linux-kernel - Re: [PATCH 0/9] More virtio hardening

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Oct 2021 15:36:51 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     "Michael S. Tsirkin" <mst@...hat.com>
Cc:     virtualization <virtualization@...ts.linux-foundation.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        "Hetzelt, Felicitas" <f.hetzelt@...berlin.de>,
        "kaplan, david" <david.kaplan@....com>,
        Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Subject: Re: [PATCH 0/9] More virtio hardening

On Tue, Oct 5, 2021 at 3:42 PM Michael S. Tsirkin <mst@...hat.com> wrote:
>
> On Mon, Sep 13, 2021 at 01:53:44PM +0800, Jason Wang wrote:
> > Hi All:
> >
> > This series treis to do more hardening for virito.
> >
> > patch 1 validates the num_queues for virio-blk device.
> > patch 2-4 validates max_nr_ports for virito-console device.
> > patch 5-7 harden virtio-pci interrupts to make sure no exepcted
> > interrupt handler is tiggered. If this makes sense we can do similar
> > things in other transport drivers.
> > patch 8-9 validate used ring length.
> >
> > Smoking test on blk/net with packed=on/off and iommu_platform=on/off.
> >
> > Please review.
> >
> > Thanks
>
> So I poked at console at least, and I think I see
> an issue: if interrupt handler queues a work/bh,
> then it can still run while reset is in progress.

Looks like a bug which is unrelated to the hardening? E.g the driver
should sync with work/bh before reset.

>
> I sent a patch to fix it for console removal specifically,
> but I suspect it's not enough e.g. freeze is still broken.
> And note this has been reported without any TDX things -
> it's not a malicious device issue, can be triggered just
> by module unload.
>
> I am vaguely thinking about new APIs to disable/enable callbacks.
> An alternative:
>
> 1. adding new remove_nocb/freeze_nocb calls
> 2. disabling/enabling interrupts automatically around these
> 3. gradually moving devices to using these
> 4. once/if all device move, removing the old callbacks
>
> the advantage here is that we'll be sure calls are always
> paired correctly.

I'm not sure I get the idea, but my feeling is that it doesn't
conflict with the interrupt hardening here (or at least the same
method is required e.g NO_AUTO_EN).

Thanks

>
>
>
>
>
> > Jason Wang (9):
> >   virtio-blk: validate num_queues during probe
> >   virtio: add doc for validate() method
> >   virtio-console: switch to use .validate()
> >   virtio_console: validate max_nr_ports before trying to use it
> >   virtio_config: introduce a new ready method
> >   virtio_pci: harden MSI-X interrupts
> >   virtio-pci: harden INTX interrupts
> >   virtio_ring: fix typos in vring_desc_extra
> >   virtio_ring: validate used buffer length
> >
> >  drivers/block/virtio_blk.c         |  3 +-
> >  drivers/char/virtio_console.c      | 51 +++++++++++++++++++++---------
> >  drivers/virtio/virtio_pci_common.c | 43 +++++++++++++++++++++----
> >  drivers/virtio/virtio_pci_common.h |  7 ++--
> >  drivers/virtio/virtio_pci_legacy.c |  5 +--
> >  drivers/virtio/virtio_pci_modern.c |  6 ++--
> >  drivers/virtio/virtio_ring.c       | 27 ++++++++++++++--
> >  include/linux/virtio.h             |  1 +
> >  include/linux/virtio_config.h      |  6 ++++
> >  9 files changed, 118 insertions(+), 31 deletions(-)
> >
> > --
> > 2.25.1
>