From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id B9F4FA0548; Tue, 27 Apr 2021 03:41:33 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 9F64B40143; Tue, 27 Apr 2021 03:41:33 +0200 (CEST) Received: from szxga06-in.huawei.com (szxga06-in.huawei.com [45.249.212.32]) by mails.dpdk.org (Postfix) with ESMTP id 6C4114003E for ; Tue, 27 Apr 2021 03:41:32 +0200 (CEST) Received: from DGGEMS405-HUB.china.huawei.com (unknown [172.30.72.60]) by szxga06-in.huawei.com (SkyGuard) with ESMTP id 4FTkvk5w6fzlb16 for ; Tue, 27 Apr 2021 09:39:30 +0800 (CST) Received: from [10.67.103.128] (10.67.103.128) by DGGEMS405-HUB.china.huawei.com (10.3.19.205) with Microsoft SMTP Server id 14.3.498.0; Tue, 27 Apr 2021 09:41:30 +0800 To: Ferruh Yigit , References: <1619083366-63417-1-git-send-email-humin29@huawei.com> From: "Min Hu (Connor)" Message-ID: Date: Tue, 27 Apr 2021 09:41:30 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.3.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [10.67.103.128] X-CFilter-Loop: Reflected Subject: Re: [dpdk-dev] [PATCH] bonding: fix overflow check X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" 在 2021/4/26 23:08, Ferruh Yigit 写道: > On 4/22/2021 10:22 AM, Min Hu (Connor) wrote: >> Buffer 'test_params->slave_port_ids' of size 6 accessed may >> overflow, since its index 'i' can have value be is out of range. >> >> This patch fixed it. >> >> Fixes: 92073ef961ee ("bond: unit tests") >> Cc: stable@dpdk.org >> >> Signed-off-by: Min Hu (Connor) >> --- >> app/test/test_link_bonding.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/app/test/test_link_bonding.c b/app/test/test_link_bonding.c >> index 8a5c831..b5a6042 100644 >> --- a/app/test/test_link_bonding.c >> +++ b/app/test/test_link_bonding.c >> @@ -2216,7 +2216,8 @@ test_activebackup_rx_burst(void) >> "failed to get primary slave for bonded port (%d)", >> test_params->bonded_port_id); >> >> - for (i = 0; i < test_params->bonded_slave_count; i++) { >> + for (i = 0; i < test_params->bonded_slave_count && >> + i < TEST_MAX_NUMBER_OF_PORTS; i++) { >> /* Generate test bursts of packets to transmit */ >> TEST_ASSERT_EQUAL(generate_test_burst( >> &gen_pkt_burst[0], burst_size, 0, 1, 0, 0, 0), >> > > Hi Connor, > > There is nothing wrong with the check you add, but at first place how > 'test_params->bonded_slave_count' can become bigger than > 'TEST_MAX_NUMBER_OF_PORTS'? Should we fix there, instead of this loop? > > Also in same function, there are a few more loops iterate until " < > test_params->bonded_slave_count", so fixing the root case works for them too. > Hi, fixed in v2, thanks. >