linux-kernel - RE: [PATCH net-next 1/1] hv_netvsc: Check status in SEND_RNDIS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 9 Feb 2023 22:09:33 +0000
From:   "Michael Kelley (LINUX)" <mikelley@...rosoft.com>
To:     Jakub Kicinski <kuba@...nel.org>,
        Haiyang Zhang <haiyangz@...rosoft.com>
CC:     KY Srinivasan <kys@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Dexuan Cui <decui@...rosoft.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH net-next 1/1] hv_netvsc: Check status in SEND_RNDIS_PKT
 completion message

From: Jakub Kicinski <kuba@...nel.org> Sent: Thursday, February 9, 2023 12:22 PM
> 
> On Thu, 9 Feb 2023 19:10:16 +0000 Haiyang Zhang wrote:
> > But I'm just worried about if a VM sending at high speed, and host side is,
> > for some reason, not able to send them correctly, the log file will become
> > really big and difficult to download and read. With rate limit, we still see
> > dozens of messages every 5 seconds or so, and it tells you how many
> > messages are skipped. And, if the rate is lower, it won't skip anything.
> > Isn't this info sufficient to debug?

Agreed.

> >
> > By the way, guests cannot trust the host -- probably we shouldn't allow the
> > host to have a way to jam guest's log file?

Actually, preventing jamming the guest's log file is not a requirement
in Confidential VMs where the host is not trusted.  Confidential VMs
do not prevent denial-of-service attacks, or similar.  But that's another
topic. :-)

> 
> +1 FWIW, the general guidance is to always rate limit prints
> which may be triggered from the datapath (which I'm guessing
> this is based on the names of things)

Fair enough.  I'll do a v2 with the rate limiting.

Michael