linux-kernel - Re: [Qemu-devel] security implications of caching with virtio pmem (was Re: [PATCH v3 0/5] kvm "virtio pmem" device)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 11 Feb 2019 18:07:02 -0500
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     David Hildenbrand <david@...hat.com>
Cc:     Dave Chinner <david@...morbit.com>,
        Pankaj Gupta <pagupta@...hat.com>, dchinner@...hat.com,
        jack@...e.cz, kvm@...r.kernel.org, linux-nvdimm@...1.01.org,
        jasowang@...hat.com, qemu-devel@...gnu.org,
        virtualization@...ts.linux-foundation.org,
        adilger kernel <adilger.kernel@...ger.ca>, zwisler@...nel.org,
        Andrea Arcangeli <aarcange@...hat.com>,
        dave jiang <dave.jiang@...el.com>,
        darrick wong <darrick.wong@...cle.com>,
        vishal l verma <vishal.l.verma@...el.com>,
        willy@...radead.org, hch@...radead.org, linux-acpi@...r.kernel.org,
        jmoyer@...hat.com, nilal@...hat.com, riel@...riel.com,
        stefanha@...hat.com, imammedo@...hat.com,
        dan j williams <dan.j.williams@...el.com>,
        lcapitulino@...hat.com, kwolf@...hat.com,
        linux-ext4@...r.kernel.org, tytso@....edu,
        xiaoguangrong eric <xiaoguangrong.eric@...il.com>,
        rjw@...ysocki.net, linux-kernel@...r.kernel.org,
        linux-xfs@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        pbonzini@...hat.com
Subject: Re: [Qemu-devel] security implications of caching with virtio pmem
 (was Re: [PATCH v3 0/5] kvm "virtio pmem" device)

On Mon, Feb 11, 2019 at 11:58:15PM +0100, David Hildenbrand wrote:
> On 11.02.19 23:29, Dave Chinner wrote:
> > On Mon, Feb 11, 2019 at 02:29:46AM -0500, Pankaj Gupta wrote:
> >> Hello Dave,
> >> Are we okay with this?
> > 
> > Sure.
> > 
> > I'm not sure I agree with all the analysis presented, but, well, I
> > haven't looked any deeper because I'm tired of being shouted at and
> > being called argumentative for daring to ask hard questions about
> > this topic....
> 
> I think if you have concerns, they should definitely be discussed.
> Making people frustrated that review code is not what we want. Not at all.
> 
> I suggest that Pankaj properly documents what we found out so far about
> security concerns and properly describes intended use cases and answers
> other questions you had in the cover letter / documentation of the
> follow up series.
> 
> Thanks Dave!

Right. Also, there's an open question that you posed:
	Also other storage devices have caches like that (well, the caches size
	depends on the device) - thinking especially about storage systems -
	which would in my opinion, also allow similar leaks. How are such
	security concerns handled there? Are they different (besides eventually
	access speed)?
and that needs some looking into, and reporting on.


> > 
> > Cheers,
> > 
> > Dave.
> > 
> 
> 
> -- 
> 
> Thanks,
> 
> David / dhildenb