From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr0-f180.google.com (mail-wr0-f180.google.com [209.85.128.180]) by dpdk.org (Postfix) with ESMTP id 3889B9A0E for ; Mon, 31 Jul 2017 15:40:21 +0200 (CEST) Received: by mail-wr0-f180.google.com with SMTP id y43so179422166wrd.3 for ; Mon, 31 Jul 2017 06:40:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=8b3/Di+hePUY6gf411gwgzqrSQvhr3vXocgPenYqvBs=; b=cM9eqa/SnaaERePsdOoRbPhCDHglX4UkUARAQrtJK4xij/5TLPI+J2Q24h4WA2mO/2 JT7Ig/E4FbcVJSPiBu86XK6BhhG/L4rPe+HUDmfayRGkrEA9HvbvChB+3v5B39bZ9Pz9 phlt6z9F13YJ2k6MO5TAVxs0DLlkp43y1Mp67CPAjfNwTsQhAygRgD6S8kFUu7qVm3ZF bgUNWkKPyVJfTM0pCHInx/99R0KRI8SiUyAf4WNfH3AvFywEExzVSHg5ZwFnDKznRoCW kU8xrWnATaHXedQrCrdewh9OW9N2ka4SKPexF+lklWk9hjSYKLs3MOsAZJS2cgi7AqSn nmBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=8b3/Di+hePUY6gf411gwgzqrSQvhr3vXocgPenYqvBs=; b=Fdz8NA/cfKHth/gb5jD7qOQM1YyCkzwzDQPzXfARhlTDHWfJM1xPP48CHmO5SIDwrL lB4mm3FKvP9Hf0dUHKf/ipJjtjmlAi4o7TVgZtetXEG7u3JsWHzeUzcIfO4N7Rs+SsG7 CJ/jnp4f+lOA1GmD7fCB5/jyvX5MqWAEf9wcbNlHirAHfi4V0/gOuvxV93tB2q9V/LID USOsKm7TUq3ZdUkerXjA3qILF90aVwKVOHl6mwCfE62pgIcaKggAIapqUzr8eDSOz1sN rvJPex8SwcHXAf5xjZd2CjpsZYsYoxgtqaYs48R40O+Cjl5U0RsXYC9MTqSmVZmmh4xV Ln4g== X-Gm-Message-State: AIVw111lFieaFQLNnCzEZRE/5c3sEDkpdpmFQQvcPgsn1qaybNDZOw/z 6P4SUP8bda2ttnEa X-Received: by 10.223.130.137 with SMTP id 9mr12483827wrc.0.1501508420799; Mon, 31 Jul 2017 06:40:20 -0700 (PDT) Received: from bidouze.dev.6wind.com (host.78.145.23.62.rev.coltfrance.com. [62.23.145.78]) by smtp.gmail.com with ESMTPSA id 192sm777400wml.41.2017.07.31.06.40.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 31 Jul 2017 06:40:19 -0700 (PDT) From: Gaetan Rivet To: dev@dpdk.org Cc: Gaetan Rivet , stable@dpdk.org, Ferruh Yigit Date: Mon, 31 Jul 2017 15:40:07 +0200 Message-Id: X-Mailer: git-send-email 2.1.4 In-Reply-To: <1757afd2673591a59ebd69cef7b569d344f20e7c.1501496827.git.gaetan.rivet@6wind.com> References: <1757afd2673591a59ebd69cef7b569d344f20e7c.1501496827.git.gaetan.rivet@6wind.com> Subject: [dpdk-stable] [PATCH v2] ethdev: fix invalid length write on dev detach X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jul 2017 13:40:21 -0000 The name of a device is copied in a provided buffer within rte_eth_dev_detach(). The current sizeof is done on a pointer instead of the intended array usually pointed to. The name field of an rte_device is not assured however to point an rte_devargs name field. The almost correct length to base this copy over is thus RTE_DEV_NAME_MAX_LEN. Almost correct, because unfortunately this function does not allow the user to pass down a size parameter for the buffer it is meant to write. This API should be fixed, it is broken by design. Fixes: a1e7c17555e8 ("ethdev: use device name from device structure") Cc: stable@dpdk.org Cc: Ferruh Yigit Signed-off-by: Gaetan Rivet --- v2: - Document the function expectations regarding the given buffer. While doing so, clarify the intent of the devname parameter, as its intent was ambiguous. lib/librte_ether/rte_ethdev.c | 4 ++-- lib/librte_ether/rte_ethdev.h | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/librte_ether/rte_ethdev.c b/lib/librte_ether/rte_ethdev.c index 805ef63..0597641 100644 --- a/lib/librte_ether/rte_ethdev.c +++ b/lib/librte_ether/rte_ethdev.c @@ -436,8 +436,8 @@ rte_eth_dev_detach(uint8_t port_id, char *name) if (rte_eth_dev_is_detachable(port_id)) goto err; - snprintf(name, sizeof(rte_eth_devices[port_id].device->name), - "%s", rte_eth_devices[port_id].device->name); + snprintf(name, RTE_DEV_NAME_MAX_LEN, "%s", + rte_eth_devices[port_id].device->name); ret = rte_eal_dev_detach(rte_eth_devices[port_id].device); if (ret < 0) diff --git a/lib/librte_ether/rte_ethdev.h b/lib/librte_ether/rte_ethdev.h index 0e99090..0adf327 100644 --- a/lib/librte_ether/rte_ethdev.h +++ b/lib/librte_ether/rte_ethdev.h @@ -1831,7 +1831,8 @@ int rte_eth_dev_attach(const char *devargs, uint8_t *port_id); * @param port_id * The port identifier of the device to detach. * @param devname - * A pointer to a device name actually detached. + * A pointer to a buffer that will be filled with the device name. + * This buffer must be at least RTE_DEV_NAME_MAX_LEN long. * @return * 0 on success and devname is filled, negative on error */ -- 2.1.4