linux-kernel - Re: [PATCH] swiotlb: Validate bounce size in the sync/unmap path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YAV0uhfkimXn1izW@martin>
Date:   Mon, 18 Jan 2021 12:44:58 +0100
From:   Martin Radev <martin.b.radev@...il.com>
To:     Christoph Hellwig <hch@....de>
Cc:     konrad.wilk@...cle.com, m.szyprowski@...sung.com,
        robin.murphy@....com, iommu@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org, joro@...tes.org,
        kirill.shutemov@...ux.intel.com, thomas.lendacky@....com,
        robert.buhren@...t.tu-berlin.de, file@...t.tu-berlin.de,
        mathias.morbitzer@...ec.fraunhofer.de,
        virtualization@...ts.linux-foundation.org, kvm@...r.kernel.org
Subject: Re: [PATCH] swiotlb: Validate bounce size in the sync/unmap path

On Wed, Jan 13, 2021 at 12:30:17PM +0100, Christoph Hellwig wrote:
> On Tue, Jan 12, 2021 at 04:07:29PM +0100, Martin Radev wrote:
> > The size of the buffer being bounced is not checked if it happens
> > to be larger than the size of the mapped buffer. Because the size
> > can be controlled by a device, as it's the case with virtio devices,
> > this can lead to memory corruption.
> > 
> 
> I'm really worried about all these hodge podge hacks for not trusted
> hypervisors in the I/O stack.  Instead of trying to harden protocols
> that are fundamentally not designed for this, how about instead coming
> up with a new paravirtualized I/O interface that is specifically
> designed for use with an untrusted hypervisor from the start?

Your comment makes sense but then that would require the cooperation
of these vendors and the cloud providers to agree on something meaningful.
I am also not sure whether the end result would be better than hardening
this interface to catch corruption. There is already some validation in
unmap path anyway.

Another possibility is to move this hardening to the common virtio code,
but I think the code may become more complicated there since it would
require tracking both the dma_addr and length for each descriptor.