[PATCH 12/16] crypto/cnxk: validate TLS 1.2 MAC trim lengths

[Tejasree Kondoj]

From: Rupesh Chiluka <rchiluka at marvell.com>

In cn10k_cpt_tls12_trim_mac() and cn20k_cpt_tls12_trim_mac(), the pad
length comes from the decrypted record and the record length from
hardware. Neither was fully validated against the mbuf. Padding larger
than the record made the MAC and pad offsets underflow. That caused
out-of-bounds reads in direct mode and a walk past the end of the
segment chain in SG mode.

Fail the op with an error and skip trimming when trim_len exceeds the
record length, or when the record length exceedds pkt_len.

Signed-off-by: Rupesh Chiluka <rchiluka at marvell.com>
---
 drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 2 +-
 drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
index 30ef0d14c2..365e3a8535 100644
--- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
@@ -943,7 +943,7 @@ cn10k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn10k_res_s *res,
 	pad_len = pad_val + 1;
 	trim_len = pad_len + mac_len;
 
-	if (trim_len > m_len) {
+	if (trim_len > m_len || m_len > mbuf->pkt_len) {
 		cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
 		cop->aux_flags = res->uc_compcode;
 		return;
diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
index f91e56f3ed..bb3384023f 100644
--- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
@@ -705,7 +705,7 @@ cn20k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn20k_res_s *res,
 	pad_len = pad_val + 1;
 	trim_len = pad_len + mac_len;
 
-	if (trim_len > m_len) {
+	if (trim_len > m_len || m_len > mbuf->pkt_len) {
 		cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
 		cop->aux_flags = res->uc_compcode;
 		return;
-- 
2.43.0