tcam_entry_get() copies the TCAM key, mask and result out of
the firmware response using the key_size, result_offset and
result_size values returned in the response, without checking them
against the size of the dev_data[] array they index. The mask is
read from dev_data[key_size] for key_size bytes and the result from
dev_data[result_offset] for result_size bytes, so a bad value
makes the copy read past the end of the 272 byte array in the
response on the stack.
Reject the response with -EINVAL if the key and mask (2 * key_size)
or the result (result_offset + result_size) do not fit in dev_data[].
Fixes: a9597be79f66 ("net/bnxt: support L2 context TCAM operations")
Cc: [email protected]
Signed-off-by: Manish Kurup <[email protected]>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
patch); this is the tf_msg_tcam_entry_get() response check.
* New subject and commit message; single Fixes: tag.
drivers/net/bnxt/tf_core/tf_msg.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/bnxt/tf_core/tf_msg.c
b/drivers/net/bnxt/tf_core/tf_msg.c
index aab8d05d81..c345d0a7ce 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -1243,6 +1243,16 @@ tf_msg_tcam_entry_get(struct tf *tfp,
strerror(-rc));
return rc;
}
+ if (resp.key_size * 2 > sizeof(resp.dev_data) ||
+ resp.result_offset + resp.result_size > sizeof(resp.dev_data)) {
+ rc = -EINVAL;
+ TFP_DRV_LOG(ERR,
+ "%s: FW data out of bounds key_size(%d)
result_offset(%d) result_size(%d), rc:%s\n",
+ tf_dir_2_str(parms->dir), resp.key_size,
+ resp.result_offset, resp.result_size,
+ strerror(-rc));
+ return rc;
+ }
parms->key_size = resp.key_size;
parms->result_size = resp.result_size;
tfp_memcpy(parms->key, resp.dev_data, resp.key_size);
--
2.31.1
