patch 'common/cnxk: fix cipher key length validation' has been queued to stable release 25.11.1
Kevin Traynor
ktraynor at redhat.com
Fri Mar 27 11:01:17 CET 2026
Hi,
FYI, your patch has been queued to stable release 25.11.1
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/31/26. So please
shout if anyone has objections.
Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.
Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable
This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/5fb5f03868544cfc4d4339e90c626ec524d44216
Thanks.
Kevin
---
>From 5fb5f03868544cfc4d4339e90c626ec524d44216 Mon Sep 17 00:00:00 2001
From: Tejasree Kondoj <ktejasree at marvell.com>
Date: Thu, 19 Mar 2026 15:14:34 +0530
Subject: [PATCH] common/cnxk: fix cipher key length validation
[ upstream commit fda5740324f5d3c77d9d6e35e1b6fcd9a72b9bd2 ]
Validate DES/3DES and AES key lengths before copying
into SA cipher_key[] to avoid out-of-bounds write
into adjacent IV/salt fields.
Fixes: 24d10645bdfb ("common/cnxk: support CN20K IPsec session")
Signed-off-by: Tejasree Kondoj <ktejasree at marvell.com>
---
drivers/common/cnxk/cnxk_security.c | 127 ++++++++++++++++------------
drivers/common/cnxk/roc_cpt.h | 1 +
2 files changed, 76 insertions(+), 52 deletions(-)
diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c
index 600098ae1c..6b51055100 100644
--- a/drivers/common/cnxk/cnxk_security.c
+++ b/drivers/common/cnxk/cnxk_security.c
@@ -171,4 +171,33 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2, uint8_t *cipher_k
if (key != NULL && length != 0) {
+ /* Validate key length and set AES key len before copy to avoid overflow */
+ if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
+ w2->s.auth_type == ROC_IE_SA_AUTH_AES_GMAC) {
+ switch (length) {
+ case ROC_CPT_AES128_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
+ break;
+ case ROC_CPT_AES192_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
+ break;
+ case ROC_CPT_AES256_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
+ break;
+ default:
+ plt_err("Invalid AES key length");
+ return -EINVAL;
+ }
+ }
+ if (w2->s.enc_type == ROC_IE_SA_ENC_DES_CBC && length != ROC_CPT_DES_KEY_LEN) {
+ plt_err("Invalid DES key length");
+ return -EINVAL;
+ }
+ if (w2->s.enc_type == ROC_IE_SA_ENC_3DES_CBC && length != ROC_CPT_DES3_KEY_LEN) {
+ plt_err("Invalid 3DES key length");
+ return -EINVAL;
+ }
/* Copy encryption key */
memcpy(cipher_key, key, length);
@@ -178,28 +207,5 @@ ot_ipsec_sa_common_param_fill(union roc_ot_ipsec_sa_word2 *w2, uint8_t *cipher_k
}
- /* Set AES key length */
- if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC ||
- w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR ||
- w2->s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
- w2->s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
- w2->s.auth_type == ROC_IE_SA_AUTH_AES_GMAC) {
- switch (length) {
- case ROC_CPT_AES128_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
- break;
- case ROC_CPT_AES192_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
- break;
- case ROC_CPT_AES256_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
- break;
- default:
- plt_err("Invalid AES key length");
- return -EINVAL;
- }
- }
-
- if (ipsec_xfrm->life.packets_soft_limit != 0 ||
- ipsec_xfrm->life.packets_hard_limit != 0) {
+ if (ipsec_xfrm->life.packets_soft_limit != 0 || ipsec_xfrm->life.packets_hard_limit != 0) {
if (ipsec_xfrm->life.bytes_soft_limit != 0 ||
ipsec_xfrm->life.bytes_hard_limit != 0) {
@@ -845,7 +851,9 @@ on_ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
case RTE_CRYPTO_CIPHER_DES_CBC:
ctl->enc_type = ROC_IE_SA_ENC_DES_CBC;
+ aes_key_len = cipher_xform->cipher.key.length;
break;
case RTE_CRYPTO_CIPHER_3DES_CBC:
ctl->enc_type = ROC_IE_SA_ENC_3DES_CBC;
+ aes_key_len = cipher_xform->cipher.key.length;
break;
case RTE_CRYPTO_CIPHER_AES_CBC:
@@ -898,18 +906,16 @@ on_ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
}
- /* Set AES key length */
- if (ctl->enc_type == ROC_IE_SA_ENC_AES_CBC ||
