[dpdk-stable] patch 'power: fix sanity checks for guest channel read' has been queued to stable release 20.11.2

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 20.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/14/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/steevenlee/dpdk

This queued commit can be viewed at:
https://github.com/steevenlee/dpdk/commit/b7ab9f121d70b57465583b9c074d85fb3c6e7386

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From b7ab9f121d70b57465583b9c074d85fb3c6e7386 Mon Sep 17 00:00:00 2001
From: Hongbo Zheng <zhenghongbo3 at huawei.com>
Date: Wed, 12 May 2021 10:19:19 +0800
Subject: [PATCH] power: fix sanity checks for guest channel read
Cc: Luca Boccassi <bluca at debian.org>

[ upstream commit 1fe00fd358c0b5cab798010a69e758bfead9fd84 ]

In function power_guest_channel_read_msg, 'lcore_id' is used before
validity check, which may cause buffer 'global_fds' accessed by index
'lcore_id' overflow.

This patch moves the validity check of 'lcore_id' before the 'lcore_id'
being used for the first time.

Fixes: 9dc843eb273b ("power: extend guest channel API for reading")

Signed-off-by: Hongbo Zheng <zhenghongbo3 at huawei.com>
Signed-off-by: Min Hu (Connor) <humin29 at huawei.com>
Reviewed-by: Reshma Pattan <reshma.pattan at intel.com>
Acked-by: David Hunt <david.hunt at intel.com>
---
 lib/librte_power/guest_channel.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/librte_power/guest_channel.c b/lib/librte_power/guest_channel.c
index 2f7507a03c..474dd92998 100644
--- a/lib/librte_power/guest_channel.c
+++ b/lib/librte_power/guest_channel.c
@@ -166,6 +166,17 @@ int power_guest_channel_read_msg(void *pkt,
 	if (pkt_len == 0 || pkt == NULL)
 		return -1;
 
+	if (lcore_id >= RTE_MAX_LCORE) {
+		RTE_LOG(ERR, GUEST_CHANNEL, "Channel(%u) is out of range 0...%d\n",
+				lcore_id, RTE_MAX_LCORE-1);
+		return -1;
+	}
+
+	if (global_fds[lcore_id] < 0) {
+		RTE_LOG(ERR, GUEST_CHANNEL, "Channel is not connected\n");
+		return -1;
+	}
+
 	fds.fd = global_fds[lcore_id];
 	fds.events = POLLIN;
 
@@ -179,17 +190,6 @@ int power_guest_channel_read_msg(void *pkt,
 		return -1;
 	}
 
-	if (lcore_id >= RTE_MAX_LCORE) {
-		RTE_LOG(ERR, GUEST_CHANNEL, "Channel(%u) is out of range 0...%d\n",
-				lcore_id, RTE_MAX_LCORE-1);
-		return -1;
-	}
-
-	if (global_fds[lcore_id] < 0) {
-		RTE_LOG(ERR, GUEST_CHANNEL, "Channel is not connected\n");
-		return -1;
-	}
-
 	while (pkt_len > 0) {
 		ret = read(global_fds[lcore_id],
 				pkt, pkt_len);
-- 
2.25.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-06-12 06:53:59.270979100 +0800
+++ 0103-power-fix-sanity-checks-for-guest-channel-read.patch	2021-06-12 06:53:56.460000000 +0800
@@ -1 +1 @@
-From 1fe00fd358c0b5cab798010a69e758bfead9fd84 Mon Sep 17 00:00:00 2001
+From b7ab9f121d70b57465583b9c074d85fb3c6e7386 Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Luca Boccassi <bluca at debian.org>
+
+[ upstream commit 1fe00fd358c0b5cab798010a69e758bfead9fd84 ]
@@ -14 +16,0 @@
-Cc: stable at dpdk.org
@@ -21 +23 @@
- lib/power/guest_channel.c | 22 +++++++++++-----------
+ lib/librte_power/guest_channel.c | 22 +++++++++++-----------
@@ -24 +26 @@
-diff --git a/lib/power/guest_channel.c b/lib/power/guest_channel.c
+diff --git a/lib/librte_power/guest_channel.c b/lib/librte_power/guest_channel.c
@@ -26,2 +28,2 @@
---- a/lib/power/guest_channel.c
-+++ b/lib/power/guest_channel.c
+--- a/lib/librte_power/guest_channel.c
++++ b/lib/librte_power/guest_channel.c