[PATCH 1/2] net/bonding: fix xmit l34 hash calculate for tcp

[PATCH 1/2] net/bonding: fix xmit l34 hash calculate for tcp

[Jun Qiu]

In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end,
and the TCP port is not taken into account in calculating the HASH
value of TCP packets. TCP connections with the same source and
destination IP addresses will be hashed to the same slave port,
which may cause load imbalance.
1. TCP Pure ACK packets with no options, The header length is 20
and there is no data.
2. A TCP packet contains data, but the first seg of the mbuf
contains only the header information (ETH, IP, TCP), and the
data is in subsequent segs, which is usually the case in the
indirect mbuf used for zero-copy.

Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read")
Cc: stable@dpdk.org

Signed-off-by: Jun Qiu <jun.qiu@jaguarmicro.com>
---
 drivers/net/bonding/rte_eth_bond_pmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
index 73e6972035..3bf978e2df 100644
--- a/drivers/net/bonding/rte_eth_bond_pmd.c
+++ b/drivers/net/bonding/rte_eth_bond_pmd.c
@@ -768,7 +768,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
 						((char *)ipv4_hdr +
 							ip_hdr_offset);
 					if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
-							< pkt_end)
+							<= pkt_end)
 						l4hash = HASH_L4_PORTS(tcp_hdr);
 				} else if (ipv4_hdr->next_proto_id ==
 								IPPROTO_UDP) {
-- 
2.25.1

Re: [PATCH 1/2] net/bonding: fix xmit l34 hash calculate for tcp

[humin (Q)]

Acked-by: Min Hu (Connor) <humin29@huawei.com>

在 2022/7/26 14:19, Jun Qiu 写道:
> In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end,
> and the TCP port is not taken into account in calculating the HASH
> value of TCP packets. TCP connections with the same source and
> destination IP addresses will be hashed to the same slave port,
> which may cause load imbalance.
> 1. TCP Pure ACK packets with no options, The header length is 20
> and there is no data.
> 2. A TCP packet contains data, but the first seg of the mbuf
> contains only the header information (ETH, IP, TCP), and the
> data is in subsequent segs, which is usually the case in the
> indirect mbuf used for zero-copy.
>
> Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read")
> Cc: stable@dpdk.org
>
> Signed-off-by: Jun Qiu <jun.qiu@jaguarmicro.com>
> ---
>   drivers/net/bonding/rte_eth_bond_pmd.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
> index 73e6972035..3bf978e2df 100644
> --- a/drivers/net/bonding/rte_eth_bond_pmd.c
> +++ b/drivers/net/bonding/rte_eth_bond_pmd.c
> @@ -768,7 +768,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
>   						((char *)ipv4_hdr +
>   							ip_hdr_offset);
>   					if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
> -							< pkt_end)
> +							<= pkt_end)
>   						l4hash = HASH_L4_PORTS(tcp_hdr);
>   				} else if (ipv4_hdr->next_proto_id ==
>   								IPPROTO_UDP) {

Re: [PATCH 1/2] net/bonding: fix xmit l34 hash calculate for tcp

[Thomas Monjalon]

> > In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end,
> > and the TCP port is not taken into account in calculating the HASH
> > value of TCP packets. TCP connections with the same source and
> > destination IP addresses will be hashed to the same slave port,
> > which may cause load imbalance.
> > 1. TCP Pure ACK packets with no options, The header length is 20
> > and there is no data.
> > 2. A TCP packet contains data, but the first seg of the mbuf
> > contains only the header information (ETH, IP, TCP), and the
> > data is in subsequent segs, which is usually the case in the
> > indirect mbuf used for zero-copy.
> >
> > Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Jun Qiu <jun.qiu@jaguarmicro.com>
> Acked-by: Min Hu (Connor) <humin29@huawei.com>

Applied, thanks.