[PATCH 04/14] vhost: fix log base address mapping offset

[Maxime Coquelin]

Fix out-of-bounds write vulnerability caused by double-application of
mmap_offset in vhost_user_set_log_base(). The offset was used both as
a file offset in mmap() and then added again to compute log_base,
causing log_base to point beyond the mapped memory region.

Map the full region (size + offset) at file offset 0, matching the
correct pattern used in vhost_user_mmap_region(). Update munmap calls
to use the actual mapped size.

Fixes: bdd96d8ac76c ("vhost: fix offset while mapping log base address")

Bugzilla ID: 2004
CVE-2026-86563

Cc: stable at dpdk.org

Reported-by: Ivar Al-Safawi <hemo40047 at gmail.com>
Acked-by: Kevin Traynor <ktraynor at redhat.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
---
 lib/vhost/vhost_user.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index ce3420ae90..018adfe4b2 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -296,7 +296,8 @@ vhost_backend_cleanup(struct virtio_net *dev)
 	dev->guest_pages = NULL;
 
 	if (dev->log_addr) {
-		munmap((void *)(uintptr_t)dev->log_addr, dev->log_size);
+		munmap((void *)(uintptr_t)dev->log_addr,
+		       dev->log_size + dev->log_base - dev->log_addr);
 		dev->log_addr = 0;
 	}
 
@@ -2726,7 +2727,7 @@ vhost_user_set_log_base(struct virtio_net **pdev,
 	 * mmap from 0 to workaround a hugepage mmap bug: mmap will
 	 * fail when offset is not page size aligned.
 	 */
-	addr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, off);
+	addr = mmap(0, size + off, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
 	alignment = get_blk_size(fd);
 	close(fd);
 	if (addr == MAP_FAILED) {
@@ -2739,7 +2740,8 @@ vhost_user_set_log_base(struct virtio_net **pdev,
 	 * multiple VHOST_USER_SET_LOG_BASE.
 	 */
 	if (dev->log_addr) {
-		munmap((void *)(uintptr_t)dev->log_addr, dev->log_size);
+		munmap((void *)(uintptr_t)dev->log_addr,
+		       dev->log_size + dev->log_base - dev->log_addr);
 	}
 	dev->log_addr = (uint64_t)(uintptr_t)addr;
 	dev->log_base = dev->log_addr + off;
-- 
2.56.0