From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <david.marchand@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 by dpdk.org (Postfix) with ESMTP id 752AC1B536;
 Thu, 21 Mar 2019 21:28:24 +0100 (CET)
Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com
 [10.5.11.16])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.redhat.com (Postfix) with ESMTPS id A4ED43092650;
 Thu, 21 Mar 2019 20:28:23 +0000 (UTC)
Received: from dmarchan.remote.csb (ovpn-204-129.brq.redhat.com
 [10.40.204.129])
 by smtp.corp.redhat.com (Postfix) with ESMTP id 32D754B3;
 Thu, 21 Mar 2019 20:28:22 +0000 (UTC)
From: David Marchand <david.marchand@redhat.com>
To: dev@dpdk.org
Cc: ferruh.yigit@intel.com, chas3@att.com, zhaohui8@huawei.com, stable@dpdk.org
Date: Thu, 21 Mar 2019 21:28:14 +0100
Message-Id: <1553200094-5487-2-git-send-email-david.marchand@redhat.com>
In-Reply-To: <1553200094-5487-1-git-send-email-david.marchand@redhat.com>
References: <1553200094-5487-1-git-send-email-david.marchand@redhat.com>
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
 (mx1.redhat.com [10.5.110.43]); Thu, 21 Mar 2019 20:28:23 +0000 (UTC)
Subject: [dpdk-dev] [PATCH 2/2] net/bonding: fix oob access in "other"
	aggregator modes
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Mar 2019 20:28:24 -0000

From: Zhaohui <zhaohui8@huawei.com>

slave aggregator_port_id is in [0, RTE_MAX_ETHPORTS-1] range.
If RTE_MAX_ETHPORTS is > 8, we can hit out of bound accesses on
agg_bandwidth[] and agg_count[] arrays.

Fixes: 6d72657ce379 ("net/bonding: add other aggregator modes")
Cc: stable@dpdk.org

Signed-off-by: Zhaohui <zhaohui8@huawei.com>
Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c b/drivers/net/bonding/rte_eth_bond_8023ad.c
index 3943ec1..5004898 100644
--- a/drivers/net/bonding/rte_eth_bond_8023ad.c
+++ b/drivers/net/bonding/rte_eth_bond_8023ad.c
@@ -669,8 +669,8 @@
 	struct port *agg, *port;
 	uint16_t slaves_count, new_agg_id, i, j = 0;
 	uint16_t *slaves;
-	uint64_t agg_bandwidth[8] = {0};
-	uint64_t agg_count[8] = {0};
+	uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0};
+	uint64_t agg_count[RTE_MAX_ETHPORTS] = {0};
 	uint16_t default_slave = 0;
 	uint16_t mode_count_id;
 	uint16_t mode_band_id;
-- 
1.8.3.1

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from dpdk.org (dpdk.org [92.243.14.124])
	by dpdk.space (Postfix) with ESMTP id AD388A00E6
	for <public@inbox.dpdk.org>; Thu, 21 Mar 2019 21:28:31 +0100 (CET)
Received: from [92.243.14.124] (localhost [127.0.0.1])
	by dpdk.org (Postfix) with ESMTP id 195C21B544;
	Thu, 21 Mar 2019 21:28:27 +0100 (CET)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 by dpdk.org (Postfix) with ESMTP id 752AC1B536;
 Thu, 21 Mar 2019 21:28:24 +0100 (CET)
Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com
 [10.5.11.16])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.redhat.com (Postfix) with ESMTPS id A4ED43092650;
 Thu, 21 Mar 2019 20:28:23 +0000 (UTC)
Received: from dmarchan.remote.csb (ovpn-204-129.brq.redhat.com
 [10.40.204.129])
 by smtp.corp.redhat.com (Postfix) with ESMTP id 32D754B3;
 Thu, 21 Mar 2019 20:28:22 +0000 (UTC)
From: David Marchand <david.marchand@redhat.com>
To: dev@dpdk.org
Cc: ferruh.yigit@intel.com, chas3@att.com, zhaohui8@huawei.com, stable@dpdk.org
Date: Thu, 21 Mar 2019 21:28:14 +0100
Message-Id: <1553200094-5487-2-git-send-email-david.marchand@redhat.com>
In-Reply-To: <1553200094-5487-1-git-send-email-david.marchand@redhat.com>
References: <1553200094-5487-1-git-send-email-david.marchand@redhat.com>
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
 (mx1.redhat.com [10.5.110.43]); Thu, 21 Mar 2019 20:28:23 +0000 (UTC)
Subject: [dpdk-dev] [PATCH 2/2] net/bonding: fix oob access in "other"
	aggregator modes
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>
Content-Type: text/plain; charset="UTF-8"
Message-ID: <20190321202814.P8dW6YKx_R-DlT6JR-bM-dJfoQMjsN19HTbvBy-hmT8@z>

From: Zhaohui <zhaohui8@huawei.com>

slave aggregator_port_id is in [0, RTE_MAX_ETHPORTS-1] range.
If RTE_MAX_ETHPORTS is > 8, we can hit out of bound accesses on
agg_bandwidth[] and agg_count[] arrays.

Fixes: 6d72657ce379 ("net/bonding: add other aggregator modes")
Cc: stable@dpdk.org

Signed-off-by: Zhaohui <zhaohui8@huawei.com>
Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c b/drivers/net/bonding/rte_eth_bond_8023ad.c
index 3943ec1..5004898 100644
--- a/drivers/net/bonding/rte_eth_bond_8023ad.c
+++ b/drivers/net/bonding/rte_eth_bond_8023ad.c
@@ -669,8 +669,8 @@
 	struct port *agg, *port;
 	uint16_t slaves_count, new_agg_id, i, j = 0;
 	uint16_t *slaves;
-	uint64_t agg_bandwidth[8] = {0};
-	uint64_t agg_count[8] = {0};
+	uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0};
+	uint64_t agg_count[RTE_MAX_ETHPORTS] = {0};
 	uint16_t default_slave = 0;
 	uint16_t mode_count_id;
 	uint16_t mode_band_id;
-- 
1.8.3.1