Additional sanity checks for QNX + CAAM resource manager - #11263
Additional sanity checks for QNX + CAAM resource manager#11263JacobBarthelmeh wants to merge 3 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds defensive validation around untrusted client-provided sizes/flags for CAAM QNX resmgr operations and makes the device node permissions configurable.
Changes:
- Introduces
WOLFSSL_CAAM_QNX_MAX_SZandWOLFSSL_CAAM_QNX_DEV_MODEconfiguration macros. - Adds size sanity checks and safer aggregate-size arithmetic in CMAC and AES paths.
- Tightens read-length validation to avoid partially-initialized buffers being used.
Suppressed comments (1)
wolfcrypt/src/port/caam/caam_qnx.c:428
- When
resmgr_msgreadv()fails (ret < 0), returningEOVERFLOWconflates an I/O error with a short-read/undersized message, and hides the underlying failure mode. Handleret < 0separately (e.g., returnECANCELEDor the appropriate errno from the resmgr layer), and reserveEOVERFLOW(orEBADMSG) for theret < expSzshort-read case.
expSz = msgSz + keySz + (int)sizeof(ctx);
ret = resmgr_msgreadv(ctp, in_iovs, numBuf, idx);
if (ret < 0 || ret < expSz) {
/* sanity check that the read worked and enough data was sent */
if (buf != NULL)
CAAM_ADR_UNMAP(buf, 0, msgSz, 0);
return EOVERFLOW;
}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Can one of the admins verify this patch? |
|
Retest this please Jenkins |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11263
Scan targets checked: wolfcrypt-port-bugs
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11263
Scan targets checked: wolfcrypt-port-bugs
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
|
Retest this please Jenkins, |
|
Retest this please Jenkins. ABI test failed, |
For internal reports f-11224 and f-8236