[PATCH] common/cnxk: fix mailbox message size underflow

[PATCH] common/cnxk: fix mailbox message size underflow

[Harman Kalra]

When the PF forwards a VF mailbox message to the AF, it computes the
message size from an offset supplied by the VF without validating it. A
malicious VF can pick a small offset that wraps the size to a huge value
used as the copy length, so the copy overruns the mailbox region and
crashes the PF. Validate the size before use, as other paths already do.

Bugzilla ID: 2024
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Cc: stable@dpdk.org

Signed-off-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/common/cnxk/roc_dev.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 61aa4b3075..433aca1dd3 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -286,6 +286,17 @@ vf_pf_process_msgs(struct dev *dev, uint16_t vf)
 		msg = (struct mbox_msghdr *)((uintptr_t)mdev->mbase + offset);
 		size = mbox->rx_start + msg->next_msgoff - offset;
 
+		/*
+		 * next_msgoff is VF-controlled. Reject a message whose size is
+		 * smaller than the header or larger than the maximum request so
+		 * an underflowed size cannot be used as the copy length below.
+		 */
+		if (size < sizeof(struct mbox_msghdr) ||
+		    (size - sizeof(struct mbox_msghdr)) > MBOX_MSG_REQ_SIZE_MAX) {
+			plt_err("VF%d: invalid mbox msg size %zu", vf, size);
+			break;
+		}
+
 		/* RVU_PF_FUNC_S */
 		msg->pcifunc = dev_pf_func(dev->pf, vf);
 
-- 
2.43.0