[PATCH 5/5] common/cnxk: fix OOB write in rep count copy

[Aarnav JP]

roc_nix_max_rep_count() copied rsp->rep_cnt entries from the get_rep_cnt
mailbox response into the fixed 64-entry roc_nix->rep_pfvf_map[] without
validating the AF-supplied count. rep_cnt is a uint16_t, so a malformed
or malicious AF response could overrun the array (and read past the
response's 64-entry map), corrupting adjacent driver state.

Reject responses with rep_cnt greater than MAX_PFVF_REP before copying.

Fixes: 162c77c18838 ("common/cnxk: add support for representors")
Cc: stable at dpdk.org

Signed-off-by: Aarnav JP <ajp at marvell.com>
---
 drivers/common/cnxk/roc_nix.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/common/cnxk/roc_nix.c b/drivers/common/cnxk/roc_nix.c
index 8e3903051d..ae6a918682 100644
--- a/drivers/common/cnxk/roc_nix.c
+++ b/drivers/common/cnxk/roc_nix.c
@@ -589,6 +589,12 @@ roc_nix_max_rep_count(struct roc_nix *roc_nix)
 	if (rc)
 		goto exit;
 
+	if (rsp->rep_cnt > MAX_PFVF_REP) {
+		plt_err("Invalid rep_cnt %u in get_rep_cnt rsp", rsp->rep_cnt);
+		rc = -EIO;
+		goto exit;
+	}
+
 	roc_nix->rep_cnt = rsp->rep_cnt;
 	for (i = 0; i < rsp->rep_cnt; i++)
 		roc_nix->rep_pfvf_map[i] = rsp->rep_pfvf_map[i];
-- 
2.43.0