Re: [PATCH net-next v2 1/4] vm_sockets: Include flags field in the vsock address data structure

["Paraschiv, Andra-Irina" <andraprs@amazon.com>]

On 09/12/2020 12:48, Stefano Garzarella wrote:
>
> On Tue, Dec 08, 2020 at 10:42:22AM -0800, Jakub Kicinski wrote:
>> On Tue, 8 Dec 2020 20:23:24 +0200 Paraschiv, Andra-Irina wrote:
>>> >> --- a/include/uapi/linux/vm_sockets.h
>>> >> +++ b/include/uapi/linux/vm_sockets.h
>>> >> @@ -145,7 +145,7 @@
>>> >>
>>> >>   struct sockaddr_vm {
>>> >>        __kernel_sa_family_t svm_family;
>>> >> -     unsigned short svm_reserved1;
>>> >> +     unsigned short svm_flags;
>>> >>        unsigned int svm_port;
>>> >>        unsigned int svm_cid;
>>> >>        unsigned char svm_zero[sizeof(struct sockaddr) -
>>> > Since this is a uAPI header I gotta ask - are you 100% sure that it's
>>> > okay to rename this field?
>>> >
>>> > I didn't grasp from just reading the patches whether this is a 
>>> uAPI or
>>> > just internal kernel flag, seems like the former from the reading of
>>> > the comment in patch 2. In which case what guarantees that existing
>>> > users don't pass in garbage since the kernel doesn't check it was 0?
>>>
>>> That's always good to double-check the uapi changes don't break / 
>>> assume
>>> something, thanks for bringing this up. :)
>>>
>>> Sure, let's go through the possible options step by step. Let me 
>>> know if
>>> I get anything wrong and if I can help with clarifications.
>>>
>>> There is the "svm_reserved1" field that is not used in the kernel
>>> codebase. It is set to 0 on the receive (listen) path as part of the
>>> vsock address initialization [1][2]. The "svm_family" and "svm_zero"
>>> fields are checked as part of the address validation [3].
>>>
>>> Now, with the current change to "svm_flags", the flow is the following:
>>>
>>> * On the receive (listen) path, the remote address structure is
>>> initialized as part of the vsock address init logic [2]. Then patch 3/4
>>> of this series sets the "VMADDR_FLAG_TO_HOST" flag given a set of
>>> conditions (local and remote CID > VMADDR_CID_HOST).
>>>
>>> * On the connect path, the userspace logic can set the "svm_flags"
>>> field. It can be set to 0 or 1 (VMADDR_FLAG_TO_HOST); or any other 
>>> value
>>> greater than 1. If the "VMADDR_FLAG_TO_HOST" flag is set, all the vsock
>>> packets are then forwarded to the host.
>>>
>>> * When the vsock transport is assigned, the "svm_flags" field is
>>> checked, and if it has the "VMADDR_FLAG_TO_HOST" flag set, it goes on
>>> with a guest->host transport (patch 4/4 of this series). Otherwise,
>>> other specific flag value is not currently used.
>>>
>>> Given all these points, the question remains what happens if the
>>> "svm_flags" field is set on the connect path to a value higher than 1
>>> (maybe a bogus one, not intended so). And it includes the
>>> "VMADDR_FLAG_TO_HOST" value (the single flag set and specifically used
>>> for now, but we should also account for any further possible flags). In
>>> this case, all the vsock packets would be forwarded to the host and
>>> maybe not intended so, having a bogus value for the flags field. Is 
>>> this
>>> possible case what you are referring to?
>>
>> Correct. What if user basically declared the structure on the stack,
>> and only initialized the fields the kernel used to check?
>>
>> This problem needs to be at the very least discussed in the commit
>> message.
>>
>
> I agree that could be a problem, but here some considerations:
> - I checked some applications (qemu-guest-agent, ncat, iperf-vsock) and
>   all use the same pattern: allocate memory, initialize all the
>   sockaddr_vm to zero (to be sure to initialize the svm_zero), set the
>   cid and port fields.
>   So we should be safe, but of course it may not always be true.
>
> - For now the issue could affect only nested VMs. We introduced this
>   support one year ago, so it's something new and maybe we don't cause
>   too many problems.
>
> As an alternative, what about using 1 or 2 bytes from svm_zero[]?
> These must be set at zero, even if we only check the first byte in the
> kernel.

Thanks for the follow-up info.

We can also consider the "svm_zero" option and could use 2 bytes from 
that field for "svm_flags", keeping the same "unsigned short" type.

Thanks,
Andra



Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.