[DPDK/ethdev Bug 2036] net/octeontx: nr_port write runs past a one byte stack struct

[bugzilla]

https://bugs.dpdk.org/show_bug.cgi?id=2036

            Bug ID: 2036
           Summary: net/octeontx: nr_port write runs past a one byte stack
                    struct
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: ethdev
          Assignee: dev@dpdk.org
          Reporter: step...@networkplumber.org
  Target Milestone: ---

drivers/net/octeontx/octeontx_ethdev.c

parse_integer_arg() stores an int:

        static int
        parse_integer_arg(const char *key __rte_unused,
                        const char *value, void *extra_args)
        {
                int *i = (int *)extra_args;

                *i = atoi(value);

The caller passes &params->nr_port, which is a uint8_t and the only member
of a struct octeontx_vdev_init_params living on the stack:

        struct octeontx_vdev_init_params {
                uint8_t nr_port;
        };

So "nr_port=1" writes four bytes into a one byte struct, three of them past
its end. Worst of the set because the overrun leaves the object entirely.

Fixes: f7be70e5130e ("net/octeontx: add net device probe and remove")

-- 
You are receiving this mail because:
You are the assignee for the bug.