[dpdk-stable] patch 'vhost: catch overflow causing mmap of size 0' has been queued to stable release 19.11.1

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 19.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/13/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
>From 43bbd5262003581cadec3b1068ffdb62a4bd3cb0 Mon Sep 17 00:00:00 2001
From: Maxime Coquelin <maxime.coquelin at redhat.com>
Date: Thu, 16 Jan 2020 11:44:27 +0100
Subject: [PATCH] vhost: catch overflow causing mmap of size 0

[ upstream commit c6420a36328b9c6b71770aaa982abacd0e2440b8 ]

This patch catches an overflow that could happen if an
invalid region size or page alignment is provided by the
guest via the VHOST_USER_SET_MEM_TABLE request.

If the sum of the size to mmap and the alignment overflows
uint64_t, then RTE_ALIGN_CEIL(mmap_size, alignment) macro
will return 0. This value was passed as is as size argument
to mmap().

While kernel handling of mmap() syscall returns an error
if size is 0, it is better to catch it earlier and provide
a meaningful error log.

Fixes: ec09c280b839 ("vhost: fix mmap not aligned with hugepage size")

Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Reviewed-by: Tiwei Bie <tiwei.bie at intel.com>
---
 lib/librte_vhost/vhost_user.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index 1c3a1a89fc..4312e5e536 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -1145,6 +1145,21 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
 			goto err_mmap;
 		}
 		mmap_size = RTE_ALIGN_CEIL(mmap_size, alignment);
+		if (mmap_size == 0) {
+			/*
+			 * It could happen if initial mmap_size + alignment
+			 * overflows the sizeof uint64, which could happen if
+			 * either mmap_size or alignment value is wrong.
+			 *
+			 * mmap() kernel implementation would return an error,
+			 * but better catch it before and provide useful info
+			 * in the logs.
+			 */
+			RTE_LOG(ERR, VHOST_CONFIG, "mmap size (0x%" PRIx64 ") "
+					"or alignment (0x%" PRIx64 ") is invalid\n",
+					reg->size + mmap_offset, alignment);
+			goto err_mmap;
+		}
 
 		populate = (dev->dequeue_zero_copy) ? MAP_POPULATE : 0;
 		mmap_addr = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE,
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-02-11 11:17:44.830085085 +0000
+++ 0181-vhost-catch-overflow-causing-mmap-of-size-0.patch	2020-02-11 11:17:38.832009425 +0000
@@ -1,8 +1,10 @@
-From c6420a36328b9c6b71770aaa982abacd0e2440b8 Mon Sep 17 00:00:00 2001
+From 43bbd5262003581cadec3b1068ffdb62a4bd3cb0 Mon Sep 17 00:00:00 2001
 From: Maxime Coquelin <maxime.coquelin at redhat.com>
 Date: Thu, 16 Jan 2020 11:44:27 +0100
 Subject: [PATCH] vhost: catch overflow causing mmap of size 0
 
+[ upstream commit c6420a36328b9c6b71770aaa982abacd0e2440b8 ]
+
 This patch catches an overflow that could happen if an
 invalid region size or page alignment is provided by the
 guest via the VHOST_USER_SET_MEM_TABLE request.
@@ -17,7 +19,6 @@
 a meaningful error log.
 
 Fixes: ec09c280b839 ("vhost: fix mmap not aligned with hugepage size")
-Cc: stable at dpdk.org
 
 Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
 Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
@@ -27,7 +28,7 @@
  1 file changed, 15 insertions(+)
 
 diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
-index c9cc4d6489..9f14ea6676 100644
+index 1c3a1a89fc..4312e5e536 100644
 --- a/lib/librte_vhost/vhost_user.c
 +++ b/lib/librte_vhost/vhost_user.c
 @@ -1145,6 +1145,21 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
@@ -44,7 +45,7 @@
 +			 * but better catch it before and provide useful info
 +			 * in the logs.
 +			 */
-+			VHOST_LOG_CONFIG(ERR, "mmap size (0x%" PRIx64 ") "
++			RTE_LOG(ERR, VHOST_CONFIG, "mmap size (0x%" PRIx64 ") "
 +					"or alignment (0x%" PRIx64 ") is invalid\n",
 +					reg->size + mmap_offset, alignment);
 +			goto err_mmap;