diff mbox series

[v2,2/2] common/cnxk: fix possible out-of-bounds access

Message ID 20240301033534.1968900-2-psatheesh@marvell.com (mailing list archive)
State Accepted, archived
Delegated to: Jerin Jacob
Headers
Series [v2,1/2] common/cnxk: remove dead code |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/loongarch-compilation success Compilation OK
ci/loongarch-unit-testing success Unit Testing PASS
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/intel-Functional success Functional PASS
ci/github-robot: build success github build: passed
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-abi-testing success Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-compile-amd64-testing success Testing PASS
ci/iol-unit-arm64-testing success Testing PASS
ci/iol-compile-arm64-testing success Testing PASS
ci/iol-unit-amd64-testing success Testing PASS
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-broadcom-Functional success Functional Testing PASS
ci/iol-sample-apps-testing success Testing PASS

Commit Message

Satheesh Paul Antonysamy March 1, 2024, 3:35 a.m. UTC 
  From: Satheesh Paul <psatheesh@marvell.com>

The subtraction expression in mbox_memcpy() can wrap around
causing an out-of-bounds access. Added a check on 'size' to
fix this.

Coverity issue: 384431, 384439
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Cc: stable@dpdk.org

Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
Reviewed-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/common/cnxk/roc_dev.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Jerin Jacob March 3, 2024, 3:16 p.m. UTC | #1 
On Fri, Mar 1, 2024 at 9:05 AM <psatheesh@marvell.com> wrote:
>
> From: Satheesh Paul <psatheesh@marvell.com>
>
> The subtraction expression in mbox_memcpy() can wrap around
> causing an out-of-bounds access. Added a check on 'size' to
> fix this.
>
> Coverity issue: 384431, 384439
> Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
> Cc: stable@dpdk.org
>
> Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
> Reviewed-by: Harman Kalra <hkalra@marvell.com>


Series applied to dpdk-next-net-mrvl/for-main. Thanks
diff mbox series

Patch

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 084343c3b4..14aff233d5 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -502,6 +502,8 @@  pf_vf_mbox_send_up_msg(struct dev *dev, void *rec_msg)
 	size_t size;
 
 	size = PLT_ALIGN(mbox_id2size(msg->hdr.id), MBOX_MSG_ALIGN);
+	if (size < sizeof(struct mbox_msghdr))
+		return;
 	/* Send UP message to all VF's */
 	for (vf = 0; vf < vf_mbox->ndevs; vf++) {
 		/* VF active */