linux-kernel - Re: [PATCH v2] xen-blkback: fix compatibility bug with single page rings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7fb64e2f-141a-c848-0f8a-2313d2e821b6@suse.com>
Date:   Fri, 29 Jan 2021 08:35:06 +0100
From:   Jürgen Groß <jgross@...e.com>
To:     Dongli Zhang <dongli.zhang@...cle.com>,
        Paul Durrant <paul@....org>, xen-devel@...ts.xenproject.org,
        linux-block@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Paul Durrant <pdurrant@...zon.com>,
        Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
        Roger Pau Monné <roger.pau@...rix.com>,
        Jens Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v2] xen-blkback: fix compatibility bug with single page
 rings

On 29.01.21 07:20, Dongli Zhang wrote:
> 
> 
> On 1/28/21 5:04 AM, Paul Durrant wrote:
>> From: Paul Durrant <pdurrant@...zon.com>
>>
>> Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid
>> inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the
>> behaviour of xen-blkback when connecting to a frontend was:
>>
>> - read 'ring-page-order'
>> - if not present then expect a single page ring specified by 'ring-ref'
>> - else expect a ring specified by 'ring-refX' where X is between 0 and
>>    1 << ring-page-order
>>
>> This was correct behaviour, but was broken by the afforementioned commit to
>> become:
>>
>> - read 'ring-page-order'
>> - if not present then expect a single page ring (i.e. ring-page-order = 0)
>> - expect a ring specified by 'ring-refX' where X is between 0 and
>>    1 << ring-page-order
>> - if that didn't work then see if there's a single page ring specified by
>>    'ring-ref'
>>
>> This incorrect behaviour works most of the time but fails when a frontend
>> that sets 'ring-page-order' is unloaded and replaced by one that does not
>> because, instead of reading 'ring-ref', xen-blkback will read the stale
>> 'ring-ref0' left around by the previous frontend will try to map the wrong
>> grant reference.
>>
>> This patch restores the original behaviour.
>>
>> Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront")
>> Signed-off-by: Paul Durrant <pdurrant@...zon.com>
>> ---
>> Cc: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
>> Cc: "Roger Pau Monné" <roger.pau@...rix.com>
>> Cc: Jens Axboe <axboe@...nel.dk>
>> Cc: Dongli Zhang <dongli.zhang@...cle.com>
>>
>> v2:
>>   - Remove now-spurious error path special-case when nr_grefs == 1
>> ---
>>   drivers/block/xen-blkback/common.h |  1 +
>>   drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++-----------------
>>   2 files changed, 17 insertions(+), 22 deletions(-)
>>
>> diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
>> index b0c71d3a81a0..524a79f10de6 100644
>> --- a/drivers/block/xen-blkback/common.h
>> +++ b/drivers/block/xen-blkback/common.h
>> @@ -313,6 +313,7 @@ struct xen_blkif {
>>   
>>   	struct work_struct	free_work;
>>   	unsigned int 		nr_ring_pages;
>> +	bool                    multi_ref;
> 
> Is it really necessary to introduce 'multi_ref' here or we may just re-use
> 'nr_ring_pages'?
> 
> According to blkfront code, 'ring-page-order' is set only when it is not zero,
> that is, only when (info->nr_ring_pages > 1).

Did you look into all other OS's (Windows, OpenBSD, FreebSD, NetBSD,
Solaris, Netware, other proprietary systems) implementations to verify
that claim?

I don't think so. So better safe than sorry.


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3092 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)