CCP cipher keys overflow

https://bugs.dpdk.org/show_bug.cgi?id=1993

Bug ID: 1993
Summary: CCP cipher keys overflow
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: cryptodev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Group: security

Report date: 2026-03-11
Reported by: pengpeng <[email protected]>

Hello DPDK maintainers,

I would like to report what appears to be a real current-head overflow in the ccp crypto PMD. I rechecked current upstream head on 2026-03-10 before writing this report.

The core problem is in ccp_configure_session_cipher():

```c
sess->cipher.key_length = cipher_xform->key.length;
rte_memcpy(sess->cipher.key, cipher_xform->key.data,
           cipher_xform->key.length);
...
if (sess->cipher.key_length == 16) ...
else if (sess->cipher.key_length == 24) ...
else if (sess->cipher.key_length == 32) ...
else
    return -1;
```

The destination layout in struct ccp_session is:

```c
uint64_t key_length;
uint8_t  key[32];
uint8_t  key_ccp[32];
phys_addr_t key_phys;
uint8_t  nonce[32];
```

So a 40-byte key already overwrites the adjacent key_ccp member before the function reports that the length is invalid.

Why I do not think this is refuted by current-head invariants:

- the generic session setup paths still reach ccp_set_session_parameters() and then ccp_configure_session_cipher()
- the function itself performs the copy before its algorithm-specific accepted-length checks
- this is not a tail-allocation pattern; it is a fixed in-object array followed by a live adjacent member
- the issue is not just "unsupported input"; the memory corruption happens before the -1 return

I am keeping the claim narrow: this is a PMD session-configuration bug, and the cleanest reproducer is an oversized AES key such as 40 bytes.

The fix seems straightforward:

1. validate the supported key length before the rte_memcpy()
2. add a hard upper bound such as if (cipher_xform->key.length > sizeof(sess->cipher.key)) return -1;

You are receiving this mail because:
You are the assignee for the bug.