[dpdk-dev] [PATCH 10/10] net/bonding: fix configuration assignment overflow

[Stephen Hemminger]

On Mon, 19 Apr 2021 21:34:49 +0800
"Min Hu (Connor)" <humin29 at huawei.com> wrote:

> From: Chengchang Tang <tangchengchang at huawei.com>
> 
> The expression may cause an overflow.
> 
> This patch fix the codeDEX static check warning "INTEGER_OVERFLOW".
> 
> Fixes: 46fb43683679 ("bond: add mode 4")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Chengchang Tang <tangchengchang at huawei.com>
> Signed-off-by: Min Hu (Connor) <humin29 at huawei.com>
> ---
>  drivers/net/bonding/rte_eth_bond_8023ad.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/bonding/rte_eth_bond_8023ad.c b/drivers/net/bonding/rte_eth_bond_8023ad.c
> index 128754f..483f082 100644
> --- a/drivers/net/bonding/rte_eth_bond_8023ad.c
> +++ b/drivers/net/bonding/rte_eth_bond_8023ad.c
> @@ -1237,7 +1237,7 @@ bond_mode_8023ad_conf_assign(struct mode8023ad_private *mode4,
>  	mode4->aggregate_wait_timeout = conf->aggregate_wait_timeout_ms * ms_ticks;
>  	mode4->tx_period_timeout = conf->tx_period_ms * ms_ticks;
>  	mode4->rx_marker_timeout = conf->rx_marker_period_ms * ms_ticks;
> -	mode4->update_timeout_us = conf->update_timeout_ms * 1000;
> +	mode4->update_timeout_us = (uint64_t)conf->update_timeout_ms * 1000;

It could overflow, but that would only happen if the timeout_ms was greater than 2^32 / 1000
which is 4295 seconds!  The default is 100 ms. 
	
The driver should do some more validation in bond_8023ad_setup_validate().
It does check that update_timeout_ms is non zero, but it has no upper bound.