On Sat, 4 Jul 2020 at 19:31, Michael S. Tsirkin <m...@redhat.com> wrote:
>
> From: Cindy Lu <l...@redhat.com>
>
> Currently we have 2 types of vhost backends in QEMU: vhost kernel and
> vhost-user. The above patch provides a generic device for vDPA purpose,
> this vDPA device exposes to user space a non-vendor-specific configuration
> interface for setting up a vhost HW accelerator, this patch set introduces
> a third vhost backend called vhost-vdpa based on the vDPA interface.
>
> Vhost-vdpa usage:
>
> qemu-system-x86_64 -cpu host -enable-kvm \
> ......
> -netdev type=vhost-vdpa,vhostdev=/dev/vhost-vdpa-id,id=vhost-vdpa0 \
> -device virtio-net-pci,netdev=vhost-vdpa0,page-per-vq=on \
Hi; Coverity reports some issues with this change:
> +static int vhost_vdpa_dma_map(struct vhost_vdpa *v, hwaddr iova, hwaddr size,
> + void *vaddr, bool readonly)
> +{
> + struct vhost_msg_v2 msg;
> + int fd = v->device_fd;
> + int ret = 0;
> +
> + msg.type = v->msg_type;
> + msg.iotlb.iova = iova;
> + msg.iotlb.size = size;
> + msg.iotlb.uaddr = (uint64_t)vaddr;
> + msg.iotlb.perm = readonly ? VHOST_ACCESS_RO : VHOST_ACCESS_RW;
> + msg.iotlb.type = VHOST_IOTLB_UPDATE;
> +
> + if (write(fd, &msg, sizeof(msg)) != sizeof(msg)) {
Here we write the contents of the struct down the pipe,
but we have not initialized all its fields; specifically,
msg.reserved is not initialized and so those bytes will
be random. We'll also transfer random contents from the
stack in the padding, potentially.
This is CID 1420267.
The easy fix is to zero-initialize the whole struct at the start:
struct vhost_msg_v2 msg = {};
> + error_report("failed to write, fd=%d, errno=%d (%s)",
> + fd, errno, strerror(errno));
> + return -EIO ;
> + }
> +
> + return ret;
> +}
> +
> +static int vhost_vdpa_dma_unmap(struct vhost_vdpa *v, hwaddr iova,
> + hwaddr size)
> +{
> + struct vhost_msg_v2 msg;
> + int fd = v->device_fd;
> + int ret = 0;
> +
> + msg.type = v->msg_type;
> + msg.iotlb.iova = iova;
> + msg.iotlb.size = size;
> + msg.iotlb.type = VHOST_IOTLB_INVALIDATE;
> +
> + if (write(fd, &msg, sizeof(msg)) != sizeof(msg)) {
> + error_report("failed to write, fd=%d, errno=%d (%s)",
> + fd, errno, strerror(errno));
> + return -EIO ;
> + }
Same here (CID 1430270)
> +
> + return ret;
> +}
> +
thanks
-- PMM
