linux-kernel - Re: [patch v8 3/7] nbd: check sock index in nbd_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Sep 2021 07:12:01 -0500
From:   Eric Blake <eblake@...hat.com>
To:     Ming Lei <ming.lei@...hat.com>
Cc:     "yukuai (C)" <yukuai3@...wei.com>, josef@...icpanda.com,
        axboe@...nel.dk, hch@...radead.org, linux-block@...r.kernel.org,
        nbd@...er.debian.org, linux-kernel@...r.kernel.org,
        yi.zhang@...wei.com
Subject: Re: [patch v8 3/7] nbd: check sock index in nbd_read_stat()

On Wed, Sep 22, 2021 at 05:22:07PM +0800, Ming Lei wrote:
> 
> I think this one relies on nbd protocol between server and client, and
> does the protocol require both request and reply xmitted via same
> socket?

Yes, a reply must be transmitted on the same socket as the request
came over.  This is because independent sockets are not required to
use distinct 64-bit handles, and there is no way for a server to tell
if independent clients are related to one another; sending a reply on
the wrong socket is thus not guaranteed to reach the intended client.
Thus, a compliant server will never send a reply over a different
socket than the original request, and if a client ever gets a reply
with a handle it was not expecting, then the server is buggy or
malicious.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org