答复: [PATCH] USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci

[TimGuo-oc <TimGuo-oc@zhaoxin.com>]

> -----Original Mail-----
> Sender : Alan Stern <stern@rowland.harvard.edu>
> Time : 2020/7/24  0:39
> Receiver : Alex Williamson <alex.williamson@redhat.com>
> CC : Weitao Wang(BJ-RD) <WeitaoWang@zhaoxin.com>; Greg KH
> <gregkh@linuxfoundation.org>; WeitaoWang-oc
> <WeitaoWang-oc@zhaoxin.com>; mathias.nyman@linux.intel.com;
> ulf.hansson@linaro.org; vkoul@kernel.org; hslester96@gmail.com;
> linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org;
> Carsten_Schmid@mentor.com; efremov@linux.com; Tony W. Wang(XA-RD)
> <TonyWWang@zhaoxin.com>; Cobe Chen(BJ-RD) <CobeChen@zhaoxin.com>;
> Tim Guo(BJ-RD) <TimGuo@zhaoxin.com>; wwt8723@163.com
> Subject : Re: [PATCH] USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci
> 
> On Thu, Jul 23, 2020 at 10:17:35AM -0600, Alex Williamson wrote:
> > The IOMMU grouping restriction does solve the hardware issue, so long
> > as one driver doesn't blindly assume the driver private data for
> > another device and modify it.
> 
> Correction: The IOMMU grouping restriction solves the hardware issue for
> vfio-pci.  It won't necessarily help if some other driver comes along and wants
> to bind to this hardware.
> 
> >   I do agree that your solution would
> > work, requiring all devices are unbound before any can be bound, but
> > it also seems difficult to manage.  The issue is largely unique to USB
> > AFAIK.  On the other hand, drivers coordinating with each other to
> > register their _private_ data as share-able within a set of drivers
> > seems like a much more direct and explicit interaction between the
> > drivers.  Thanks,
> 
> Yes, that makes sense.  But it would have to be implemented in the driver core,
> not in particular subsystems like USB or PCI.  And it might be seen as overkill,
> given that only UHCI/OHCI/EHCI devices require this sort of sharing AFAIK.
> 
> Also, when you think about it, what form would such coordination among drivers
> take?  From your description, it sounds like the drivers would agree to avoid
> accessing each other's private data if the proper registration wasn't in place.
> 
> On the other hand, a stronger and perhaps more robust approach would be to
> enforce the condition that non-cooperating drivers are never bound to devices
> in the same group at the same time.  That's basically what I'm proposing here
> -- the question is whether the enforcement should be instituted in the kernel or
> should merely be part of a standard protocol followed by userspace drivers.
> 
> Given that it's currently needed in only one place, it seems reasonable to leave
> this as a "gentlemen's agreement" in userspace for the time being instead of
> adding it to the kernel.
But Qemu and Virt-manager don't comply with this "gentlemen's agreement" even if the EHCI and UHCI sit in the same IOMMU group. 
And the current behavior of Qemu and linux USB driver will cause a catastrophe. 
Maybe the hackers can use this BUG to attack the computer.
We shouldn't believe the VMM always comply with the "gentlemen's agreement", I think.
> 
> Alan Stern