net/bonding: fix Segfault when eal thread executing nic‘s lsc event for mode 4

  When the number of slave slave devices exceeds 8, it will cause the array subscript to cross the boundary.

---
drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--
  

On 3/6/2019 3:42 AM, Zhaohui (zhaohui, Polestar) wrote:
> When the number of slave slave devices exceeds 8, it will cause the array
> subscript to cross the boundary.
> 
> ---
> drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>  
> diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c
> b/drivers/net/bonding/rte_eth_bond_8023ad.c
> index f6f8b28..b5589c7 100644
> --- a/drivers/net/bonding/rte_eth_bond_8023ad.c
> +++ b/drivers/net/bonding/rte_eth_bond_8023ad.c
> @@ -920,8 +920,8 @@ static void selection_logic (struct bond_dev_private
> *internals, uint8_t slave_id
>        struct port *agg, *port;
>        uint16_t slaves_count, new_agg_id, i, j = 0;
>        uint16_t *slaves;
> -        uint64_t agg_bandwidth[8] = {0};
> -        uint64_t agg_count[8] = {0};
> +       uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0};
> +       uint64_t agg_count[RTE_MAX_ETHPORTS] = {0};

Patch doesn't apply clearly but I think the intention in the fix is clear.

Is there any specific reason to pick the number '8'?
Also this function gets 'uint8_t slave_id' as argument, if this is port_is,
should it be uint16_t?

>        uint16_t default_slave = 0;
>        uint8_t mode_count_id, mode_band_id;
>        struct rte_eth_link link_info;
> --
  

On 3/19/19 1:37 PM, Ferruh Yigit wrote:
> On 3/6/2019 3:42 AM, Zhaohui (zhaohui, Polestar) wrote:
>> When the number of slave slave devices exceeds 8, it will cause the array
>> subscript to cross the boundary.
>>
>> ---
>> drivers/net/bonding/rte_eth_bond_8023ad.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>   
>> diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c
>> b/drivers/net/bonding/rte_eth_bond_8023ad.c
>> index f6f8b28..b5589c7 100644
>> --- a/drivers/net/bonding/rte_eth_bond_8023ad.c
>> +++ b/drivers/net/bonding/rte_eth_bond_8023ad.c
>> @@ -920,8 +920,8 @@ static void selection_logic (struct bond_dev_private
>> *internals, uint8_t slave_id
>>         struct port *agg, *port;
>>         uint16_t slaves_count, new_agg_id, i, j = 0;
>>         uint16_t *slaves;
>> -        uint64_t agg_bandwidth[8] = {0};
>> -        uint64_t agg_count[8] = {0};
>> +       uint64_t agg_bandwidth[RTE_MAX_ETHPORTS] = {0};
>> +       uint64_t agg_count[RTE_MAX_ETHPORTS] = {0};
> 
> Patch doesn't apply clearly but I think the intention in the fix is clear.

Zhaohui,

Has this been an actual problem in practice? I ask because the number
of possible slaves for the bonding drivers appears to be RTE_MAX_ETHPORTS.
I suspect people typically have far fewer slaves on a bonding device in
practice.

> Is there any specific reason to pick the number '8'?

I suspect someone guessed this was the maximum reasonable number of
slaves.

> Also this function gets 'uint8_t slave_id' as argument, if this is port_is,
> should it be uint16_t?

It probably was never completely changed when the DPDK port id changed
from uint8 to uint16.

> 
>>         uint16_t default_slave = 0;
>>         uint8_t mode_count_id, mode_band_id;
>>         struct rte_eth_link link_info;
>> --
>