[PATCH 05/16] crypto/cnxk: reject truncated TLS records in decrypt

[Tejasree Kondoj]

From: Rupesh Chiluka <rchiluka at marvell.com>

The TLS decrypt tail-fetch path for CBC/3DES READ sessions computed the
tail-fetch source offset as (pkt_len - tail_len) without checking that
pkt_len >= tail_len. For an inbound record shorter than tail_len, the
subtraction underflows when passed as the uint32_t offset to
rte_pktmbuf_read(), which then returns NULL because offset + len
exceeds the packet length. The following rte_memcpy(in_buffer, output,
tail_len) dereferences that NULL pointer.

Reject records with pkt_len < tail_len (return -EINVAL) before computing
the tail-fetch offset in the scatter-gather branches of process_tls_read()
for both cn10k (SGv1 and SGv2) and cn20k.

Signed-off-by: Rupesh Chiluka <rchiluka at marvell.com>
---
 drivers/crypto/cnxk/cn10k_tls_ops.h | 12 ++++++++++++
 drivers/crypto/cnxk/cn20k_tls_ops.h |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/drivers/crypto/cnxk/cn10k_tls_ops.h b/drivers/crypto/cnxk/cn10k_tls_ops.h
index 90600bd850..416207f676 100644
--- a/drivers/crypto/cnxk/cn10k_tls_ops.h
+++ b/drivers/crypto/cnxk/cn10k_tls_ops.h
@@ -260,6 +260,12 @@ process_tls_read(struct rte_crypto_op *cop, struct cn10k_sec_session *sess,
 		uint32_t dlen;
 		int i;
 
+		if (unlikely(pkt_len < tail_len)) {
+			plt_dp_err("Invalid TLS record: pkt_len %d < tail_len %d", pkt_len,
+				   tail_len);
+			return -EINVAL;
+		}
+
 		if (unlikely(m_src->nb_segs > ROC_SG1_MAX_PTRS)) {
 			plt_dp_err("Exceeds max supported components. Reduce segments");
 			return -1;
@@ -320,6 +326,12 @@ process_tls_read(struct rte_crypto_op *cop, struct cn10k_sec_session *sess,
 		uint32_t g_size_bytes;
 		int i;
 
+		if (unlikely(pkt_len < tail_len)) {
+			plt_dp_err("Invalid TLS record: pkt_len %d < tail_len %d", pkt_len,
+				   tail_len);
+			return -EINVAL;
+		}
+
 		if (unlikely(m_src->nb_segs > ROC_SG2_MAX_PTRS)) {
 			plt_dp_err("Exceeds max supported components. Reduce segments");
 			return -1;
diff --git a/drivers/crypto/cnxk/cn20k_tls_ops.h b/drivers/crypto/cnxk/cn20k_tls_ops.h
index e7a8ba34ae..670acbe9ab 100644
--- a/drivers/crypto/cnxk/cn20k_tls_ops.h
+++ b/drivers/crypto/cnxk/cn20k_tls_ops.h
@@ -203,6 +203,12 @@ process_tls_read(struct rte_crypto_op *cop, struct cn20k_sec_session *sess,
 		uint32_t g_size_bytes;
 		int i;
 
+		if (unlikely(pkt_len < tail_len)) {
+			plt_dp_err("Invalid TLS record: pkt_len %d < tail_len %d", pkt_len,
+				   tail_len);
+			return -EINVAL;
+		}
+
 		if (unlikely(m_src->nb_segs > ROC_SG2_MAX_PTRS)) {
 			plt_dp_err("Exceeds max supported components. Reduce segments");
 			return -1;
-- 
2.43.0