From fbe9bd4deab755855a4ef2d88e559da6ae4b76c2 Mon Sep 17 00:00:00 2001
From: Jun Qiu <jun.qiu@jaguarmicro.com>
Date: Fri, 28 Oct 2022 15:32:42 +0800
Subject: net/bonding: fix Tx hash for TCP

In the following two cases, tcp_hdr + sizeof(*tcp_hdr) == pkt_end,
and the TCP port is not taken into account in calculating the HASH
value of TCP packets. TCP connections with the same source and
destination IP addresses will be hashed to the same slave port,
which may cause load imbalance.
1. TCP Pure ACK packets with no options, The header length is 20
and there is no data.
2. A TCP packet contains data, but the first seg of the mbuf
contains only the header information (ETH, IP, TCP), and the
data is in subsequent segs, which is usually the case in the
indirect mbuf used for zero-copy.

Fixes: 726158060d55 ("net/bonding: fix potential out of bounds read")
Cc: stable@dpdk.org

Signed-off-by: Jun Qiu <jun.qiu@jaguarmicro.com>
Acked-by: Min Hu (Connor) <humin29@huawei.com>
---
 drivers/net/bonding/rte_eth_bond_pmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
index 3be2b08128..18754e3299 100644
--- a/drivers/net/bonding/rte_eth_bond_pmd.c
+++ b/drivers/net/bonding/rte_eth_bond_pmd.c
@@ -768,7 +768,7 @@ burst_xmit_l34_hash(struct rte_mbuf **buf, uint16_t nb_pkts,
 						((char *)ipv4_hdr +
 							ip_hdr_offset);
 					if ((size_t)tcp_hdr + sizeof(*tcp_hdr)
-							< pkt_end)
+							<= pkt_end)
 						l4hash = HASH_L4_PORTS(tcp_hdr);
 				} else if (ipv4_hdr->next_proto_id ==
 								IPPROTO_UDP) {
-- 
2.23.0