From: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
To: <dev@dpdk.org>, Nithin Dabilpuram <ndabilpuram@marvell.com>,
Kiran Kumar K <kirankumark@marvell.com>,
Sunil Kumar Kori <skori@marvell.com>,
Satha Rao <skoteshwar@marvell.com>,
Ankur Dwivedi <adwivedi@marvell.com>,
Anoob Joseph <anoobj@marvell.com>,
Tejasree Kondoj <ktejasree@marvell.com>
Cc: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>, <stable@dpdk.org>
Subject: [PATCH] crypto/cnxk: fix coverity issues
Date: Sat, 15 Jun 2024 17:03:01 +0530 [thread overview]
Message-ID: <20240615113304.2197-1-gmuthukrishn@marvell.com> (raw)
Fix out-of-bound issues reported by coverity scan.
Coverity issue: 403164, 403165, 403166, 403167, 403169, 403170, 403171,
403172, 403173, 403174, 403176, 403178, 403179, 403180
Fixes: 5686b573e4b ("crypto/cnxk: support SM2")
Fixes: badc0c6f6d6 ("cryptodev: set private and public keys in EC session")
Cc: stable@dpdk.org
Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
---
drivers/common/cnxk/roc_ae.h | 16 +++++++++-------
drivers/crypto/cnxk/cnxk_ae.h | 24 +++++++++++++++++++-----
2 files changed, 28 insertions(+), 12 deletions(-)
diff --git a/drivers/common/cnxk/roc_ae.h b/drivers/common/cnxk/roc_ae.h
index a9a08d9fb9..7886b9d107 100644
--- a/drivers/common/cnxk/roc_ae.h
+++ b/drivers/common/cnxk/roc_ae.h
@@ -53,29 +53,31 @@ typedef enum {
ROC_AE_ERR_ECC_POINT_NOT_ON_CURVE = 0x11
} roc_ae_error_code;
+#define ROC_AE_EC_DATA_MAX 66
+
/* Prime and order fields of built-in elliptic curves */
struct roc_ae_ec_group {
struct {
/* P521 maximum length */
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} prime;
struct {
/* P521 maximum length */
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} order;
struct {
/* P521 maximum length */
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} consta;
struct {
/* P521 maximum length */
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} constb;
};
@@ -86,18 +88,18 @@ struct roc_ae_ec_ctx {
/* Private key */
struct {
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} pkey;
/* Public key */
struct {
struct {
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} x;
struct {
- uint8_t data[66];
+ uint8_t data[ROC_AE_EC_DATA_MAX];
unsigned int length;
} y;
} q;
diff --git a/drivers/crypto/cnxk/cnxk_ae.h b/drivers/crypto/cnxk/cnxk_ae.h
index ea11e093bf..a843d6b5ef 100644
--- a/drivers/crypto/cnxk/cnxk_ae.h
+++ b/drivers/crypto/cnxk/cnxk_ae.h
@@ -205,16 +205,22 @@ cnxk_ae_fill_ec_params(struct cnxk_ae_sess *sess,
return 0;
ec->pkey.length = xform->ec.pkey.length;
- if (xform->ec.pkey.length)
- rte_memcpy(ec->pkey.data, xform->ec.pkey.data, xform->ec.pkey.length);
+ if (ec->pkey.length > ROC_AE_EC_DATA_MAX)
+ ec->pkey.length = ROC_AE_EC_DATA_MAX;
+ if (ec->pkey.length)
+ rte_memcpy(ec->pkey.data, xform->ec.pkey.data, ec->pkey.length);
ec->q.x.length = xform->ec.q.x.length;
- if (xform->ec.q.x.length)
- rte_memcpy(ec->q.x.data, xform->ec.q.x.data, xform->ec.q.x.length);
+ if (ec->q.x.length > ROC_AE_EC_DATA_MAX)
+ ec->q.x.length = ROC_AE_EC_DATA_MAX;
+ if (ec->q.x.length)
+ rte_memcpy(ec->q.x.data, xform->ec.q.x.data, ec->q.x.length);
ec->q.y.length = xform->ec.q.y.length;
+ if (ec->q.y.length > ROC_AE_EC_DATA_MAX)
+ ec->q.y.length = ROC_AE_EC_DATA_MAX;
if (xform->ec.q.y.length)
- rte_memcpy(ec->q.y.data, xform->ec.q.y.data, xform->ec.q.y.length);
+ rte_memcpy(ec->q.y.data, xform->ec.q.y.data, ec->q.y.length);
return 0;
}
@@ -735,7 +741,11 @@ cnxk_ae_sm2_sign_prep(struct rte_crypto_sm2_op_param *sm2,
uint8_t *dptr;
prime_len = ec_grp->prime.length;
+ if (prime_len > ROC_AE_EC_DATA_MAX)
+ prime_len = ROC_AE_EC_DATA_MAX;
order_len = ec_grp->order.length;
+ if (order_len > ROC_AE_EC_DATA_MAX)
+ order_len = ROC_AE_EC_DATA_MAX;
/* Truncate input length to curve prime length */
if (message_len > prime_len)
@@ -822,7 +832,11 @@ cnxk_ae_sm2_verify_prep(struct rte_crypto_sm2_op_param *sm2,
uint8_t *dptr;
prime_len = ec_grp->prime.length;
+ if (prime_len > ROC_AE_EC_DATA_MAX)
+ prime_len = ROC_AE_EC_DATA_MAX;
order_len = ec_grp->order.length;
+ if (order_len > ROC_AE_EC_DATA_MAX)
+ order_len = ROC_AE_EC_DATA_MAX;
/* Truncate input length to curve prime length */
if (message_len > prime_len)
--
2.25.1
next reply other threads:[~2024-06-15 11:33 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-15 11:33 Gowrishankar Muthukrishnan [this message]
2024-06-26 7:46 ` [EXTERNAL] " Akhil Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240615113304.2197-1-gmuthukrishn@marvell.com \
--to=gmuthukrishn@marvell.com \
--cc=adwivedi@marvell.com \
--cc=anoobj@marvell.com \
--cc=dev@dpdk.org \
--cc=kirankumark@marvell.com \
--cc=ktejasree@marvell.com \
--cc=ndabilpuram@marvell.com \
--cc=skori@marvell.com \
--cc=skoteshwar@marvell.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).