Re: [PATCH v3 1/3] cxl/features: Reject Get Feature count larger than the output buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds checks on user-provided input length in `cxlctl_fw_rpc()` and `cxlctl_set_feature()`, leading to out-of-bounds reads and potential ZERO_SIZE_PTR crashes.
--

commit 1f7098b182e4cdaf480b19545ca818cbf043bd29
Author: Richard Cheng <icheng@nvidia.com>

cxl/features: Reject Get Feature count larger than the output buffer

cxlctl_get_feature() sizes its output buffer from the user's
fwctl_rpc.out_len, but the device is told to write count bytes into
rpc_out->payload. This adds bounds checking against out_size to prevent
overflowing the allocated buffer.

> diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c
> index 85185af46b72d..9c714ee42a411 100644
> --- a/drivers/cxl/core/features.c
> +++ b/drivers/cxl/core/features.c
> @@ -471,6 +471,10 @@ static void *cxlctl_get_feature(struct cxl_features_state *cxlfs,
>  	if (!count)
>  		return ERR_PTR(-EINVAL);
>  
> +	if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload) ||
> +	    count > out_size - offsetof(struct fwctl_rpc_cxl_out, payload))
> +		return ERR_PTR(-EINVAL);
> +

[Severity: Critical]
This is a pre-existing issue, but while we are adding bounds checks for
the output buffer here, does cxlctl_fw_rpc() also need to validate the
user-provided in_len?

If the ioctl is called with an in_len of 0, could dereferencing
rpc_in->opcode in cxlctl_fw_rpc() lead to a zero-size pointer crash?

Similarly, in cxlctl_set_feature(), the operation size is calculated without
verifying in_len:

    data_size = rpc_in->op_size - sizeof(feat_in->hdr);

Could a small in_len combined with a large rpc_in->op_size result in an
out-of-bounds read, copying adjacent kernel heap memory into the hardware
mailbox? Would validating in_len against op_size in cxlctl_fw_rpc() prevent
this?

>  	struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) =
>  		kvzalloc(out_size, GFP_KERNEL);
>  	if (!rpc_out)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626104102.53892-1-icheng@nvidia.com?part=1