From: Stefano Garzarella <sgarzare@redhat.com>
To: Jason Wang <jasowang@redhat.com>
Cc: mst@redhat.com, corbet@lwn.net, linux-kernel@vger.kernel.org,
linux-doc@vger.kernel.org, mikelley@microsoft.com,
vkuznets@redhat.com, liuwe@microsoft.com,
kkashanjat@microsoft.com, cohuck@redhat.com, otubo@redhat.com,
andavis@redhat.com, aadam@redhat.com, stefanha@redhat.com,
virtualization@lists.linux-foundation.org
Subject: Re: [RFC PATCH] virtio: document virtio hardening status and TODO
Date: Tue, 18 Oct 2022 17:39:48 +0200 [thread overview]
Message-ID: <20221018153948.2ocwejx4ut3sf3br@sgarzare-redhat> (raw)
In-Reply-To: <20221014042037.23639-1-jasowang@redhat.com>
I'm not a native speaker, so the following suggestions can be wrong :-)
On Fri, Oct 14, 2022 at 12:20:37PM +0800, Jason Wang wrote:
>This patch summarizes the status of hardening and TODO of hardening
>virtio core and drivers.
>
>Signed-off-by: Jason Wang <jasowang@redhat.com>
>---
> Documentation/security/virtio/core.rst | 49 ++++++++++++++++++++++++++
> MAINTAINERS | 1 +
> 2 files changed, 50 insertions(+)
> create mode 100644 Documentation/security/virtio/core.rst
>
>diff --git a/Documentation/security/virtio/core.rst b/Documentation/security/virtio/core.rst
>new file mode 100644
>index 000000000000..b8baa104d7c8
>--- /dev/null
>+++ b/Documentation/security/virtio/core.rst
>@@ -0,0 +1,49 @@
>+================
>+Virtio hardening
>+================
>+
>+The virtio core and drivers should not trust the devices. This means
>+all kinds of input from the device must be validated before being
>+used. This document summarizes the current status and TODO for this
>+validation/hardening efforts.
s/efforts/effort
>+
>+
>+Status
>+======
>+
>+The virtio core and drivers has done some basic hardening:
>+
>+* Config callback hardening: The core makes sure the config interrupt
>+ callbacks are enabled after the driver is ready and disable before
>+ the driver is removed.
>+
>+* Descriptor ring hardening: The metadata of a descriptor were copied
>+ and stored in a driver private memory that can not be accessed by the
>+ device. The eliminates the device triggerable behaviours through the
s/The/This ? (not sure)
)
>+ descriptor ring.
>+
>+* Device configuration space validation: Some of the virtio drivers
>+ validates the fields of device configuration space before try to use
s/validates/validate
>+ them.
>+
>+
>+TODO
>+====
>+
>+* Input buffer length validation: The virtio core needs to validate
>+ the input buffer length validation before passing them to individual
Remove "validation"?
>+ virtio drivers.
>+
>+* Virtqueue callback hardening: The virtio core (or with the help of
>+ the drivers) should guarantee that the virtqueue callbacks should not
>+ be triggered before the driver is ready or after the driver is
>+ removed.
>+
>+* Transport specific data validation: The virtio transport driver should
>+ validate the virtio transport specific data provided by the device
>+ before trying to use them in the probing.
s/in the probing/during the probe ?
>+
>+* Device specific validation: Driver should validate the device specific
>+ metadata before being used by a specific subsystem.
>+
>+
>diff --git a/MAINTAINERS b/MAINTAINERS
>index 673b9f9b8d8a..b33cc5c751c1 100644
>--- a/MAINTAINERS
>+++ b/MAINTAINERS
>@@ -21516,6 +21516,7 @@ S: Maintained
> F: Documentation/ABI/testing/sysfs-bus-vdpa
> F: Documentation/ABI/testing/sysfs-class-vduse
> F: Documentation/devicetree/bindings/virtio/
>+F: Documentation/security/virtio/core.rst
> F: drivers/block/virtio_blk.c
> F: drivers/crypto/virtio/
> F: drivers/net/virtio_net.c
>--
>2.25.1
>
Thanks,
Stefano
prev parent reply other threads:[~2022-10-18 15:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-14 4:20 [RFC PATCH] virtio: document virtio hardening status and TODO Jason Wang
2022-10-14 14:01 ` Jonathan Corbet
2022-10-17 6:09 ` Jason Wang
2022-10-18 15:39 ` Stefano Garzarella [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221018153948.2ocwejx4ut3sf3br@sgarzare-redhat \
--to=sgarzare@redhat.com \
--cc=aadam@redhat.com \
--cc=andavis@redhat.com \
--cc=cohuck@redhat.com \
--cc=corbet@lwn.net \
--cc=jasowang@redhat.com \
--cc=kkashanjat@microsoft.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liuwe@microsoft.com \
--cc=mikelley@microsoft.com \
--cc=mst@redhat.com \
--cc=otubo@redhat.com \
--cc=stefanha@redhat.com \
--cc=virtualization@lists.linux-foundation.org \
--cc=vkuznets@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).