In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end,
and the TCP port is not taken into account in calculating the HASH
value of TCP packets. TCP connections with the same source and
destination IP addresses will be hashed to the same slave port,
which may cause load imbalance.
1. TCP Pure ACK packets with no options, The header length is 20
and there is no data.
2. A TCP packet contains data, but the first seg of the mbuf
contains only the header information (ETH, IP, TCP), and the
data is in subsequent segs, which is usually the case in the
indirect mbuf used for zero-copy.
Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read")
Cc: sta...@dpdk.org
Signed-off-by: Jun Qiu <jun....@jaguarmicro.com>
---
drivers/net/bonding/rte_eth_bond_pmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c
b/drivers/net/bonding/rte_eth_bond_pmd.c
index 73e6972035..3bf978e2df 100644
--- a/drivers/net/bonding/rte_eth_bond_pmd.c
+++ b/drivers/net/bonding/rte_eth_bond_pmd.c
@@ -768,7 +768,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
((char *)ipv4_hdr +
ip_hdr_offset);
if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
- < pkt_end)
+ <= pkt_end)
l4hash = HASH_L4_PORTS(tcp_hdr);
} else if (ipv4_hdr->next_proto_id ==
IPPROTO_UDP) {
--
2.25.1
