[PATCH net 0/6] net/ncsi: harden packet parsing against malformed BMC replies

Michael Bommarito
2026-04-22T16:05:05Z

NC-SI treats the management controller as privileged, but the Linux
packet parser still needs to reject malformed or truncated replies
instead of walking past the skb or past its software filter tables.

This series closes six linked parser issues in net/ncsi:

- short replies accepted before response header/checksum reads
- GC/GP count fields exceeding software filter limits
- GMCMA address counts exceeding payload-backed addresses
- OEM response parsing that trusts vendor-specific payload offsets
- short AEN packets accepted before AEN header/payload reads
- GP payloads not checked against the consumed MAC/VLAN table bytes

The threat model here is a compromised BMC or management-channel MITM
on the NC-SI link. This is not internet-reachable remote input, so I am
sending it as a public [PATCH net] series with Cc: stable rather than
through security@.

Testing:

- x86_64 defconfig with CONFIG_NET_NCSI=y and
CONFIG_NCSI_OEM_CMD_GET_MAC=y:
`make -C ~/src/linux-mainline O=~/src/build-ncsi-bmc-oob ARCH=x86_64
-j$(nproc) net/ncsi/`
- live x86_64/KASAN QEMU guest for the GP path: guest `virtio-net`
registered with NCSI, `SP -> CIS -> GC -> GP` issued over the
`NCSI` generic-netlink family, and a host tap responder returning
matching NC-SI frames. Without the series applied, a GP reply
with mac_cnt=65 triggers
`KASAN: slab-out-of-bounds in ncsi_rsp_handler_gp()`. With the
series applied, the same reply is rejected with `-ERANGE` and no
KASAN report.
- synthetic A/B userspace harness covering the other malformed-
response cases: without the series, parsing either faults or
corrupts adjacent state; with the series, each case is rejected
or clamped at the parser boundary.

Impact / regression notes:

- libclang call-graph query shows ncsi_validate_rsp_pkt() is only
reached from ncsi_rcv_rsp() and ncsi_rsp_handler_dc(), so the new
skb-length guard stays local to the response path.
- cscope shows ncsi_aen_handler() is only reached from ncsi_rcv_rsp(),
so the new AEN pulls stay local to AEN dispatch.
- cscope on n_vids shows the downstream consumers are the response
parser, the manage-side VLAN bitmap walkers, and ncsi-netlink's
channel dump path, which is the surface this series intentionally
tightens.

Michael Bommarito (6):
net/ncsi: validate response packet lengths against the skb
net/ncsi: bound filter table state to software limits
net/ncsi: validate GMCMA address counts against the payload
net/ncsi: validate OEM response payloads before parsing
net/ncsi: validate AEN packet lengths against the skb
net/ncsi: validate GP payload lengths before parsing

net/ncsi/ncsi-aen.c | 30 +++++++++---
net/ncsi/ncsi-rsp.c | 114 ++++++++++++++++++++++++++++++++++++++++----
2 files changed, 128 insertions(+), 16 deletions(-)

--
2.53.0