LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Juergen Gross <jgross@suse.com>
To: xen-devel@lists.xenproject.org, linux-block@vger.kernel.org,
	linux-kernel@vger.kernel.org
Cc: "Boris Ostrovsky" <boris.ostrovsky@oracle.com>,
	"Stefano Stabellini" <sstabellini@kernel.org>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
	"Roger Pau Monné" <roger.pau@citrix.com>,
	"Jens Axboe" <axboe@kernel.dk>
Subject: Re: [PATCH v2 3/3] xen/blkfront: don't trust the backend response data blindly
Date: Fri, 30 Jul 2021 12:08:43 +0200	[thread overview]
Message-ID: <9ef58781-bd7d-48bc-2b59-bb71d2ba83b8@suse.com> (raw)
In-Reply-To: <20210708124345.10173-4-jgross@suse.com>


[-- Attachment #1.1.1: Type: text/plain, Size: 7578 bytes --]

On 08.07.21 14:43, Juergen Gross wrote:
> Today blkfront will trust the backend to send only sane response data.
> In order to avoid privilege escalations or crashes in case of malicious
> backends verify the data to be within expected limits. Especially make
> sure that the response always references an outstanding request.
> 
> Introduce a new state of the ring BLKIF_STATE_ERROR which will be
> switched to in case an inconsistency is being detected. Recovering from
> this state is possible only via removing and adding the virtual device
> again (e.g. via a suspend/resume cycle).
> 
> Signed-off-by: Juergen Gross <jgross@suse.com>

Any comments for this patch?


Juergen

> ---
> V2:
> - use READ_ONCE() for reading the producer index
> - check validity of producer index only after memory barrier (Jan Beulich)
> - use virt_rmb() as barrier (Jan Beulich)
> ---
>   drivers/block/xen-blkfront.c | 66 ++++++++++++++++++++++++++----------
>   1 file changed, 49 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
> index 80701860870a..ecdbb0381b4c 100644
> --- a/drivers/block/xen-blkfront.c
> +++ b/drivers/block/xen-blkfront.c
> @@ -80,6 +80,7 @@ enum blkif_state {
>   	BLKIF_STATE_DISCONNECTED,
>   	BLKIF_STATE_CONNECTED,
>   	BLKIF_STATE_SUSPENDED,
> +	BLKIF_STATE_ERROR,
>   };
>   
>   struct grant {
> @@ -89,6 +90,7 @@ struct grant {
>   };
>   
>   enum blk_req_status {
> +	REQ_PROCESSING,
>   	REQ_WAITING,
>   	REQ_DONE,
>   	REQ_ERROR,
> @@ -543,7 +545,7 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo,
>   
>   	id = get_id_from_freelist(rinfo);
>   	rinfo->shadow[id].request = req;
> -	rinfo->shadow[id].status = REQ_WAITING;
> +	rinfo->shadow[id].status = REQ_PROCESSING;
>   	rinfo->shadow[id].associated_id = NO_ASSOCIATED_ID;
>   
>   	rinfo->shadow[id].req.u.rw.id = id;
> @@ -572,6 +574,7 @@ static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_inf
>   
>   	/* Copy the request to the ring page. */
>   	*final_ring_req = *ring_req;
> +	rinfo->shadow[id].status = REQ_WAITING;
>   
>   	return 0;
>   }
> @@ -847,8 +850,11 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
>   
>   	/* Copy request(s) to the ring page. */
>   	*final_ring_req = *ring_req;
> -	if (unlikely(require_extra_req))
> +	rinfo->shadow[id].status = REQ_WAITING;
> +	if (unlikely(require_extra_req)) {
>   		*final_extra_ring_req = *extra_ring_req;
> +		rinfo->shadow[extra_id].status = REQ_WAITING;
> +	}
>   
>   	if (new_persistent_gnts)
>   		gnttab_free_grant_references(setup.gref_head);
> @@ -1402,8 +1408,8 @@ static enum blk_req_status blkif_rsp_to_req_status(int rsp)
>   static int blkif_get_final_status(enum blk_req_status s1,
>   				  enum blk_req_status s2)
>   {
> -	BUG_ON(s1 == REQ_WAITING);
> -	BUG_ON(s2 == REQ_WAITING);
> +	BUG_ON(s1 < REQ_DONE);
> +	BUG_ON(s2 < REQ_DONE);
>   
>   	if (s1 == REQ_ERROR || s2 == REQ_ERROR)
>   		return BLKIF_RSP_ERROR;
> @@ -1436,7 +1442,7 @@ static bool blkif_completion(unsigned long *id,
>   		s->status = blkif_rsp_to_req_status(bret->status);
>   
>   		/* Wait the second response if not yet here. */
> -		if (s2->status == REQ_WAITING)
> +		if (s2->status < REQ_DONE)
>   			return false;
>   
>   		bret->status = blkif_get_final_status(s->status,
> @@ -1555,11 +1561,17 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   
>   	spin_lock_irqsave(&rinfo->ring_lock, flags);
>    again:
> -	rp = rinfo->ring.sring->rsp_prod;
> -	rmb(); /* Ensure we see queued responses up to 'rp'. */
> +	rp = READ_ONCE(rinfo->ring.sring->rsp_prod);
> +	virt_rmb(); /* Ensure we see queued responses up to 'rp'. */
> +	if (RING_RESPONSE_PROD_OVERFLOW(&rinfo->ring, rp)) {
> +		pr_alert("%s: illegal number of responses %u\n",
> +			 info->gd->disk_name, rp - rinfo->ring.rsp_cons);
> +		goto err;
> +	}
>   
>   	for (i = rinfo->ring.rsp_cons; i != rp; i++) {
>   		unsigned long id;
> +		unsigned int op;
>   
>   		RING_COPY_RESPONSE(&rinfo->ring, i, &bret);
>   		id = bret.id;
> @@ -1570,14 +1582,28 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   		 * look in get_id_from_freelist.
>   		 */
>   		if (id >= BLK_RING_SIZE(info)) {
> -			WARN(1, "%s: response to %s has incorrect id (%ld)\n",
> -			     info->gd->disk_name, op_name(bret.operation), id);
> -			/* We can't safely get the 'struct request' as
> -			 * the id is busted. */
> -			continue;
> +			pr_alert("%s: response has incorrect id (%ld)\n",
> +				 info->gd->disk_name, id);
> +			goto err;
>   		}
> +		if (rinfo->shadow[id].status != REQ_WAITING) {
> +			pr_alert("%s: response references no pending request\n",
> +				 info->gd->disk_name);
> +			goto err;
> +		}
> +
> +		rinfo->shadow[id].status = REQ_PROCESSING;
>   		req  = rinfo->shadow[id].request;
>   
> +		op = rinfo->shadow[id].req.operation;
> +		if (op == BLKIF_OP_INDIRECT)
> +			op = rinfo->shadow[id].req.u.indirect.indirect_op;
> +		if (bret.operation != op) {
> +			pr_alert("%s: response has wrong operation (%u instead of %u)\n",
> +				 info->gd->disk_name, bret.operation, op);
> +			goto err;
> +		}
> +
>   		if (bret.operation != BLKIF_OP_DISCARD) {
>   			/*
>   			 * We may need to wait for an extra response if the
> @@ -1602,7 +1628,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   		case BLKIF_OP_DISCARD:
>   			if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) {
>   				struct request_queue *rq = info->rq;
> -				printk(KERN_WARNING "blkfront: %s: %s op failed\n",
> +
> +				pr_warn_ratelimited("blkfront: %s: %s op failed\n",
>   					   info->gd->disk_name, op_name(bret.operation));
>   				blkif_req(req)->error = BLK_STS_NOTSUPP;
>   				info->feature_discard = 0;
> @@ -1614,13 +1641,13 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   		case BLKIF_OP_FLUSH_DISKCACHE:
>   		case BLKIF_OP_WRITE_BARRIER:
>   			if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) {
> -				printk(KERN_WARNING "blkfront: %s: %s op failed\n",
> +				pr_warn_ratelimited("blkfront: %s: %s op failed\n",
>   				       info->gd->disk_name, op_name(bret.operation));
>   				blkif_req(req)->error = BLK_STS_NOTSUPP;
>   			}
>   			if (unlikely(bret.status == BLKIF_RSP_ERROR &&
>   				     rinfo->shadow[id].req.u.rw.nr_segments == 0)) {
> -				printk(KERN_WARNING "blkfront: %s: empty %s op failed\n",
> +				pr_warn_ratelimited("blkfront: %s: empty %s op failed\n",
>   				       info->gd->disk_name, op_name(bret.operation));
>   				blkif_req(req)->error = BLK_STS_NOTSUPP;
>   			}
> @@ -1635,8 +1662,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   		case BLKIF_OP_READ:
>   		case BLKIF_OP_WRITE:
>   			if (unlikely(bret.status != BLKIF_RSP_OKAY))
> -				dev_dbg(&info->xbdev->dev, "Bad return from blkdev data "
> -					"request: %x\n", bret.status);
> +				dev_dbg_ratelimited(&info->xbdev->dev,
> +					"Bad return from blkdev data request: %x\n", bret.status);
>   
>   			break;
>   		default:
> @@ -1662,6 +1689,11 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
>   	spin_unlock_irqrestore(&rinfo->ring_lock, flags);
>   
>   	return IRQ_HANDLED;
> +
> + err:
> +	info->connected = BLKIF_STATE_ERROR;
> +	pr_alert("%s disabled for further use\n", info->gd->disk_name);
> +	return IRQ_HANDLED;
>   }
>   
>   
> 


