When the PF forwards a VF mailbox message to the AF, it computes the
message size from an offset supplied by the VF without validating it. A
malicious VF can pick a small offset that wraps the size to a huge value
used as the copy length, so the copy overruns the mailbox region and
crashes the PF. Validate the size before use, as other paths already do.
Bugzilla ID: 2024
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Cc: [email protected]
Signed-off-by: Harman Kalra <[email protected]>
---
drivers/common/cnxk/roc_dev.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 61aa4b3075..433aca1dd3 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -286,6 +286,17 @@ vf_pf_process_msgs(struct dev *dev, uint16_t vf)
msg = (struct mbox_msghdr *)((uintptr_t)mdev->mbase + offset);
size = mbox->rx_start + msg->next_msgoff - offset;
+ /*
+ * next_msgoff is VF-controlled. Reject a message whose size is
+ * smaller than the header or larger than the maximum request so
+ * an underflowed size cannot be used as the copy length below.
+ */
+ if (size < sizeof(struct mbox_msghdr) ||
+ (size - sizeof(struct mbox_msghdr)) >
MBOX_MSG_REQ_SIZE_MAX) {
+ plt_err("VF%d: invalid mbox msg size %zu", vf, size);
+ break;
+ }
+
/* RVU_PF_FUNC_S */
msg->pcifunc = dev_pf_func(dev->pf, vf);
--
2.43.0
