From 925b94aa3c91970cdb6c059191f95f7079f69b27 Mon Sep 17 00:00:00 2001
From: Dave Barach <dave@barachs.net>
Date: Wed, 9 Oct 2019 12:57:13 -0400
Subject: vppinfra: fix page boundary crossing bug in hash_memory64

Fix a day-1 bug, possibly dating back as far as 2002. The zap64() game
involves fetching 8 byte chunks, and clearing octets not to be
included in the key.

That's fine *unless* the 8-byte fetch happens to cross a page boundary
into unmapped or no-access space.

Type: fix

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: I4607e9840032257c96ba7387f86c931c0921749d
(cherry picked from commit 7e2cea3d26701ff1d80fda7d8ca907890e3e7baa)
---
 src/plugins/unittest/util_test.c | 62 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

(limited to 'src/plugins')

diff --git a/src/plugins/unittest/util_test.c b/src/plugins/unittest/util_test.c
index d2f2715d763..67fe0093ab8 100644
--- a/src/plugins/unittest/util_test.c
+++ b/src/plugins/unittest/util_test.c
@@ -14,6 +14,7 @@
  */
 
 #include <vlib/vlib.h>
+#include <sys/mman.h>
 
 static clib_error_t *
 test_crash_command_fn (vlib_main_t * vm,
@@ -45,6 +46,67 @@ VLIB_CLI_COMMAND (test_crash_command, static) =
 };
 /* *INDENT-ON* */
 
+static clib_error_t *
+test_hash_command_fn (vlib_main_t * vm,
+		      unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  uword hash1, hash2;
+  u8 *baseaddr;
+  u8 *key_loc;
+
+  baseaddr = mmap (NULL, 8192, PROT_READ | PROT_WRITE,
+		   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0 /* offset */ );
+
+  if (baseaddr == 0)
+    {
+      clib_unix_warning ("mmap");
+      return 0;
+    }
+
+  if (mprotect (baseaddr + (4 << 10), (4 << 10), PROT_NONE) < 0)
+    {
+      clib_unix_warning ("mprotect");
+      return 0;
+    }
+
+  key_loc = baseaddr + (4 << 10) - 4;
+  key_loc[0] = 0xde;
+  key_loc[1] = 0xad;
+  key_loc[2] = 0xbe;
+  key_loc[3] = 0xef;
+
+  hash1 = hash_memory (key_loc, 4, 0ULL);
+
+  vlib_cli_output (vm, "hash1 is %llx", hash1);
+
+  key_loc = baseaddr;
+
+  key_loc[0] = 0xde;
+  key_loc[1] = 0xad;
+  key_loc[2] = 0xbe;
+  key_loc[3] = 0xef;
+
+  hash2 = hash_memory (key_loc, 4, 0ULL);
+
+  vlib_cli_output (vm, "hash2 is %llx", hash2);
+
+  if (hash1 == hash2)
+    vlib_cli_output (vm, "PASS...");
+  else
+    vlib_cli_output (vm, "FAIL...");
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_hash_command, static) =
+{
+  .path = "test hash_memory",
+  .short_help = "page boundary crossing test",
+  .function = test_hash_command_fn,
+};
+/* *INDENT-ON* */
+
 /*
  * fd.io coding-style-patch-verification: ON
  *
-- 
cgit 1.2.3-korg