1. when memcpy slaves the internals->active_slave_count 1 2. return internals->active_slave_count is 2 3. the slaves[1] would be a random invalid value
Signed-off-by: Haifeng Lin <haifeng....@huawei.com> --- drivers/net/bonding/rte_eth_bond_api.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/rte_eth_bond_api.c b/drivers/net/bonding/rte_eth_bond_api.c index 21bcd50..ed7b02e 100644 --- a/drivers/net/bonding/rte_eth_bond_api.c +++ b/drivers/net/bonding/rte_eth_bond_api.c @@ -815,6 +815,7 @@ uint16_t len) { struct bond_dev_private *internals; + uint16_t active_slave_count; if (valid_bonded_port_id(bonded_port_id) != 0) return -1; @@ -824,13 +825,14 @@ internals = rte_eth_devices[bonded_port_id].data->dev_private; - if (internals->active_slave_count > len) + active_slave_count = internals->active_slave_count; + if (active_slave_count > len) return -1; memcpy(slaves, internals->active_slaves, - internals->active_slave_count * sizeof(internals->active_slaves[0])); + active_slave_count * sizeof(internals->active_slaves[0])); - return internals->active_slave_count; + return active_slave_count; } int -- 1.8.5.2.msysgit.0