From fbe9bd4deab755855a4ef2d88e559da6ae4b76c2 Mon Sep 17 00:00:00 2001 From: Jun Qiu <jun.qiu@jaguarmicro.com> Date: Fri, 28 Oct 2022 15:32:42 +0800 Subject: net/bonding: fix Tx hash for TCP In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end, and the TCP port is not taken into account in calculating the HASH value of TCP packets. TCP connections with the same source and destination IP addresses will be hashed to the same slave port, which may cause load imbalance. 1. TCP Pure ACK packets with no options, The header length is 20 and there is no data. 2. A TCP packet contains data, but the first seg of the mbuf contains only the header information (ETH, IP, TCP), and the data is in subsequent segs, which is usually the case in the indirect mbuf used for zero-copy. Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read") Cc: stable@dpdk.org Signed-off-by: Jun Qiu <jun.qiu@jaguarmicro.com> Acked-by: Min Hu (Connor) <humin29@huawei.com> --- drivers/net/bonding/rte_eth_bond_pmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c index 3be2b08128..18754e3299 100644 --- a/drivers/net/bonding/rte_eth_bond_pmd.c +++ b/drivers/net/bonding/rte_eth_bond_pmd.c @@ -768,7 +768,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts, ((char *)ipv4_hdr + ip_hdr_offset); if ((size_t)tcp_hdr + sizeof(*tcp_hdr) - < pkt_end) + <= pkt_end) l4hash = HASH_L4_PORTS(tcp_hdr); } else if (ipv4_hdr->next_proto_id == IPPROTO_UDP) { -- 2.23.0