From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by dpdk.org (Postfix) with ESMTP id 752AC1B536; Thu, 21 Mar 2019 21:28:24 +0100 (CET) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A4ED43092650; Thu, 21 Mar 2019 20:28:23 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-204-129.brq.redhat.com [10.40.204.129]) by smtp.corp.redhat.com (Postfix) with ESMTP id 32D754B3; Thu, 21 Mar 2019 20:28:22 +0000 (UTC) From: David Marchand To: dev@dpdk.org Cc: ferruh.yigit@intel.com, chas3@att.com, zhaohui8@huawei.com, stable@dpdk.org Date: Thu, 21 Mar 2019 21:28:14 +0100 Message-Id: <1553200094-5487-2-git-send-email-david.marchand@redhat.com> In-Reply-To: <1553200094-5487-1-git-send-email-david.marchand@redhat.com> References: <1553200094-5487-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.43]); Thu, 21 Mar 2019 20:28:23 +0000 (UTC) Subject: [dpdk-dev] [PATCH 2/2] net/bonding: fix oob access in "other" aggregator modes X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 20:28:24 -0000 From: Zhaohui slave aggregator_port_id is in [0, RTE_MAX_ETHPORTS-1] range. If RTE_MAX_ETHPORTS is > 8, we can hit out of bound accesses on agg_bandwidth[] and agg_count[] arrays. Fixes: 6d72657ce379 ("net/bonding: add other aggregator modes") Cc: stable@dpdk.org Signed-off-by: Zhaohui Signed-off-by: David Marchand --- drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c b/drivers/net/bonding/rte_eth_bond_8023ad.c index 3943ec1..5004898 100644 --- a/drivers/net/bonding/rte_eth_bond_8023ad.c +++ b/drivers/net/bonding/rte_eth_bond_8023ad.c @@ -669,8 +669,8 @@ struct port *agg, *port; uint16_t slaves_count, new_agg_id, i, j = 0; uint16_t *slaves; - uint64_t agg_bandwidth[8] = {0}; - uint64_t agg_count[8] = {0}; + uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0}; + uint64_t agg_count[RTE_MAX_ETHPORTS] = {0}; uint16_t default_slave = 0; uint16_t mode_count_id; uint16_t mode_band_id; -- 1.8.3.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id AD388A00E6 for ; Thu, 21 Mar 2019 21:28:31 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 195C21B544; Thu, 21 Mar 2019 21:28:27 +0100 (CET) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by dpdk.org (Postfix) with ESMTP id 752AC1B536; Thu, 21 Mar 2019 21:28:24 +0100 (CET) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A4ED43092650; Thu, 21 Mar 2019 20:28:23 +0000 (UTC) Received: from dmarchan.remote.csb (ovpn-204-129.brq.redhat.com [10.40.204.129]) by smtp.corp.redhat.com (Postfix) with ESMTP id 32D754B3; Thu, 21 Mar 2019 20:28:22 +0000 (UTC) From: David Marchand To: dev@dpdk.org Cc: ferruh.yigit@intel.com, chas3@att.com, zhaohui8@huawei.com, stable@dpdk.org Date: Thu, 21 Mar 2019 21:28:14 +0100 Message-Id: <1553200094-5487-2-git-send-email-david.marchand@redhat.com> In-Reply-To: <1553200094-5487-1-git-send-email-david.marchand@redhat.com> References: <1553200094-5487-1-git-send-email-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.43]); Thu, 21 Mar 2019 20:28:23 +0000 (UTC) Subject: [dpdk-dev] [PATCH 2/2] net/bonding: fix oob access in "other" aggregator modes X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Content-Type: text/plain; charset="UTF-8" Message-ID: <20190321202814.P8dW6YKx_R-DlT6JR-bM-dJfoQMjsN19HTbvBy-hmT8@z> From: Zhaohui slave aggregator_port_id is in [0, RTE_MAX_ETHPORTS-1] range. If RTE_MAX_ETHPORTS is > 8, we can hit out of bound accesses on agg_bandwidth[] and agg_count[] arrays. Fixes: 6d72657ce379 ("net/bonding: add other aggregator modes") Cc: stable@dpdk.org Signed-off-by: Zhaohui Signed-off-by: David Marchand --- drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c b/drivers/net/bonding/rte_eth_bond_8023ad.c index 3943ec1..5004898 100644 --- a/drivers/net/bonding/rte_eth_bond_8023ad.c +++ b/drivers/net/bonding/rte_eth_bond_8023ad.c @@ -669,8 +669,8 @@ struct port *agg, *port; uint16_t slaves_count, new_agg_id, i, j = 0; uint16_t *slaves; - uint64_t agg_bandwidth[8] = {0}; - uint64_t agg_count[8] = {0}; + uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0}; + uint64_t agg_count[RTE_MAX_ETHPORTS] = {0}; uint16_t default_slave = 0; uint16_t mode_count_id; uint16_t mode_band_id; -- 1.8.3.1