From: Jason Wang <jasowang@redhat.com> To: Yongji Xie <xieyongji@bytedance.com> Cc: "Michael S. Tsirkin" <mst@redhat.com>, Stefan Hajnoczi <stefanha@redhat.com>, virtualization <virtualization@lists.linux-foundation.org>, linux-block@vger.kernel.org, linux-kernel <linux-kernel@vger.kernel.org> Subject: Re: [PATCH v5] virtio-blk: Add validation for block size in config space Date: Tue, 10 Aug 2021 14:59:41 +0800 [thread overview] Message-ID: <46c513b4-6644-d4b0-84f4-32df34b6d7b8@redhat.com> (raw) In-Reply-To: <CACycT3tPR30RU8XmWbDA=Hp-A6BBifd-q_aqrmU-9VK=OaRJRg@mail.gmail.com> 在 2021/8/10 下午12:59, Yongji Xie 写道: > On Tue, Aug 10, 2021 at 11:05 AM Jason Wang <jasowang@redhat.com> wrote: >> >> 在 2021/8/9 下午6:16, Xie Yongji 写道: >>> An untrusted device might presents an invalid block size >>> in configuration space. This tries to add validation for it >>> in the validate callback and clear the VIRTIO_BLK_F_BLK_SIZE >>> feature bit if the value is out of the supported range. >>> >>> And we also double check the value in virtblk_probe() in >>> case that it's changed after the validation. >>> >>> Signed-off-by: Xie Yongji <xieyongji@bytedance.com> >>> --- >>> drivers/block/virtio_blk.c | 39 +++++++++++++++++++++++++++++++++------ >>> 1 file changed, 33 insertions(+), 6 deletions(-) >>> >>> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c >>> index 4b49df2dfd23..afb37aac09e8 100644 >>> --- a/drivers/block/virtio_blk.c >>> +++ b/drivers/block/virtio_blk.c >>> @@ -692,6 +692,28 @@ static const struct blk_mq_ops virtio_mq_ops = { >>> static unsigned int virtblk_queue_depth; >>> module_param_named(queue_depth, virtblk_queue_depth, uint, 0444); >>> >>> +static int virtblk_validate(struct virtio_device *vdev) >>> +{ >>> + u32 blk_size; >>> + >>> + if (!vdev->config->get) { >>> + dev_err(&vdev->dev, "%s failure: config access disabled\n", >>> + __func__); >>> + return -EINVAL; >>> + } >>> + >>> + if (!virtio_has_feature(vdev, VIRTIO_BLK_F_BLK_SIZE)) >>> + return 0; >>> + >>> + blk_size = virtio_cread32(vdev, >>> + offsetof(struct virtio_blk_config, blk_size)); >>> + >>> + if (blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE) >>> + __virtio_clear_bit(vdev, VIRTIO_BLK_F_BLK_SIZE); >> >> I wonder if it's better to just fail here as what we did for probe(). >> > Looks like we don't need to do that since we already clear the > VIRTIO_BLK_F_BLK_SIZE to tell the device that we don't use the block > size in configuration space. Just like what we did in > virtnet_validate(). > > Thanks, > Yongji Ok, so Acked-by: Jason Wang <jasowang@redhat.com> >
WARNING: multiple messages have this Message-ID (diff)
From: Jason Wang <jasowang@redhat.com> To: Yongji Xie <xieyongji@bytedance.com> Cc: linux-block@vger.kernel.org, virtualization <virtualization@lists.linux-foundation.org>, linux-kernel <linux-kernel@vger.kernel.org>, Stefan Hajnoczi <stefanha@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com> Subject: Re: [PATCH v5] virtio-blk: Add validation for block size in config space Date: Tue, 10 Aug 2021 14:59:41 +0800 [thread overview] Message-ID: <46c513b4-6644-d4b0-84f4-32df34b6d7b8@redhat.com> (raw) In-Reply-To: <CACycT3tPR30RU8XmWbDA=Hp-A6BBifd-q_aqrmU-9VK=OaRJRg@mail.gmail.com> 在 2021/8/10 下午12:59, Yongji Xie 写道: > On Tue, Aug 10, 2021 at 11:05 AM Jason Wang <jasowang@redhat.com> wrote: >> >> 在 2021/8/9 下午6:16, Xie Yongji 写道: >>> An untrusted device might presents an invalid block size >>> in configuration space. This tries to add validation for it >>> in the validate callback and clear the VIRTIO_BLK_F_BLK_SIZE >>> feature bit if the value is out of the supported range. >>> >>> And we also double check the value in virtblk_probe() in >>> case that