mana_hwc_init_event_handler() in hw_channel.c stores device-advertised HWC_INIT_DATA_MAX_REQUEST and HWC_INIT_DATA_MAX_RESPONSE values without bounds checking. mana_hwc_alloc_dma_buf() later computes the DMA buffer size as MANA_PAGE_ALIGN(q_depth * max_msg_size) in 32-bit arithmetic. A malicious device returning a large max_msg_size causes the product to wrap, allocating a small buffer while laying out q_depth request slots at the unwrapped stride, placing slots outside the allocation. Impact: a compromised hypervisor device model or malicious MANA PCI device can cause out-of-bounds DMA buffer writes during HWC channel initialization. A reproducer is available on request. Clamp both values to HW_CHANNEL_MAX_REQUEST_SIZE (4096), consistent with the cap already applied at the channel-create callsite. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- drivers/net/ethernet/microsoft/mana/hw_channel.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c index 48a9acea4ab6c..a0916b50cffce 100644 --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c @@ -152,10 +152,14 @@ static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self, break; case HWC_INIT_DATA_MAX_REQUEST: + if (val == 0 || val > HW_CHANNEL_MAX_REQUEST_SIZE) + val = HW_CHANNEL_MAX_REQUEST_SIZE; hwc->hwc_init_max_req_msg_size = val; break; case HWC_INIT_DATA_MAX_RESPONSE: + if (val == 0 || val > HW_CHANNEL_MAX_REQUEST_SIZE) + val = HW_CHANNEL_MAX_REQUEST_SIZE; hwc->hwc_init_max_resp_msg_size = val; break; -- 2.53.0