On Mon, Nov 2, 2026 at 5:53 PM Aarnav JP <[email protected]> wrote:
>
> roc_nix_max_rep_count() copied rsp->rep_cnt entries from the get_rep_cnt
> mailbox response into the fixed 64-entry roc_nix->rep_pfvf_map[] without
> validating the AF-supplied count. rep_cnt is a uint16_t, so a malformed
> or malicious AF response could overrun the array (and read past the
> response's 64-entry map), corrupting adjacent driver state.
>
> Reject responses with rep_cnt greater than MAX_PFVF_REP before copying.
>
> Fixes: 162c77c18838 ("common/cnxk: add support for representors")
> Cc: [email protected]
>
> Signed-off-by: Aarnav JP <[email protected]>
Series applied to dpdk-next-net-mrvl/for-main. Thanks
> ---
> drivers/common/cnxk/roc_nix.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/common/cnxk/roc_nix.c b/drivers/common/cnxk/roc_nix.c
> index 8e3903051d..ae6a918682 100644
> --- a/drivers/common/cnxk/roc_nix.c
> +++ b/drivers/common/cnxk/roc_nix.c
> @@ -589,6 +589,12 @@ roc_nix_max_rep_count(struct roc_nix *roc_nix)
> if (rc)
> goto exit;
>
> + if (rsp->rep_cnt > MAX_PFVF_REP) {
> + plt_err("Invalid rep_cnt %u in get_rep_cnt rsp",
> rsp->rep_cnt);
> + rc = -EIO;
> + goto exit;
> + }
> +
> roc_nix->rep_cnt = rsp->rep_cnt;
> for (i = 0; i < rsp->rep_cnt; i++)
> roc_nix->rep_pfvf_map[i] = rsp->rep_pfvf_map[i];
> --
> 2.43.0
>
