Skip to content

Commit

Permalink
net/bonding: fix possible overrun
Browse files Browse the repository at this point in the history
[ upstream commit 925f8582c49c79f588cb4c96f510fb94becbb3bc ]

CI found that overrunning array of 32 2-byte elements at
element index 65535 (byte offset 131071) by dereferencing
pointer "members + agg_new_idx".

Coverity issue: 403099
Fixes: 6d72657 ("net/bonding: add other aggregator modes")

Signed-off-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
Acked-by: Ferruh Yigit <ferruh.yigit@amd.com>
  • Loading branch information
wulong2022 authored and bluca committed Nov 8, 2023
1 parent 894b686 commit bc4acb9
Showing 1 changed file with 2 additions and 5 deletions.
7 changes: 2 additions & 5 deletions drivers/net/bonding/rte_eth_bond_8023ad.c
Original file line number Diff line number Diff line change
Expand Up @@ -652,12 +652,9 @@ tx_machine(struct bond_dev_private *internals, uint16_t slave_id)
}

static uint16_t
max_index(uint64_t *a, int n)
max_index(uint64_t *a, uint16_t n)
{
if (n <= 0)
return -1;

int i, max_i = 0;
uint16_t i, max_i = 0;
uint64_t max = a[0];

for (i = 1; i < n; ++i) {
Expand Down

0 comments on commit bc4acb9

Please sign in to comment.