[PATCH 09/16] crypto/cnxk: guard trim len bounds in TLS 1.2 MAC trim

[Tejasree Kondoj]

From: Rupesh Chiluka <rchiluka at marvell.com>

In cn10k_cpt_tls12_trim_mac() the padding length is derived from the
decrypted record. trim_len was used to compute mac_offset/pad_offset
without checking it against the record length, causing out-of-bounds
reads and corrupted mbuf lengths in both direct and SG modes.

Reject records where trim_len exceeds the record length.

Signed-off-by: Rupesh Chiluka <rchiluka at marvell.com>
---
 drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
index bf273774fd..30ef0d14c2 100644
--- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
@@ -942,6 +942,13 @@ cn10k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn10k_res_s *res,
 	pad_val = ((res->spi >> 16) & 0xff);
 	pad_len = pad_val + 1;
 	trim_len = pad_len + mac_len;
+
+	if (trim_len > m_len) {
+		cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+		cop->aux_flags = res->uc_compcode;
+		return;
+	}
+
 	mac_offset = m_len - trim_len;
 	pad_offset = mac_offset + mac_len;
 
-- 
2.43.0