[dpdk-stable] patch 'vhost: catch overflow causing mmap of size 0' has been queued to LTS release 18.11.7

[Kevin Traynor]

Hi,

FYI, your patch has been queued to LTS release 18.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/20/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable-queue/commit/6b3e0aa1624e47893c67e67900dcec586ebf0d99

Thanks.

Kevin.

---
>From 6b3e0aa1624e47893c67e67900dcec586ebf0d99 Mon Sep 17 00:00:00 2001
From: Maxime Coquelin <maxime.coquelin at redhat.com>
Date: Thu, 16 Jan 2020 11:44:27 +0100
Subject: [PATCH] vhost: catch overflow causing mmap of size 0

[ upstream commit c6420a36328b9c6b71770aaa982abacd0e2440b8 ]

This patch catches an overflow that could happen if an
invalid region size or page alignment is provided by the
guest via the VHOST_USER_SET_MEM_TABLE request.

If the sum of the size to mmap and the alignment overflows
uint64_t, then RTE_ALIGN_CEIL(mmap_size, alignment) macro
will return 0. This value was passed as is as size argument
to mmap().

While kernel handling of mmap() syscall returns an error
if size is 0, it is better to catch it earlier and provide
a meaningful error log.

Fixes: ec09c280b839 ("vhost: fix mmap not aligned with hugepage size")

Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Reviewed-by: Tiwei Bie <tiwei.bie at intel.com>
---
 lib/librte_vhost/vhost_user.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index b9ecec5ba7..4c58880f8c 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -1118,4 +1118,19 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
 		}
 		mmap_size = RTE_ALIGN_CEIL(mmap_size, alignment);
+		if (mmap_size == 0) {
+			/*
+			 * It could happen if initial mmap_size + alignment
+			 * overflows the sizeof uint64, which could happen if
+			 * either mmap_size or alignment value is wrong.
+			 *
+			 * mmap() kernel implementation would return an error,
+			 * but better catch it before and provide useful info
+			 * in the logs.
+			 */
+			RTE_LOG(ERR, VHOST_CONFIG, "mmap size (0x%" PRIx64 ") "
+					"or alignment (0x%" PRIx64 ") is invalid\n",
+					reg->size + mmap_offset, alignment);
+			goto err_mmap;
+		}
 
 		populate = (dev->dequeue_zero_copy) ? MAP_POPULATE : 0;
-- 
2.21.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-02-14 17:02:39.009405344 +0000
+++ 0035-vhost-catch-overflow-causing-mmap-of-size-0.patch	2020-02-14 17:02:37.048405914 +0000
@@ -1 +1 @@
-From c6420a36328b9c6b71770aaa982abacd0e2440b8 Mon Sep 17 00:00:00 2001
+From 6b3e0aa1624e47893c67e67900dcec586ebf0d99 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit c6420a36328b9c6b71770aaa982abacd0e2440b8 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -30 +31 @@
-index c9cc4d6489..9f14ea6676 100644
+index b9ecec5ba7..4c58880f8c 100644
@@ -33 +34 @@
-@@ -1146,4 +1146,19 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
+@@ -1118,4 +1118,19 @@ vhost_user_set_mem_table(struct virtio_net **pdev, struct VhostUserMsg *msg,
@@ -46 +47 @@
-+			VHOST_LOG_CONFIG(ERR, "mmap size (0x%" PRIx64 ") "
++			RTE_LOG(ERR, VHOST_CONFIG, "mmap size (0x%" PRIx64 ") "