| Message ID | eda05faf1e994f1faddb5b07007f0b93@huawei.com (mailing list archive) |
|---|---|
| State | Deferred |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v2] bonding: fix send_peer_notif data truncation | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | warning | 1 maintainers not CCed: vincent@bernat.ch |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 13 this patch: 13 |
| netdev/kdoc | success | Errors and warnings before: 2 this patch: 2 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | warning | WARNING: From:/Signed-off-by: email name mismatch: 'From: liaichun <liaichun@huawei.com>' != 'Signed-off-by: Aichun Li <liaichun@huawei.com>' |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 13 this patch: 13 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
Please make sure you CC the author of the original code. On Wed, 27 Jan 2021 03:57:22 +0000 liaichun wrote: > send_peer_notif is u8, the value of this parameter is obtained from > u8*int, it's easy to be truncated. And in practice, more than u8(256) > characters are used. Did you find this through code inspection of is it really a problem? What's your miimon setting? > Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") > Signed-off-by: Aichun Li <liaichun@huawei.com> > --- > include/net/bonding.h | 2 +- > drivers/net/bonding/bond_main.c | 4 ++-- > 2 file changed, 3 insertion(+), 3 deletion(-) > > diff --git a/include/net/bonding.h b/include/net/bonding.h index 0960d9af7b8e..65394566d556 100644 > --- a/include/net/bonding.h > +++ b/include/net/bonding.h > @@ -215,7 +215,7 @@ struct bonding { > */ > spinlock_t mode_lock; > spinlock_t stats_lock; > - u8 send_peer_notif; > + u32 send_peer_notif; > u8 igmp_retrans; > #ifdef CONFIG_PROC_FS > struct proc_dir_entry *proc_entry; > diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index b7db57e6c96a..336460538135 100644 > --- a/drivers/net/bonding/bond_main.c > +++ b/drivers/net/bonding/bond_main.c > @@ -880,8 +880,8 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active) > > if (netif_running(bond->dev)) { > bond->send_peer_notif = > - bond->params.num_peer_notif * > - max(1, bond->params.peer_notif_delay); > + (u32)(bond->params.num_peer_notif * Why do you add the cast? > + max(1, bond->params.peer_notif_delay)); > should_notify_peers = > bond_should_notify_peers(bond); > } > -- > 2.19.1 >
diff --git a/include/net/bonding.h b/include/net/bonding.h index 0960d9af7b8e..65394566d556 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h @@ -215,7 +215,7 @@ struct bonding { */ spinlock_t mode_lock; spinlock_t stats_lock; - u8 send_peer_notif; + u32 send_peer_notif; u8 igmp_retrans; #ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_entry; diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index b7db57e6c96a..336460538135 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -880,8 +880,8 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active) if (netif_running(bond->dev)) { bond->send_peer_notif = - bond->params.num_peer_notif * - max(1, bond->params.peer_notif_delay); + (u32)(bond->params.num_peer_notif * + max(1, bond->params.peer_notif_delay)); should_notify_peers = bond_should_notify_peers(bond); }
send_peer_notif is u8, the value of this parameter is obtained from u8*int, it's easy to be truncated. And in practice, more than u8(256) characters are used. Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Signed-off-by: Aichun Li <liaichun@huawei.com> --- include/net/bonding.h | 2 +- drivers/net/bonding/bond_main.c | 4 ++-- 2 file changed, 3 insertion(+), 3 deletion(-) -- 2.19.1