[dpdk-stable] patch 'vhost: protect vring access done by application' has been queued to LTS release 18.11.6

[Kevin Traynor]

Hi,

FYI, your patch has been queued to LTS release 18.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/10/19. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable-queue/commit/b0818bac8e25cf4bd024673956b52609dae1b8ba

Thanks.

Kevin.

---
>From b0818bac8e25cf4bd024673956b52609dae1b8ba Mon Sep 17 00:00:00 2001
From: Tiwei Bie <tiwei.bie at intel.com>
Date: Mon, 19 Aug 2019 19:34:57 +0800
Subject: [PATCH] vhost: protect vring access done by application

[ upstream commit 4e0de8dac8531b82d4c328791a67f49eadfed5f0 ]

Besides the enqueue/dequeue API, other APIs of the builtin net
backend should also be protected.

Fixes: a3688046995f ("vhost: protect active rings from async ring changes")

Reported-by: Peng He <xnhp0320 at icloud.com>
Signed-off-by: Tiwei Bie <tiwei.bie at intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>
---
 lib/librte_vhost/vhost.c | 50 +++++++++++++++++++++++++++++++---------
 1 file changed, 39 insertions(+), 11 deletions(-)

diff --git a/lib/librte_vhost/vhost.c b/lib/librte_vhost/vhost.c
index 0b5ee0307..f7d132cd4 100644
--- a/lib/librte_vhost/vhost.c
+++ b/lib/librte_vhost/vhost.c
@@ -635,4 +635,5 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
 	struct virtio_net *dev;
 	struct vhost_virtqueue *vq;
+	uint16_t ret = 0;
 
 	dev = get_device(vid);
@@ -641,14 +642,24 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
 
 	vq = dev->virtqueue[queue_id];
-	if (!vq->enabled)
-		return 0;
 
-	return *(volatile uint16_t *)&vq->avail->idx - vq->last_used_idx;
+	rte_spinlock_lock(&vq->access_lock);
+
+	if (unlikely(!vq->enabled || vq->avail == NULL))
+		goto out;
+
+	ret = *(volatile uint16_t *)&vq->avail->idx - vq->last_used_idx;
+
+out:
+	rte_spinlock_unlock(&vq->access_lock);
+	return ret;
 }
 
-static inline void
+static inline int
 vhost_enable_notify_split(struct virtio_net *dev,
 		struct vhost_virtqueue *vq, int enable)
 {
+	if (vq->used == NULL)
+		return -1;
+
 	if (!(dev->features & (1ULL << VIRTIO_RING_F_EVENT_IDX))) {
 		if (enable)
@@ -660,7 +671,8 @@ vhost_enable_notify_split(struct virtio_net *dev,
 			vhost_avail_event(vq) = vq->last_avail_idx;
 	}
+	return 0;
 }
 
-static inline void
+static inline int
 vhost_enable_notify_packed(struct virtio_net *dev,
 		struct vhost_virtqueue *vq, int enable)
@@ -668,7 +680,10 @@ vhost_enable_notify_packed(struct virtio_net *dev,
 	uint16_t flags;
 
+	if (vq->device_event == NULL)
+		return -1;
+
 	if (!enable) {
 		vq->device_event->flags = VRING_EVENT_F_DISABLE;
-		return;
+		return 0;
 	}
 
@@ -683,4 +698,5 @@ vhost_enable_notify_packed(struct virtio_net *dev,
 
 	vq->device_event->flags = flags;
+	return 0;
 }
 
@@ -690,4 +706,5 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
 	struct virtio_net *dev = get_device(vid);
 	struct vhost_virtqueue *vq;
+	int ret;
 
 	if (!dev)
@@ -696,10 +713,14 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
 	vq = dev->virtqueue[queue_id];
 
+	rte_spinlock_lock(&vq->access_lock);
+
 	if (vq_is_packed(dev))
-		vhost_enable_notify_packed(dev, vq, enable);
+		ret = vhost_enable_notify_packed(dev, vq, enable);
 	else
-		vhost_enable_notify_split(dev, vq, enable);
+		ret = vhost_enable_notify_split(dev, vq, enable);
 
-	return 0;
+	rte_spinlock_unlock(&vq->access_lock);
+
+	return ret;
 }
 
@@ -740,4 +761,5 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)
 	struct virtio_net *dev;
 	struct vhost_virtqueue *vq;
+	uint16_t ret = 0;
 
 	dev = get_device(vid);
@@ -755,8 +777,14 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)
 		return 0;
 
+	rte_spinlock_lock(&vq->access_lock);
+
 	if (unlikely(vq->enabled == 0 || vq->avail == NULL))
-		return 0;
+		goto out;
 
-	return *((volatile uint16_t *)&vq->avail->idx) - vq->last_avail_idx;
+	ret = *((volatile uint16_t *)&vq->avail->idx) - vq->last_avail_idx;
+
+out:
+	rte_spinlock_unlock(&vq->access_lock);
+	return ret;
 }
 
-- 
2.21.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2019-12-03 17:29:52.286908156 +0000
+++ 0008-vhost-protect-vring-access-done-by-application.patch	2019-12-03 17:29:51.702750953 +0000
@@ -1 +1 @@
-From 4e0de8dac8531b82d4c328791a67f49eadfed5f0 Mon Sep 17 00:00:00 2001
+From b0818bac8e25cf4bd024673956b52609dae1b8ba Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 4e0de8dac8531b82d4c328791a67f49eadfed5f0 ]
+
@@ -10 +11,0 @@
-Cc: stable at dpdk.org
@@ -20 +21 @@
-index 77be16069..cea44df8c 100644
+index 0b5ee0307..f7d132cd4 100644
@@ -23 +24 @@
-@@ -786,4 +786,5 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
+@@ -635,4 +635,5 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
@@ -29 +30 @@
-@@ -792,14 +793,24 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
+@@ -641,14 +642,24 @@ rte_vhost_avail_entries(int vid, uint16_t queue_id)
@@ -58 +59 @@
-@@ -811,7 +822,8 @@ vhost_enable_notify_split(struct virtio_net *dev,
+@@ -660,7 +671,8 @@ vhost_enable_notify_split(struct virtio_net *dev,
@@ -68 +69 @@
-@@ -819,7 +831,10 @@ vhost_enable_notify_packed(struct virtio_net *dev,
+@@ -668,7 +680,10 @@ vhost_enable_notify_packed(struct virtio_net *dev,
@@ -80 +81 @@
-@@ -834,4 +849,5 @@ vhost_enable_notify_packed(struct virtio_net *dev,
+@@ -683,4 +698,5 @@ vhost_enable_notify_packed(struct virtio_net *dev,
@@ -86 +87 @@
-@@ -841,4 +857,5 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
+@@ -690,4 +706,5 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
@@ -92 +93 @@
-@@ -847,10 +864,14 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
+@@ -696,10 +713,14 @@ rte_vhost_enable_guest_notification(int vid, uint16_t queue_id, int enable)
@@ -110 +111 @@
-@@ -891,4 +912,5 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)
+@@ -740,4 +761,5 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)
@@ -113 +114 @@
-+	uint32_t ret = 0;
++	uint16_t ret = 0;
@@ -116 +117 @@
-@@ -906,8 +928,14 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)
+@@ -755,8 +777,14 @@ rte_vhost_rx_queue_count(int vid, uint16_t qid)