[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3135 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

  parent reply	other threads:[~2021-07-30 10:08 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-08 12:43 [PATCH v2 0/3] xen: harden blkfront against malicious backends Juergen Gross
2021-07-08 12:43 ` [PATCH v2 1/3] xen/blkfront: read response from backend only once Juergen Gross
2021-07-09  8:33   ` Roger Pau Monné
2021-07-08 12:43 ` [PATCH v2 2/3] xen/blkfront: don't take local copy of a request from the ring page Juergen Gross
2021-07-09  8:55   ` Roger Pau Monné
2021-07-09 13:54     ` Juergen Gross
2021-07-08 12:43 ` [PATCH v2 3/3] xen/blkfront: don't trust the backend response data blindly Juergen Gross
2021-07-08 13:11   ` Jan Beulich
2021-07-08 13:14     ` Juergen Gross
2021-07-09  9:42   ` Roger Pau Monné
2021-07-09 13:58     ` Juergen Gross
2021-07-09 11:09   ` kernel test robot
2021-07-30 10:08   ` Juergen Gross [this message]
2021-07-30 10:31     ` Juergen Gross
2021-07-08 14:22 ` [PATCH v2 0/3] xen: harden blkfront against malicious backends Konrad Rzeszutek Wilk
2021-07-08 14:39   ` Juergen Gross
2021-07-10  1:18     ` Marek Marczykowski-Górecki

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=9ef58781-bd7d-48bc-2b59-bb71d2ba83b8@suse.com \
    --to=jgross@suse.com \
    --cc=axboe@kernel.dk \
    --cc=boris.ostrovsky@oracle.com \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=roger.pau@citrix.com \
    --cc=sstabellini@kernel.org \
    --cc=xen-devel@lists.xenproject.org \
    --subject='Re: [PATCH v2 3/3] xen/blkfront: don'\''t trust the backend response data blindly' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).