linux-kernel - Re: [Xen-devel] [PATCH v6 2/2] xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190117152919.GA26079@localhost.localdomain>
Date:   Thu, 17 Jan 2019 10:29:23 -0500
From:   Konrad Rzeszutek Wilk <konrad@...nok.org>
To:     Roger Pau Monné <roger.pau@...rix.com>
Cc:     Dongli Zhang <dongli.zhang@...cle.com>,
        xen-devel@...ts.xenproject.org, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, axboe@...nel.dk,
        Paul.Durrant@...rix.com, konrad.wilk@...cle.com
Subject: Re: [Xen-devel] [PATCH v6 2/2] xen/blkback: rework connect_ring() to
 avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront

On Tue, Jan 15, 2019 at 09:20:36AM +0100, Roger Pau Monné wrote:
> On Tue, Jan 15, 2019 at 12:41:44AM +0800, Dongli Zhang wrote:
> > The xenstore 'ring-page-order' is used globally for each blkback queue and
> > therefore should be read from xenstore only once. However, it is obtained
> > in read_per_ring_refs() which might be called multiple times during the
> > initialization of each blkback queue.
> > 
> > If the blkfront is malicious and the 'ring-page-order' is set in different
> > value by blkfront every time before blkback reads it, this may end up at
> > the "WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));" in
> > xen_blkif_disconnect() when frontend is destroyed.
> > 
> > This patch reworks connect_ring() to read xenstore 'ring-page-order' only
> > once.
> > 
> > Signed-off-by: Dongli Zhang <dongli.zhang@...cle.com>
> 
> LGTM:
> 
> Reviewed-by: Roger Pau Monné <roger.pau@...rix.com>

Applied.

Will push out to Jens in a couple of days. Thank you!
> 
> Thanks!