[PATCH v2 1/1] eal/linux: reject --huge-dir not parent of mountpt

[Dmitry Kozlyuk]

2023-01-03 17:00 (UTC-0700), Ashish Sadanandan:
> The code added for allowing --huge-dir to specify hugetlbfs
> sub-directories has a bug where it incorrectly matches mounts that
> contain a prefix of the specified --huge-dir.
> 
> Consider --huge-dir=/dev/hugepages1G is passed to rte_eal_init. Given
> the following hugetlbfs mounts
> 
> $ mount | grep hugetlbfs
> hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)
> hugetlbfs on /dev/hugepages1G type hugetlbfs (rw,relatime,pagesize=1024M)
> hugetlbfs on /mnt/huge type hugetlbfs (rw,relatime,pagesize=2M)
> 
> get_hugepage_dir is first called with hugepage_sz=2097152. While
> iterating over all mount points, /dev/hugepages is incorrectly
> determined to be a match because it's a prefix of --huge-dir. The caller
> then obtains an exclusive lock on --huge-dir.
> 
> In the next call to get_hugepage_dir, hugepage_sz=1073741824. This call
> correctly determines /dev/hugepages1G is a match. The caller again
> attempts to obtain an exclusive lock on --huge-dir and deadlocks because
> it's already holding a lock.
> 
> This has been corrected by ensuring any matched mount point is either an
> exact match or a parent path of --huge-dir.
> 
> Fixes: 24d5a1ce6b85 ("eal/linux: allow hugetlbfs sub-directories")
> Cc: john.levon at nutanix.com
> Cc: stable at dpdk.org
> Signed-off-by: Ashish Sadanandan <ashish.sadanandan at gmail.com>

Acked-by: Dmitry Kozlyuk <dmitry.kozliuk at gmail.com>

> ---
>  lib/eal/linux/eal_hugepage_info.c | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/eal/linux/eal_hugepage_info.c b/lib/eal/linux/eal_hugepage_info.c
> index a1b6cb31ff..180abd930c 100644
> --- a/lib/eal/linux/eal_hugepage_info.c
> +++ b/lib/eal/linux/eal_hugepage_info.c
> @@ -265,12 +265,23 @@ get_hugepage_dir(uint64_t hugepage_sz, char *hugedir, int len)
>  			break;
>  		}
>  
> +		size_t mountpt_len = strlen(splitstr[MOUNTPT]);
> +		size_t hugepage_dir_len = strlen(internal_conf->hugepage_dir);

The second one can be done before the loop.
Please declare all variables at the beginning of the block per code style.

> +
>  		/*
>  		 * Ignore any mount that doesn't contain the --huge-dir
>  		 * directory.
>  		 */
>  		if (strncmp(internal_conf->hugepage_dir, splitstr[MOUNTPT],
> -			strlen(splitstr[MOUNTPT])) != 0) {
> +			mountpt_len) != 0) {
> +			continue;
> +		}
> +		/*
> +		 * Ignore any mount where hugepage_dir is not a parent path of
> +		 * the mount
> +		 */
> +		else if(hugepage_dir_len > mountpt_len &&
> +			internal_conf->hugepage_dir[mountpt_len] != '/') {

Nit: maybe a single comment for both conditions would be more clear:

/*
 * Ignore any mount that is not --huge-dir or its subdirectory.
 */

>  			continue;
>  		}
>  
> @@ -278,7 +289,7 @@ get_hugepage_dir(uint64_t hugepage_sz, char *hugedir, int len)
>  		 * We found a match, but only prefer it if it's a longer match
>  		 * (so /mnt/1 is preferred over /mnt for matching /mnt/1/2)).
>  		 */
> -		if (strlen(splitstr[MOUNTPT]) > strlen(found))
> +		if (mountpt_len > strlen(found))
>  			strlcpy(found, splitstr[MOUNTPT], len);
>  	} /* end while fgets */