- ctl->enc_type == ROC_IE_SA_ENC_AES_CTR ||
- ctl->enc_type == ROC_IE_SA_ENC_AES_GCM ||
- ctl->enc_type == ROC_IE_SA_ENC_AES_CCM ||
+ /* Validate and set AES key length before copy */
+ if (ctl->enc_type == ROC_IE_SA_ENC_AES_CBC || ctl->enc_type == ROC_IE_SA_ENC_AES_CTR ||
+ ctl->enc_type == ROC_IE_SA_ENC_AES_GCM || ctl->enc_type == ROC_IE_SA_ENC_AES_CCM ||
ctl->auth_type == ROC_IE_SA_AUTH_AES_GMAC) {
switch (aes_key_len) {
- case 16:
+ case ROC_CPT_AES128_KEY_LEN:
ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
break;
- case 24:
+ case ROC_CPT_AES192_KEY_LEN:
ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
break;
- case 32:
+ case ROC_CPT_AES256_KEY_LEN:
ctl->aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
break;
@@ -919,4 +925,12 @@ on_ipsec_sa_ctl_set(struct rte_security_ipsec_xform *ipsec,
}
}
+ if (ctl->enc_type == ROC_IE_SA_ENC_DES_CBC && aes_key_len != ROC_CPT_DES_KEY_LEN) {
+ plt_err("Invalid DES key length");
+ return -EINVAL;
+ }
+ if (ctl->enc_type == ROC_IE_SA_ENC_3DES_CBC && aes_key_len != ROC_CPT_DES3_KEY_LEN) {
+ plt_err("Invalid 3DES key length");
+ return -EINVAL;
+ }
if (ipsec->options.esn)
@@ -1365,4 +1379,33 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k
if (key != NULL && length != 0) {
+ /* Validate key length and set AES key len before copy to avoid overflow */
+ if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
+ w2->s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
+ w2->s.auth_type == ROC_IE_SA_AUTH_AES_GMAC) {
+ switch (length) {
+ case ROC_CPT_AES128_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
+ break;
+ case ROC_CPT_AES192_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
+ break;
+ case ROC_CPT_AES256_KEY_LEN:
+ w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
+ break;
+ default:
+ plt_err("Invalid AES key length");
+ return -EINVAL;
+ }
+ }
+ if (w2->s.enc_type == ROC_IE_SA_ENC_DES_CBC && length != ROC_CPT_DES_KEY_LEN) {
+ plt_err("Invalid DES key length");
+ return -EINVAL;
+ }
+ if (w2->s.enc_type == ROC_IE_SA_ENC_3DES_CBC && length != ROC_CPT_DES3_KEY_LEN) {
+ plt_err("Invalid 3DES key length");
+ return -EINVAL;
+ }
/* Copy encryption key */
memcpy(cipher_key, key, length);
@@ -1372,24 +1415,4 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k
}
- /* Set AES key length */
- if (w2->s.enc_type == ROC_IE_SA_ENC_AES_CBC || w2->s.enc_type == ROC_IE_SA_ENC_AES_CCM ||
- w2->s.enc_type == ROC_IE_SA_ENC_AES_CTR || w2->s.enc_type == ROC_IE_SA_ENC_AES_GCM ||
- w2->s.enc_type == ROC_IE_SA_ENC_AES_CCM || w2->s.auth_type == ROC_IE_SA_AUTH_AES_GMAC) {
- switch (length) {
- case ROC_CPT_AES128_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_128;
- break;
- case ROC_CPT_AES192_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_192;
- break;
- case ROC_CPT_AES256_KEY_LEN:
- w2->s.aes_key_len = ROC_IE_SA_AES_KEY_LEN_256;
- break;
- default:
- plt_err("Invalid AES key length");
- return -EINVAL;
- }
- }
-
if (ipsec_xfrm->life.packets_soft_limit != 0 || ipsec_xfrm->life.packets_hard_limit != 0) {
if (ipsec_xfrm->life.bytes_soft_limit != 0 ||
diff --git a/drivers/common/cnxk/roc_cpt.h b/drivers/common/cnxk/roc_cpt.h
index 7547d0b020..537a50f85f 100644
--- a/drivers/common/cnxk/roc_cpt.h
+++ b/drivers/common/cnxk/roc_cpt.h
@@ -80,4 +80,5 @@
#define ROC_CPT_DES_IV_LEN 8
+#define ROC_CPT_DES_KEY_LEN 8
#define ROC_CPT_DES3_KEY_LEN 24
#define ROC_CPT_AES128_KEY_LEN 16
--
2.53.0
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2026-03-27 09:58:26.662738235 +0000
+++ 0017-common-cnxk-fix-cipher-key-length-validation.patch 2026-03-27 09:58:26.146377296 +0000
@@ -1 +1 @@
-From fda5740324f5d3c77d9d6e35e1b6fcd9a72b9bd2 Mon Sep 17 00:00:00 2001
+From 5fb5f03868544cfc4d4339e90c626ec524d44216 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit fda5740324f5d3c77d9d6e35e1b6fcd9a72b9bd2 ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -195 +196 @@
-index 4715359f49..533d194bd4 100644
+index 7547d0b020..537a50f85f 100644
More information about the stable
mailing list