patch 'common/cnxk: add cipher key length check in key set' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/2a7862d8896b49f8ba070bf2a78451fc952bee08

Thanks.

Kevin

---
>From 2a7862d8896b49f8ba070bf2a78451fc952bee08 Mon Sep 17 00:00:00 2001
From: Aarnav JP <ajp at marvell.com>
Date: Mon, 15 Jun 2026 21:54:41 +0530
Subject: [PATCH] common/cnxk: add cipher key length check in key set

[ upstream commit eae52a8652b7fcdf8f6180dd61f0b3175b28215c ]

Add upper-bound checks before memcpy into encr_key[32]
in roc_se_ciph_key_set() to prevent buffer overflow into
adjacent encr_iv[16]. Covers all write paths including
AES-DOCSISBPI and DES-DOCSISBPI branches that bypass
the generic copy via goto.

Fixes: 5e076b609f2a ("common/cnxk: add SE set key for crypto")

Signed-off-by: Aarnav JP <ajp at marvell.com>
---
 drivers/common/cnxk/roc_se.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/common/cnxk/roc_se.c b/drivers/common/cnxk/roc_se.c
index f71832ff3a..4c9210e522 100644
--- a/drivers/common/cnxk/roc_se.c
+++ b/drivers/common/cnxk/roc_se.c
@@ -519,4 +519,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
 		 * se_ctx as AES_DOCSISBPI to skip block size checks in instruction preparation.
 		 */
+		if (key_len > sizeof(fctx->enc.encr_key)) {
+			plt_err("Cipher key length %u exceeds max %zu", key_len,
+				sizeof(fctx->enc.encr_key));
+			return -1;
+		}
 		cpt_ciph_aes_key_type_set(fctx, key_len);
 		fctx->enc.enc_cipher = ROC_SE_AES_CBC;
@@ -525,4 +530,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
 	case ROC_SE_DES_DOCSISBPI:
 		/* See case ROC_SE_DES3_CBC: for explanation */
+		if (key_len * 3 > sizeof(fctx->enc.encr_key)) {
+			plt_err("DES-DOCSISBPI key length %u exceeds max %zu", key_len,
+				sizeof(fctx->enc.encr_key) / 3);
+			return -1;
+		}
 		for (i = 0; i < 3; i++)
 			memcpy(fctx->enc.encr_key + key_len * i, key, key_len);
@@ -589,4 +599,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
 		fctx->enc.enc_cipher = type;
 
+	if (key_len > sizeof(fctx->enc.encr_key)) {
+		plt_err("Cipher key length %u exceeds max %zu", key_len,
+			sizeof(fctx->enc.encr_key));
+		return -1;
+	}
 	memcpy(fctx->enc.encr_key, key, key_len);
 
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:52.518685799 +0100
+++ 0059-common-cnxk-add-cipher-key-length-check-in-key-set.patch	2026-07-28 16:54:50.808728813 +0100
@@ -1 +1 @@
-From eae52a8652b7fcdf8f6180dd61f0b3175b28215c Mon Sep 17 00:00:00 2001
+From 2a7862d8896b49f8ba070bf2a78451fc952bee08 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit eae52a8652b7fcdf8f6180dd61f0b3175b28215c ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index d841a926a4..1cec536169 100644
+index f71832ff3a..4c9210e522 100644
@@ -24 +25 @@
-@@ -546,4 +546,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
+@@ -519,4 +519,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
@@ -34 +35 @@
-@@ -552,4 +557,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
+@@ -525,4 +530,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
@@ -44 +45 @@
-@@ -629,4 +639,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui
+@@ -589,4 +599,9 @@ roc_se_ciph_key_set(struct roc_se_ctx *se_ctx, roc_se_cipher_type type, const ui