patch 'common/cnxk: fix mailbox message size underflow' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/fd4d79fafc68131d6b6c48477fd75c42b36ee441

Thanks.

Luca Boccassi

---
>From fd4d79fafc68131d6b6c48477fd75c42b36ee441 Mon Sep 17 00:00:00 2001
From: Harman Kalra <hkalra at marvell.com>
Date: Tue, 1 Sep 2026 15:23:12 +0530
Subject: [PATCH] common/cnxk: fix mailbox message size underflow

[ upstream commit 2f20bc08fcb32946286e0aab96de86d864454115 ]

When the PF forwards a VF mailbox message to the AF, it computes the
message size from an offset supplied by the VF without validating it. A
malicious VF can pick a small offset that wraps the size to a huge value
used as the copy length, so the copy overruns the mailbox region and
crashes the PF. Validate the size before use, as other paths already do.

Bugzilla ID: 2024
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")

Signed-off-by: Harman Kalra <hkalra at marvell.com>
---
 drivers/common/cnxk/roc_dev.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 61aa4b30757..433aca1dd31 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -286,6 +286,17 @@ vf_pf_process_msgs(struct dev *dev, uint16_t vf)
 		msg = (struct mbox_msghdr *)((uintptr_t)mdev->mbase + offset);
 		size = mbox->rx_start + msg->next_msgoff - offset;
 
+		/*
+		 * next_msgoff is VF-controlled. Reject a message whose size is
+		 * smaller than the header or larger than the maximum request so
+		 * an underflowed size cannot be used as the copy length below.
+		 */
+		if (size < sizeof(struct mbox_msghdr) ||
+		    (size - sizeof(struct mbox_msghdr)) > MBOX_MSG_REQ_SIZE_MAX) {
+			plt_err("VF%d: invalid mbox msg size %zu", vf, size);
+			break;
+		}
+
 		/* RVU_PF_FUNC_S */
 		msg->pcifunc = dev_pf_func(dev->pf, vf);
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:57.884681653 +0000
+++ 0107-common-cnxk-fix-mailbox-message-size-underflow.patch	2026-10-27 11:43:53.642063410 +0000
@@ -1 +1 @@
-From 2f20bc08fcb32946286e0aab96de86d864454115 Mon Sep 17 00:00:00 2001
+From fd4d79fafc68131d6b6c48477fd75c42b36ee441 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 2f20bc08fcb32946286e0aab96de86d864454115 ]
+
@@ -14 +15,0 @@
-Cc: stable at dpdk.org
@@ -22 +23 @@
-index 61aa4b3075..433aca1dd3 100644
+index 61aa4b30757..433aca1dd31 100644