Re: [PATCH net v2]bonding: fix send_peer_notif data truncation
From: Jakub Kicinski <kuba@kernel.org>
Date: 2021-01-28 20:47:24
Please make sure you CC the author of the original code. On Wed, 27 Jan 2021 03:57:22 +0000 liaichun wrote:
send_peer_notif is u8, the value of this parameter is obtained from u8*int, it's easy to be truncated. And in practice, more than u8(256) characters are used.
Did you find this through code inspection of is it really a problem? What's your miimon setting?
quoted hunk ↗ jump to hunk
Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Signed-off-by: Aichun Li <redacted> --- include/net/bonding.h | 2 +- drivers/net/bonding/bond_main.c | 4 ++-- 2 file changed, 3 insertion(+), 3 deletion(-)diff --git a/include/net/bonding.h b/include/net/bonding.h index 0960d9af7b8e..65394566d556 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h@@ -215,7 +215,7 @@ struct bonding { */ spinlock_t mode_lock; spinlock_t stats_lock; - u8 send_peer_notif; + u32 send_peer_notif; u8 igmp_retrans; #ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_entry;diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index b7db57e6c96a..336460538135 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c@@ -880,8 +880,8 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active) if (netif_running(bond->dev)) { bond->send_peer_notif = - bond->params.num_peer_notif * - max(1, bond->params.peer_notif_delay); + (u32)(bond->params.num_peer_notif *
Why do you add the cast?
+ max(1, bond->params.peer_notif_delay)); should_notify_peers = bond_should_notify_peers(bond); } -- 2.19.1