From 70a6aeb4639b633bc322834bb6f07b6c45c7e52b Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 23 Apr 2019 09:53:35 -0700 Subject: [PATCH] net/ring: check length of ring name The ring name is passed in as part of this drivers API, but it doesn't check that the name is not truncated. Fixes: 96cb19521147 ("net/ring: use EAL APIs in PMD specific API") Fixes: e1e4017751f1 ("ring: add new driver") Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger Reviewed-by: Ferruh Yigit --- drivers/net/ring/rte_eth_ring.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/ring/rte_eth_ring.c b/drivers/net/ring/rte_eth_ring.c index 0355f2b7c4..979993fd3e 100644 --- a/drivers/net/ring/rte_eth_ring.c +++ b/drivers/net/ring/rte_eth_ring.c @@ -383,7 +383,12 @@ rte_eth_from_rings(const char *name, struct rte_ring *const rx_queues[], snprintf(args_str, sizeof(args_str), "%s=%p", ETH_RING_INTERNAL_ARG, &args); - snprintf(ring_name, sizeof(ring_name), "net_ring_%s", name); + + ret = snprintf(ring_name, sizeof(ring_name), "net_ring_%s", name); + if (ret >= (int)sizeof(ring_name)) { + rte_errno = ENAMETOOLONG; + return -1; + } ret = rte_vdev_init(ring_name, args_str); if (ret) { @@ -417,7 +422,15 @@ eth_dev_ring_create(const char *name, const unsigned int numa_node, RTE_PMD_RING_MAX_TX_RINGS); for (i = 0; i < num_rings; i++) { - snprintf(rng_name, sizeof(rng_name), "ETH_RXTX%u_%s", i, name); + int cc; + + cc = snprintf(rng_name, sizeof(rng_name), + "ETH_RXTX%u_%s", i, name); + if (cc >= (int)sizeof(rng_name)) { + rte_errno = ENAMETOOLONG; + return -1; + } + rxtx[i] = (action == DEV_CREATE) ? rte_ring_create(rng_name, 1024, numa_node, RING_F_SP_ENQ|RING_F_SC_DEQ) : -- 2.20.1