Author: Stefan Hajnoczi <stefanha@redhat.com>
Description: vhost: reject invalid log base mmap offset
 If the log base mmap_offset is larger than mmap_size then it points
 outside the mmap region.  We must not write to memory outside the mmap
 region, so validate mmap_offset in vhost_user_set_log_base().
Upstream: yes
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -929,6 +929,15 @@
 
 	size = msg->payload.log.mmap_size;
 	off  = msg->payload.log.mmap_offset;
+
+	/* Don't allow mmap_offset to point outside the mmap region */
+	if (off > size) {
+		RTE_LOG(ERR, VHOST_CONFIG,
+			"log offset %#"PRIx64" exceeds log size %#"PRIx64"\n",
+			off, size);
+		return -1;
+	}
+
 	RTE_LOG(INFO, VHOST_CONFIG,
 		"log mmap size: %"PRId64", offset: %"PRId64"\n",
 		size, off);