linux-kernel - Re: [PATCH v3 5/5] RFC: fw_cfg: add DMA write operation in sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Oct 2017 18:19:21 +0200
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     "Hatayama, Daisuke" <d.hatayama@...fujitsu.com>
Cc:     "'marcandre.lureau@...hat.com'" <marcandre.lureau@...hat.com>,
        "'somlo@....edu'" <somlo@....edu>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "'qemu-devel@...gnu.org'" <qemu-devel@...gnu.org>
Subject: Re: [PATCH v3 5/5] RFC: fw_cfg: add DMA write operation in sysfs

On Mon, Oct 30, 2017 at 11:07:20AM +0000, Hatayama, Daisuke wrote:
> > From: Marc-André Lureau <marcandre.lureau@...hat.com>
> >
> > Since qemu 2.9, DMA write operations are allowed. However, usage of this
> > interface from kernel or user-space is strongly discouraged by the
> > maintainers. This patch is meant for experimentations for now.
> >
> 
> Could you (or maintainers?) tell me how experimental the DMA write
> operations from kernel are?
> 
> From some technical reason?
> Or simply there has not been enough test yet so far?

The concern is security, talking from userspace to hypervisor
might become a trivial DOS vector.

If there's need for a specific entry to be accessible from userspace,
I'd rather white-list it.

> > Signed-off-by: Marc-André Lureau <marcandre.lureau@...hat.com>
> > ---
> >  drivers/firmware/qemu_fw_cfg.c | 21 ++++++++++++++++++++-
> >  1 file changed, 20 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
> > index 54b569da3257..e2f2ad1c9c0c 100644
> > --- a/drivers/firmware/qemu_fw_cfg.c
> > +++ b/drivers/firmware/qemu_fw_cfg.c
> > @@ -524,9 +524,28 @@ static ssize_t fw_cfg_sysfs_read_raw(struct file *filp, struct kobject *kobj,
> >       return fw_cfg_read_blob(entry->f.select, buf, pos, count, true);
> >  }
> >
> > +static ssize_t fw_cfg_sysfs_write_raw(struct file *filp, struct kobject *kobj,
> > +                                   struct bin_attribute *bin_attr,
> > +                                   char *buf, loff_t pos, size_t count)
> > +{
> > +     struct fw_cfg_sysfs_entry *entry = to_entry(kobj);
> > +
> > +     if (!fw_cfg_dma_enabled())
> > +             return -ENOTSUPP;
> > +
> > +     if (pos > entry->f.size)
> > +             return -EINVAL;
> > +
> > +     if (count > entry->f.size - pos)
> > +             count = entry->f.size - pos;
> > +
> > +     return fw_cfg_write_blob(entry->f.select, buf, pos, count);
> > +}
> > +
> >  static struct bin_attribute fw_cfg_sysfs_attr_raw = {
> > -     .attr = { .name = "raw", .mode = S_IRUSR },
> > +     .attr = { .name = "raw", .mode = S_IRUSR | S_IWUSR },
> >       .read = fw_cfg_sysfs_read_raw,
> > +     .write = fw_cfg_sysfs_write_raw,
> >  };
> >
> >  /*
> > --
> > 2.14.1.146.gd35faa819
> 
> Thanks.
> HATAYAMA, Daisuke
>