[PATCH 04/16] common/cnxk: validate cipher key length in IPsec SA fill

[Tejasree Kondoj]

From: Rupesh Chiluka <rchiluka at marvell.com>

The IPsec SA builders copy the cipher key into the fixed 32-byte
SA context field via memcpy. The per-algorithm length validation
only runs for AES/DES/3DES and AES-GMAC, so a NULL-cipher SA with
a non-zero, oversized key.length skips every check.

Reject any key longer than the SA cipher key field with -EINVAL.

Signed-off-by: Rupesh Chiluka <rchiluka at marvell.com>
---
 drivers/common/cnxk/cnxk_security.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c
index 228ff2781d..9f734c16b1 100644
--- a/drivers/common/cnxk/cnxk_security.c
+++ b/drivers/common/cnxk/cnxk_security.c
@@ -170,6 +170,10 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2, uint8_t *cipher_k
 	w2->s.spi = ipsec_xfrm->spi;
 
 	if (key != NULL && length != 0) {
+		if (length > ROC_CTX_MAX_CKEY_LEN) {
+			plt_err("Invalid cipher key length");
+			return -EINVAL;
+		}
 		/* Validate key length and set AES key len before copy to avoid overflow */
 		if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC ||
 		    w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR ||
@@ -1012,8 +1016,13 @@ on_fill_ipsec_common_sa(struct rte_security_ipsec_xform *ipsec,
 		}
 	}
 
-	if (cipher_key_len != 0)
+	if (cipher_key_len != 0) {
+		if (cipher_key_len > (int)sizeof(common_sa->cipher_key)) {
+			plt_err("Invalid cipher key length");
+			return -EINVAL;
+		}
 		memcpy(common_sa->cipher_key, cipher_key, cipher_key_len);
+	}
 
 	return 0;
 }
@@ -1403,6 +1412,10 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k
 	w2->s.spi = ipsec_xfrm->spi;
 
 	if (key != NULL && length != 0) {
+		if (length > ROC_CTX_MAX_CKEY_LEN) {
+			plt_err("Invalid cipher key length");
+			return -EINVAL;
+		}
 		/* Validate key length and set AES key len before copy to avoid overflow */
 		if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC ||
 		    w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR ||
-- 
2.43.0