From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EA14CCF2DE for ; Mon, 19 Oct 2026 13:09:23 +0000 (UTC) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 984A6406A2; Mon, 19 Oct 2026 15:08:39 +0200 (CEST) Received: from mx0a-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by mails.dpdk.org (Postfix) with ESMTP id A186D40689 for ; Mon, 19 Oct 2026 15:08:37 +0200 (CEST) Received: from pps.filterd (m0431384.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69J8ONHd242494 for ; Mon, 19 Oct 2026 06:08:36 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pfpt0220; bh=u k80RgGjwa0CUJLhSIySMLFLoZ4tx9lIGF4W36mv1Bc=; b=C8UflKCs76Lu6r8CS IIMTLnxmYaZ4AevzMgJInMQNtvBT4QIkWDytKZLMI6YO30DWfM9/BQpWTrU7X/Bn 9TlWWwNRJmp5PquZrFJf2qXOfS9CWZGdY2xRkG/F1jEcT38/9d1QxM654SLC5Y4V 6LmXRIo6tszmJIFfypNGV/VSWc5pi0HcQibfIC3w6HuN2sQhLybXhQASepSi1K8r fU0KxwTfDoa0brkPaDZqgbuGmTCtKOAsjhEPe+DPUs4lGhzksCRZthElCzmgWgLs qAxEGgQ2fUSUgJq/wGsZVDEBTGCNGVu10JuhmsE/adVzFXG/tzdJ8GW12uSW9zTQ vQFeQ== Received: from dc5-exch05.marvell.com ([199.233.59.128]) by mx0a-0016f401.pphosted.com (PPS) with ESMTPS id 4hcw98k3en-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 19 Oct 2026 06:08:36 -0700 (PDT) Received: from DC5-EXCH05.marvell.com (10.69.176.209) by DC5-EXCH05.marvell.com (10.69.176.209) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.25; Mon, 19 Oct 2026 06:08:36 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH05.marvell.com (10.69.176.209) with Microsoft SMTP Server id 15.2.1544.25 via Frontend Transport; Mon, 19 Oct 2026 06:08:35 -0700 Received: from cavium-System-Product-Name.. (unknown [10.28.38.254]) by maili.marvell.com (Postfix) with ESMTP id B35B03F704D; Mon, 19 Oct 2026 06:08:33 -0700 (PDT) From: Tejasree Kondoj To: Akhil Goyal CC: Rupesh Chiluka , Anoob Joseph , Vidya Sagar Velumuri , Ankur Dwivedi , Nithin Dabilpuram , Subject: [PATCH 12/16] crypto/cnxk: validate TLS 1.2 MAC trim lengths Date: Mon, 19 Oct 2026 18:37:53 +0530 Message-ID: <20261019130759.2181566-13-ktejasree@marvell.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261019130759.2181566-1-ktejasree@marvell.com> References: <20261019130759.2181566-1-ktejasree@marvell.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-GUID: Ps0cLFCEJN4vcpfO7Mwk5bu7tDzi3Wne X-Proofpoint-ORIG-GUID: Ps0cLFCEJN4vcpfO7Mwk5bu7tDzi3Wne X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE5MDA1MiBTYWx0ZWRfXyH0C/N2vA3zy 4UloRisr141ZuZoNsIbonqXOdsX7uJ9vCtuyVXyGv2m1syagAeYD8HiGulAuM0zwwPvYzEWPJTH pNhnUMm7kF8Op92OlpFvkV6gM0lL6po= X-Authority-Analysis: v=2.4 cv=aKRlOr9m c=1 sm=1 tr=0 ts=6ad61654 cx=c_pps a=rEv8fa4AjpPjGxpoe8rlIQ==:117 a=rEv8fa4AjpPjGxpoe8rlIQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=l0iWHRpgs5sLHlkKQ1IR:22 a=TtqV-g6YmW1Jfm2GSLaY:22 a=M5GUcnROAAAA:8 a=2rtmuTpHgigTJol3w1EA:9 a=OBjm3rFKGHvpk9ecZwUJ:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE5MDA1MiBTYWx0ZWRfX/XzAU2bAgiCO t7KenpGAQ5ELmi/XVMZKGAqYmGFop3PI2PxDiX7ZybivdD5tx4b3eEgd7Z0zbV05slRdBgZfC7W a2irgv0Ze9hk2PoHLK1pLpGQkeSQaV2dU1TuG7qscBJwD2AR86XdNstC6TflSVV/QT/Ajj5omf+ DQXq05WGHPMjsFr8x8LjF+Ypfepr6uWs5QVs4riFSwPzMpn4brS1TW9Dt6PQp3M0yX3Ckrzhc7B CexS51URT66vxsztnngrJlMWLFQyTM5IH/5KvTQg4jD52mNKPFYUL8EMY7ZGVZeiojXW+BBiBS3 GeXY4h9q1c4tOmrazYKw1wURP5DT9RLYB3C/tNYpSKvcU6JdKXlc5lhn9kXWGn6GbSzWwdQsFfH a5URdN/0cID51FqGvECN5P6AS5I4tKfez1SiWLBtkN7rhzqMYSE3hQ8pu4pqObm+Z6b5jqDh1GK P90kBXLXMUn9myRSnGg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-19_03,2026-10-14_01,2025-10-01_01 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Rupesh Chiluka In cn10k_cpt_tls12_trim_mac() and cn20k_cpt_tls12_trim_mac(), the pad length comes from the decrypted record and the record length from hardware. Neither was fully validated against the mbuf. Padding larger than the record made the MAC and pad offsets underflow. That caused out-of-bounds reads in direct mode and a walk past the end of the segment chain in SG mode. Fail the op with an error and skip trimming when trim_len exceeds the record length, or when the record length exceedds pkt_len. Signed-off-by: Rupesh Chiluka --- drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 2 +- drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c index 30ef0d14c2..365e3a8535 100644 --- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c @@ -943,7 +943,7 @@ cn10k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn10k_res_s *res, pad_len = pad_val + 1; trim_len = pad_len + mac_len; - if (trim_len > m_len) { + if (trim_len > m_len || m_len > mbuf->pkt_len) { cop->status = RTE_CRYPTO_OP_STATUS_ERROR; cop->aux_flags = res->uc_compcode; return; diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c index f91e56f3ed..bb3384023f 100644 --- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c @@ -705,7 +705,7 @@ cn20k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn20k_res_s *res, pad_len = pad_val + 1; trim_len = pad_len + mac_len; - if (trim_len > m_len) { + if (trim_len > m_len || m_len > mbuf->pkt_len) { cop->status = RTE_CRYPTO_OP_STATUS_ERROR; cop->aux_flags = res->uc_compcode; return; -- 2.43.0