From patchwork Wed Jul 20 01:28:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "humin (Q)" X-Patchwork-Id: 114058 X-Patchwork-Delegate: andrew.rybchenko@oktetlabs.ru Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BEA65A0032; Wed, 20 Jul 2022 03:29:03 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 1F01D41147; Wed, 20 Jul 2022 03:29:03 +0200 (CEST) Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by mails.dpdk.org (Postfix) with ESMTP id 43BF340697; Wed, 20 Jul 2022 03:29:01 +0200 (CEST) Received: from kwepemi500012.china.huawei.com (unknown [172.30.72.57]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4LndP92tcZzFqL0; Wed, 20 Jul 2022 09:27:57 +0800 (CST) Received: from kwepemi500012.china.huawei.com (7.221.188.12) by kwepemi500012.china.huawei.com (7.221.188.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 20 Jul 2022 09:28:59 +0800 Received: from kwepemi500012.china.huawei.com ([7.221.188.12]) by kwepemi500012.china.huawei.com ([7.221.188.12]) with mapi id 15.01.2375.024; Wed, 20 Jul 2022 09:28:59 +0800 From: "humin (Q)" To: wangyunjian , "dev@dpdk.org" CC: "chas3@att.com" , Huangshaozhang , "jilei (F)" , "stable@dpdk.org" Subject: =?eucgb2312_cn?b?tPC4tDogW2RwZGstZGV2XSBbUEFUQ0hdIG5ldC9ib25kaW5nOiBmaXgg?= =?eucgb2312_cn?b?YXJyYXkgb3ZlcmZsb3cgaW4gUnggYnVyc3Q=?= Thread-Topic: [dpdk-dev] [PATCH] net/bonding: fix array overflow in Rx burst Thread-Index: AQHYmqeDTAgsz+azdk+mjaelaDT9u62GeoEg Date: Wed, 20 Jul 2022 01:28:59 +0000 Message-ID: <5001c75008d9423c885747b51cb1ad55@huawei.com> References: <20210810064323.4161835-1-jilei8@huawei.com> <23483205275b4639324b82c1607cd867327bf783.1658146483.git.wangyunjian@huawei.com> In-Reply-To: <23483205275b4639324b82c1607cd867327bf783.1658146483.git.wangyunjian@huawei.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.78.23.197] MIME-Version: 1.0 X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Acked-by: Min Hu (Connor) -----邮件原件----- 发件人: wangyunjian 发送时间: 2022年7月18日 21:09 收件人: dev@dpdk.org 抄送: chas3@att.com; humin (Q) ; Huangshaozhang ; jilei (F) ; wangyunjian ; stable@dpdk.org 主题: [dpdk-dev] [PATCH] net/bonding: fix array overflow in Rx burst In bond_ethdev_rx_burst() function, we check the validity of the 'active_slave' as this code: if (++active_slave == slave_count) active_slave = 0; However, the value of 'active_slave' maybe equal to 'slave_count', when a slave is down. This is wrong and it can cause buffer overflow. This patch fixes the issue by using '>=' instead of '=='. Fixes: e1110e977648 ("net/bonding: fix Rx slave fairness") Cc: stable@dpdk.org Signed-off-by: Lei Ji Signed-off-by: Yunjian Wang --- drivers/net/bonding/rte_eth_bond_pmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.27.0 diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c index 73e6972035..6f8a6da108 100644 --- a/drivers/net/bonding/rte_eth_bond_pmd.c +++ b/drivers/net/bonding/rte_eth_bond_pmd.c @@ -82,7 +82,7 @@ bond_ethdev_rx_burst(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) bufs + num_rx_total, nb_pkts); num_rx_total += num_rx_slave; nb_pkts -= num_rx_slave; - if (++active_slave == slave_count) + if (++active_slave >= slave_count) active_slave = 0; }