lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 5 Oct 2021 03:42:29 -0400
From:   "Michael S. Tsirkin" <mst@...hat.com>
To:     Jason Wang <jasowang@...hat.com>
Cc:     virtualization@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org, f.hetzelt@...berlin.de,
        david.kaplan@....com, konrad.wilk@...cle.com
Subject: Re: [PATCH 0/9] More virtio hardening

On Mon, Sep 13, 2021 at 01:53:44PM +0800, Jason Wang wrote:
> Hi All:
> 
> This series treis to do more hardening for virito.
> 
> patch 1 validates the num_queues for virio-blk device.
> patch 2-4 validates max_nr_ports for virito-console device.
> patch 5-7 harden virtio-pci interrupts to make sure no exepcted
> interrupt handler is tiggered. If this makes sense we can do similar
> things in other transport drivers.
> patch 8-9 validate used ring length.
> 
> Smoking test on blk/net with packed=on/off and iommu_platform=on/off.
> 
> Please review.
> 
> Thanks

So I poked at console at least, and I think I see
an issue: if interrupt handler queues a work/bh,
then it can still run while reset is in progress.

I sent a patch to fix it for console removal specifically,
but I suspect it's not enough e.g. freeze is still broken.
And note this has been reported without any TDX things -
it's not a malicious device issue, can be triggered just
by module unload.

I am vaguely thinking about new APIs to disable/enable callbacks.
An alternative:

1. adding new remove_nocb/freeze_nocb calls
2. disabling/enabling interrupts automatically around these
3. gradually moving devices to using these
4. once/if all device move, removing the old callbacks

the advantage here is that we'll be sure calls are always
paired correctly.





> Jason Wang (9):
>   virtio-blk: validate num_queues during probe
>   virtio: add doc for validate() method
>   virtio-console: switch to use .validate()
>   virtio_console: validate max_nr_ports before trying to use it
>   virtio_config: introduce a new ready method
>   virtio_pci: harden MSI-X interrupts
>   virtio-pci: harden INTX interrupts
>   virtio_ring: fix typos in vring_desc_extra
>   virtio_ring: validate used buffer length
> 
>  drivers/block/virtio_blk.c         |  3 +-
>  drivers/char/virtio_console.c      | 51 +++++++++++++++++++++---------
>  drivers/virtio/virtio_pci_common.c | 43 +++++++++++++++++++++----
>  drivers/virtio/virtio_pci_common.h |  7 ++--
>  drivers/virtio/virtio_pci_legacy.c |  5 +--
>  drivers/virtio/virtio_pci_modern.c |  6 ++--
>  drivers/virtio/virtio_ring.c       | 27 ++++++++++++++--
>  include/linux/virtio.h             |  1 +
>  include/linux/virtio_config.h      |  6 ++++
>  9 files changed, 118 insertions(+), 31 deletions(-)
> 
> -- 
> 2.25.1

Powered by blists - more mailing lists