roc_nix_max_rep_count() copied rsp->rep_cnt entries from the get_rep_cnt
mailbox response into the fixed 64-entry roc_nix->rep_pfvf_map[] without
validating the AF-supplied count. rep_cnt is a uint16_t, so a malformed
or malicious AF response could overrun the array (and read past the
response's 64-entry map), corrupting adjacent driver state.
Reject responses with rep_cnt greater than MAX_PFVF_REP before copying.
Fixes: 162c77c18838 ("common/cnxk: add support for representors")
Cc: [email protected]
Signed-off-by: Aarnav JP <[email protected]>
---
drivers/common/cnxk/roc_nix.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/common/cnxk/roc_nix.c b/drivers/common/cnxk/roc_nix.c
index 8e3903051d..ae6a918682 100644
--- a/drivers/common/cnxk/roc_nix.c
+++ b/drivers/common/cnxk/roc_nix.c
@@ -589,6 +589,12 @@ roc_nix_max_rep_count(struct roc_nix *roc_nix)
if (rc)
goto exit;
+ if (rsp->rep_cnt > MAX_PFVF_REP) {
+ plt_err("Invalid rep_cnt %u in get_rep_cnt rsp", rsp->rep_cnt);
+ rc = -EIO;
+ goto exit;
+ }
+
roc_nix->rep_cnt = rsp->rep_cnt;
for (i = 0; i < rsp->rep_cnt; i++)
roc_nix->rep_pfvf_map[i] = rsp->rep_pfvf_map[i];
--
2.43.0
