netdev - RE: [PATCH net 2/5] hv_netvsc: Use vmbus_sendpacket_mpb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <SN6PR02MB4157C9EC51BEC1EBCB2B7DC5D491A@SN6PR02MB4157.namprd02.prod.outlook.com>
Date: Wed, 14 May 2025 15:44:35 +0000
From: Michael Kelley <mhklinux@...look.com>
To: Simon Horman <horms@...nel.org>
CC: "kys@...rosoft.com" <kys@...rosoft.com>, "haiyangz@...rosoft.com"
	<haiyangz@...rosoft.com>, "wei.liu@...nel.org" <wei.liu@...nel.org>,
	"decui@...rosoft.com" <decui@...rosoft.com>, "andrew+netdev@...n.ch"
	<andrew+netdev@...n.ch>, "davem@...emloft.net" <davem@...emloft.net>,
	"edumazet@...gle.com" <edumazet@...gle.com>, "kuba@...nel.org"
	<kuba@...nel.org>, "pabeni@...hat.com" <pabeni@...hat.com>,
	"James.Bottomley@...senpartnership.com"
	<James.Bottomley@...senpartnership.com>, "martin.petersen@...cle.com"
	<martin.petersen@...cle.com>, "linux-hyperv@...r.kernel.org"
	<linux-hyperv@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "linux-scsi@...r.kernel.org"
	<linux-scsi@...r.kernel.org>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH net 2/5] hv_netvsc: Use vmbus_sendpacket_mpb_desc() to
 send VMBus messages

From: Simon Horman <horms@...nel.org> Sent: Wednesday, May 14, 2025 2:38 AM
> 
> On Mon, May 12, 2025 at 05:06:01PM -0700, mhkelley58@...il.com wrote:
> > From: Michael Kelley <mhklinux@...look.com>
> >
> > netvsc currently uses vmbus_sendpacket_pagebuffer() to send VMBus
> > messages. This function creates a series of GPA ranges, each of which
> > contains a single PFN. However, if the rndis header in the VMBus
> > message crosses a page boundary, the netvsc protocol with the host
> > requires that both PFNs for the rndis header must be in a single "GPA
> > range" data structure, which isn't possible with
> > vmbus_sendpacket_pagebuffer(). As the first step in fixing this, add a
> > new function netvsc_build_mpb_array() to build a VMBus message with
> > multiple GPA ranges, each of which may contain multiple PFNs. Use
> > vmbus_sendpacket_mpb_desc() to send this VMBus message to the host.
> >
> > There's no functional change since higher levels of netvsc don't
> > maintain or propagate knowledge of contiguous PFNs. Based on its
> > input, netvsc_build_mpb_array() still produces a separate GPA range
> > for each PFN and the behavior is the same as with
> > vmbus_sendpacket_pagebuffer(). But the groundwork is laid for a
> > subsequent patch to provide the necessary grouping.
> >
> > Cc: <stable@...r.kernel.org> # 6.1.x
> > Signed-off-by: Michael Kelley <mhklinux@...look.com>
> > ---
> >  drivers/net/hyperv/netvsc.c | 50 +++++++++++++++++++++++++++++++++----
> >  1 file changed, 45 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
> > index d6f5b9ea3109..6d1705f87682 100644
> > --- a/drivers/net/hyperv/netvsc.c
> > +++ b/drivers/net/hyperv/netvsc.c
> > @@ -1055,6 +1055,42 @@ static int netvsc_dma_map(struct hv_device *hv_dev,
> >  	return 0;
> >  }
> >
> > +/* Build an "array" of mpb entries describing the data to be transferred
> > + * over VMBus. After the desc header fields, each "array" entry is variable
> > + * size, and each entry starts after the end of the previous entry. The
> > + * "offset" and "len" fields for each entry imply the size of the entry.
> > + *
> > + * The pfns are in HV_HYP_PAGE_SIZE, because all communication with Hyper-V
> > + * uses that granularity, even if the system page size of the guest is larger.
> > + * Each entry in the input "pb" array must describe a contiguous range of
> > + * guest physical memory so that the pfns are sequential if the range crosses
> > + * a page boundary. The offset field must be < HV_HYP_PAGE_SIZE.
> 
> Hi Michael,
> 
> Is there a guarantee that this constraint is met. And moreover, is there a
> guarantee that all of the entries will fit in desc? I am slightly concerned
> that there may be an overrun lurking here.
> 

It is indeed up to the caller to ensure that the pb array is properly
constructed. netvsc_build_mpb_array() doesn't do additional validation.
There are only two sources of the pb array, both of which do the right
thing, so additional validation seemed redundant.

An overrun is a concern, but again the callers do the right thing. As
described in my response to Patch 3 of the series, netvsc_xmit()
counts the number of pages ahead of time, and makes sure the count is
within the limit of the amount space allocated in the "desc" argument
to netvsc_build_mpb_array().

Michael