patch 'net/vhost: fix access to freed memory' has been queued to stable release 21.11.2

[Kevin Traynor <ktraynor@redhat.com>]

Hi,

FYI, your patch has been queued to stable release 21.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/30/22. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/58d1b856be11421a5d7688a89f0058ff10688e3a

Thanks.

Kevin

---
From 58d1b856be11421a5d7688a89f0058ff10688e3a Mon Sep 17 00:00:00 2001
From: Yuan Wang <yuanx.wang@intel.com>
Date: Sat, 12 Mar 2022 00:35:12 +0800
Subject: [PATCH] net/vhost: fix access to freed memory

[ upstream commit 9dc6bb06824f3c5887f0436ddba5ab9116cb277e ]

This patch fixes heap-use-after-free reported by ASan.

It is possible for the rte_vhost_dequeue_burst() to access the vq
is freed when numa_realloc() gets called in the device running state.
The control plane will set the vq->access_lock to protected the vq
from the data plane. Unfortunately the lock will fail at the moment
the vq is freed, allowing the rte_vhost_dequeue_burst() to access
the fields of the vq, which will trigger a heap-use-after-free error.

In the case of multiple queues, the vhost pmd can access other queues
that are not ready when the first queue is ready, which makes no sense
and also allows numa_realloc() and rte_vhost_dequeue_burst() access to
vq to happen at the same time. By controlling vq->allow_queuing we can make
the pmd access only the queues that are ready.

Fixes: 1ce3c7fe149 ("net/vhost: emulate device start/stop behavior")

Signed-off-by: Yuan Wang <yuanx.wang@intel.com>
Tested-by: Wei Ling <weix.ling@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 drivers/net/vhost/rte_eth_vhost.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/vhost/rte_eth_vhost.c b/drivers/net/vhost/rte_eth_vhost.c
index 070f0e6dfd..8a6595504a 100644
--- a/drivers/net/vhost/rte_eth_vhost.c
+++ b/drivers/net/vhost/rte_eth_vhost.c
@@ -721,4 +721,5 @@ update_queuing_status(struct rte_eth_dev *dev)
 	struct pmd_internal *internal = dev->data->dev_private;
 	struct vhost_queue *vq;
+	struct rte_vhost_vring_state *state;
 	unsigned int i;
 	int allow_queuing = 1;
@@ -731,4 +732,6 @@ update_queuing_status(struct rte_eth_dev *dev)
 		allow_queuing = 0;
 
+	state = vring_states[dev->data->port_id];
+
 	/* Wait until rx/tx_pkt_burst stops accessing vhost device */
 	for (i = 0; i < dev->data->nb_rx_queues; i++) {
@@ -736,5 +739,8 @@ update_queuing_status(struct rte_eth_dev *dev)
 		if (vq == NULL)
 			continue;
-		rte_atomic32_set(&vq->allow_queuing, allow_queuing);
+		if (allow_queuing && state->cur[vq->virtqueue_id])
+			rte_atomic32_set(&vq->allow_queuing, 1);
+		else
+			rte_atomic32_set(&vq->allow_queuing, 0);
 		while (rte_atomic32_read(&vq->while_queuing))
 			rte_pause();
@@ -745,5 +751,8 @@ update_queuing_status(struct rte_eth_dev *dev)
 		if (vq == NULL)
 			continue;
-		rte_atomic32_set(&vq->allow_queuing, allow_queuing);
+		if (allow_queuing && state->cur[vq->virtqueue_id])
+			rte_atomic32_set(&vq->allow_queuing, 1);
+		else
+			rte_atomic32_set(&vq->allow_queuing, 0);
 		while (rte_atomic32_read(&vq->while_queuing))
 			rte_pause();
@@ -968,4 +977,6 @@ vring_state_changed(int vid, uint16_t vring, int enable)
 	rte_spinlock_unlock(&state->lock);
 
+	update_queuing_status(eth_dev);
+
 	VHOST_LOG(INFO, "vring%u is %s\n",
 			vring, enable ? "enabled" : "disabled");
-- 
2.34.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2022-05-25 17:26:58.808074511 +0100
+++ 0007-net-vhost-fix-access-to-freed-memory.patch	2022-05-25 17:26:58.541828293 +0100
@@ -1 +1 @@
-From 9dc6bb06824f3c5887f0436ddba5ab9116cb277e Mon Sep 17 00:00:00 2001
+From 58d1b856be11421a5d7688a89f0058ff10688e3a Mon Sep 17 00:00:00 2001
@@ -4,0 +5,2 @@
+
+[ upstream commit 9dc6bb06824f3c5887f0436ddba5ab9116cb277e ]