lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 18 Feb 2019 16:04:14 +0800
From:   Dongli Zhang <>
To:     Konrad Rzeszutek Wilk <>,
Cc:     Roger Pau Monné <>,,,,,
Subject: Re: [Xen-devel] [PATCH v6 2/2] xen/blkback: rework connect_ring() to
 avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront

Hi Konrad,

On 1/17/19 11:29 PM, Konrad Rzeszutek Wilk wrote:
> On Tue, Jan 15, 2019 at 09:20:36AM +0100, Roger Pau Monné wrote:
>> On Tue, Jan 15, 2019 at 12:41:44AM +0800, Dongli Zhang wrote:
>>> The xenstore 'ring-page-order' is used globally for each blkback queue and
>>> therefore should be read from xenstore only once. However, it is obtained
>>> in read_per_ring_refs() which might be called multiple times during the
>>> initialization of each blkback queue.
>>> If the blkfront is malicious and the 'ring-page-order' is set in different
>>> value by blkfront every time before blkback reads it, this may end up at
>>> the "WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));" in
>>> xen_blkif_disconnect() when frontend is destroyed.
>>> This patch reworks connect_ring() to read xenstore 'ring-page-order' only
>>> once.
>>> Signed-off-by: Dongli Zhang <>
>> LGTM:
>> Reviewed-by: Roger Pau Monné <>
> Applied.
> Will push out to Jens in a couple of days. Thank you!
>> Thanks!

I only see the PATCH 1/2 (xen/blkback: add stack variable 'blkif' in
connect_ring()) on the top of below branch for Jens, would you please apply this
one (PATCH 2/2) as well?

1/2 is only a prerequisite for 2/2.

Thank you very much!

Dongli Zhang

Powered by blists - more mailing lists