From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr0-f175.google.com (mail-wr0-f175.google.com [209.85.128.175]) by dpdk.org (Postfix) with ESMTP id 860A99A0E for ; Mon, 31 Jul 2017 15:40:21 +0200 (CEST) Received: by mail-wr0-f175.google.com with SMTP id y43so179422236wrd.3 for ; Mon, 31 Jul 2017 06:40:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=8b3/Di+hePUY6gf411gwgzqrSQvhr3vXocgPenYqvBs=; b=cM9eqa/SnaaERePsdOoRbPhCDHglX4UkUARAQrtJK4xij/5TLPI+J2Q24h4WA2mO/2 JT7Ig/E4FbcVJSPiBu86XK6BhhG/L4rPe+HUDmfayRGkrEA9HvbvChB+3v5B39bZ9Pz9 phlt6z9F13YJ2k6MO5TAVxs0DLlkp43y1Mp67CPAjfNwTsQhAygRgD6S8kFUu7qVm3ZF bgUNWkKPyVJfTM0pCHInx/99R0KRI8SiUyAf4WNfH3AvFywEExzVSHg5ZwFnDKznRoCW kU8xrWnATaHXedQrCrdewh9OW9N2ka4SKPexF+lklWk9hjSYKLs3MOsAZJS2cgi7AqSn nmBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=8b3/Di+hePUY6gf411gwgzqrSQvhr3vXocgPenYqvBs=; b=QZaYhl0JPbQq0IDLgVvu79enDzUVOqQ7jv4q6ocLuL61cGFcWcqGjWh2/9aY/W7AWx QTH6v/ukAe01JtldiDHIHZ+6v5yAVLM8OMSBGgGIV1Fzu4PTjwA2eGIQnLAJB89/n4Do LGZ5NS704ZmfvQppCeDjcEgGlvCKloMy6RTuKtOojyvbROTZCjqK6h2eX2q0hG2slN3l amOYTYTmRqUj3sxop0C/DNMqBEs9ft+8Li+zdSi93V+NHIOWGmx9mUwBp3P49h2OVF3p aQTMHquzR9Y7UllM/TXERUBaZkY0BFPWLChQufqXb0xnmizlMRVCS7YVo4+HtKlEpW1A g61A== X-Gm-Message-State: AIVw111K3xJbGeTaALZY18867LW08gqkQPQG8RB0/5OVW/4ezKJdoyQd QIprkyB82hZA8NjIL1g= X-Received: by 10.223.130.137 with SMTP id 9mr12483827wrc.0.1501508420799; Mon, 31 Jul 2017 06:40:20 -0700 (PDT) Received: from bidouze.dev.6wind.com (host.78.145.23.62.rev.coltfrance.com. [62.23.145.78]) by smtp.gmail.com with ESMTPSA id 192sm777400wml.41.2017.07.31.06.40.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 31 Jul 2017 06:40:19 -0700 (PDT) From: Gaetan Rivet To: dev@dpdk.org Cc: Gaetan Rivet , stable@dpdk.org, Ferruh Yigit Date: Mon, 31 Jul 2017 15:40:07 +0200 Message-Id: X-Mailer: git-send-email 2.1.4 In-Reply-To: <1757afd2673591a59ebd69cef7b569d344f20e7c.1501496827.git.gaetan.rivet@6wind.com> References: <1757afd2673591a59ebd69cef7b569d344f20e7c.1501496827.git.gaetan.rivet@6wind.com> Subject: [dpdk-dev] [PATCH v2] ethdev: fix invalid length write on dev detach X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jul 2017 13:40:21 -0000 The name of a device is copied in a provided buffer within rte_eth_dev_detach(). The current sizeof is done on a pointer instead of the intended array usually pointed to. The name field of an rte_device is not assured however to point an rte_devargs name field. The almost correct length to base this copy over is thus RTE_DEV_NAME_MAX_LEN. Almost correct, because unfortunately this function does not allow the user to pass down a size parameter for the buffer it is meant to write. This API should be fixed, it is broken by design. Fixes: a1e7c17555e8 ("ethdev: use device name from device structure") Cc: stable@dpdk.org Cc: Ferruh Yigit Signed-off-by: Gaetan Rivet --- v2: - Document the function expectations regarding the given buffer. While doing so, clarify the intent of the devname parameter, as its intent was ambiguous. lib/librte_ether/rte_ethdev.c | 4 ++-- lib/librte_ether/rte_ethdev.h | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/librte_ether/rte_ethdev.c b/lib/librte_ether/rte_ethdev.c index 805ef63..0597641 100644 --- a/lib/librte_ether/rte_ethdev.c +++ b/lib/librte_ether/rte_ethdev.c @@ -436,8 +436,8 @@ rte_eth_dev_detach(uint8_t port_id, char *name) if (rte_eth_dev_is_detachable(port_id)) goto err; - snprintf(name, sizeof(rte_eth_devices[port_id].device->name), - "%s", rte_eth_devices[port_id].device->name); + snprintf(name, RTE_DEV_NAME_MAX_LEN, "%s", + rte_eth_devices[port_id].device->name); ret = rte_eal_dev_detach(rte_eth_devices[port_id].device); if (ret < 0) diff --git a/lib/librte_ether/rte_ethdev.h b/lib/librte_ether/rte_ethdev.h index 0e99090..0adf327 100644 --- a/lib/librte_ether/rte_ethdev.h +++ b/lib/librte_ether/rte_ethdev.h @@ -1831,7 +1831,8 @@ int rte_eth_dev_attach(const char *devargs, uint8_t *port_id); * @param port_id * The port identifier of the device to detach. * @param devname - * A pointer to a device name actually detached. + * A pointer to a buffer that will be filled with the device name. + * This buffer must be at least RTE_DEV_NAME_MAX_LEN long. * @return * 0 on success and devname is filled, negative on error */ -- 2.1.4