it's changed after the validation. >>> >>> Signed-off-by: Xie Yongji <xieyongji@bytedance.com> >>> --- >>> drivers/block/virtio_blk.c | 39 +++++++++++++++++++++++++++++++++------ >>> 1 file changed, 33 insertions(+), 6 deletions(-) >>> >>> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c >>> index 4b49df2dfd23..afb37aac09e8 100644 >>> --- a/drivers/block/virtio_blk.c >>> +++ b/drivers/block/virtio_blk.c >>> @@ -692,6 +692,28 @@ static const struct blk_mq_ops virtio_mq_ops = { >>> static unsigned int virtblk_queue_depth; >>> module_param_named(queue_depth, virtblk_queue_depth, uint, 0444); >>> >>> +static int virtblk_validate(struct virtio_device *vdev) >>> +{ >>> + u32 blk_size; >>> + >>> + if (!vdev->config->get) { >>> + dev_err(&vdev->dev, "%s failure: config access disabled\n", >>> + __func__); >>> + return -EINVAL; >>> + } >>> + >>> + if (!virtio_has_feature(vdev, VIRTIO_BLK_F_BLK_SIZE)) >>> + return 0; >>> + >>> + blk_size = virtio_cread32(vdev, >>> + offsetof(struct virtio_blk_config, blk_size)); >>> + >>> + if (blk_size < SECTOR_SIZE || blk_size > PAGE_SIZE) >>> + __virtio_clear_bit(vdev, VIRTIO_BLK_F_BLK_SIZE); >> >> I wonder if it's better to just fail here as what we did for probe(). >> > Looks like we don't need to do that since we already clear the > VIRTIO_BLK_F_BLK_SIZE to tell the device that we don't use the block > size in configuration space. Just like what we did in > virtnet_validate(). > > Thanks, > Yongji Ok, so Acked-by: Jason Wang <jasowang@redhat.com> > _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
next prev parent reply other threads:[~2021-08-10 6:59 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-08-09 10:16 [PATCH v5] virtio-blk: Add validation for block size in config space Xie Yongji 2021-08-10 3:05 ` Jason Wang 2021-08-10 3:05 ` Jason Wang 2021-08-10 4:59 ` Yongji Xie 2021-08-10 6:59 ` Jason Wang [this message] 2021-08-10 6:59 ` Jason Wang 2021-08-22 23:17 ` Max Gurtovoy 2021-08-23 4:31 ` Yongji Xie 2021-08-23 8:07 ` Max Gurtovoy 2021-08-23 8:35 ` Yongji Xie 2021-08-23 9:04 ` Max Gurtovoy 2021-08-23 9:27 ` Yongji Xie 2021-08-23 9:38 ` Max Gurtovoy 2021-08-23 10:33 ` Yongji Xie 2021-08-23 10:45 ` Max Gurtovoy 2021-08-23 11:41 ` Yongji Xie 2021-08-23 12:13 ` Michael S. Tsirkin 2021-08-23 12:13 ` Michael S. Tsirkin 2021-08-23 12:40 ` Yongji Xie 2021-08-23 16:02 ` Michael S. Tsirkin 2021-08-23 16:02 ` Michael S. Tsirkin 2021-08-23 22:31 ` Max Gurtovoy 2021-08-24 2:47 ` Jason Wang 2021-08-24 2:47 ` Jason Wang 2021-08-24 10:11 ` Max Gurtovoy 2021-08-24 12:52 ` Yongji Xie 2021-08-24 13:30 ` Max Gurtovoy 2021-08-24 13:38 ` Yongji Xie 2021-08-24 13:48 ` Max Gurtovoy 2021-10-04 15:27 ` Michael S. Tsirkin 2021-10-04 15:27 ` Michael S. Tsirkin 2021-10-04 15:39 ` Michael S. Tsirkin 2021-10-04 15:39 ` Michael S. Tsirkin 2021-10-05 15:52 ` Yongji Xie 2021-10-05 10:42 ` Michael S. Tsirkin 2021-10-05 10:42 ` Michael S. Tsirkin 2021-10-05 15:45 ` Yongji Xie 2021-10-05 18:26 ` Martin K. Petersen 2021-10-05 18:26 ` Martin K. Petersen 2021-10-11 11:40 ` Christoph Hellwig 2021-10-11 11:40 ` Christoph Hellwig 2021-10-13 12:21 ` Michael S. Tsirkin 2021-10-13 12:21 ` Michael S. Tsirkin 2021-10-13 12:34 ` Yongji Xie 2021-10-13 12:51 ` Michael S. Tsirkin 2021-10-13 12:51 ` Michael S. Tsirkin 2021-10-13 12:59 ` Yongji Xie 2021-10-05 15:24 ` Yongji Xie
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=46c513b4-6644-d4b0-84f4-32df34b6d7b8@redhat.com \ --to=jasowang@redhat.com \ --cc=linux-block@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mst@redhat.com \ --cc=stefanha@redhat.com \ --cc=virtualization@lists.linux-foundation.org \ --cc=xieyongji@bytedance.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.