From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: "Jens Axboe" <axboe@kernel.dk>,
"Roger Pau Monné" <roger.pau@citrix.com>,
"Alasdair Kergon" <agk@redhat.com>,
"Mike Snitzer" <snitzer@kernel.org>,
dm-devel@redhat.com
Cc: "Demi Marie Obenour" <demi@invisiblethingslab.com>,
"Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>,
linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
xen-devel@lists.xenproject.org
Subject: [PATCH v2 00/16] Diskseq support in loop, device-mapper, and blkback
Date: Tue, 30 May 2023 16:31:00 -0400 [thread overview]
Message-ID: <20230530203116.2008-1-demi@invisiblethingslab.com> (raw)
This work aims to allow userspace to create and destroy block devices
in a race-free way, and to allow them to be exposed to other Xen VMs via
blkback without races.
Changes since v1:
- Several device-mapper fixes added.
- The diskseq is now a separate Xenstore node, rather than being part of
physical-device.
- Potentially backwards-incompatible changes to device-mapper now
require userspace opt-in.
- The code has been tested: I have a block script written in C that uses
these changes to successfully boot a Xen VM.
- The core block layer is almost completely untouched. Instead of
exposing a block device inode directly to userspace, device-mapper
ioctls that create a block device now return that device's diskseq.
Userspace can then use that diskseq to safely open the device.
Furthermore, ioctls that operate on an existing device-mapper device
now accept a diskseq parameter, which can be used to prevent races.
There are a few changes that make device-mapper's table validation
stricter. Two of them are clear-cut fixes for memory safety bugs: one
prevents a misaligned pointer dereference in the kernel, and the other
prevents pointer arithmetic overflow that could cause the kernel to
dereference a userspace pointer, especially on 32-bit systems. One
fixes a double-fetch bug that happens to be harmless right now, but
would make distribution backports of subsequent patches unsafe. The
remaining fixes prevent totally nonsensical tables from being accepted.
This includes parameter strings that overlap the subsequent target spec,
and target specs that overlap the 'struct dm_ioctl' or each other. I
doubt there is any userspace extant that generates such tables.
Finally, one patch forbids device-mapper devices to be named ".", "..",
or "control". Since device-mapper devices are often accessed via
/dev/mapper/NAME, such names would likely greatly confuse userspace. I
consider this to be an extension of the existing check that prohibits
device mapper names or UUIDs from containing '/'.
Demi Marie Obenour (16):
device-mapper: Check that target specs are sufficiently aligned
device-mapper: Avoid pointer arithmetic overflow
device-mapper: do not allow targets to overlap 'struct dm_ioctl'
device-mapper: Better error message for too-short target spec
device-mapper: Target parameters must not overlap next target spec
device-mapper: Avoid double-fetch of version
device-mapper: Allow userspace to opt-in to strict parameter checks
device-mapper: Allow userspace to provide expected diskseq
device-mapper: Allow userspace to suppress uevent generation
device-mapper: Refuse to create device named "control"
device-mapper: "." and ".." are not valid symlink names
device-mapper: inform caller about already-existing device
xen-blkback: Implement diskseq checks
block, loop: Increment diskseq when releasing a loop device
xen-blkback: Minor cleanups
xen-blkback: Inform userspace that device has been opened
block/genhd.c | 1 +
drivers/block/loop.c | 6 +
drivers/block/xen-blkback/blkback.c | 8 +-
drivers/block/xen-blkback/xenbus.c | 147 ++++++++--
drivers/md/dm-core.h | 2 +
drivers/md/dm-ioctl.c | 432 ++++++++++++++++++++++------
drivers/md/dm.c | 5 +-
include/linux/device-mapper.h | 2 +-
include/uapi/linux/dm-ioctl.h | 67 ++++-
9 files changed, 551 insertions(+), 119 deletions(-)
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
next reply other threads:[~2023-05-30 20:31 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-30 20:31 Demi Marie Obenour [this message]
2023-05-30 20:31 ` [PATCH v2 01/16] device-mapper: Check that target specs are sufficiently aligned Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 02/16] device-mapper: Avoid pointer arithmetic overflow Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 03/16] device-mapper: do not allow targets to overlap 'struct dm_ioctl' Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 04/16] device-mapper: Better error message for too-short target spec Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 05/16] device-mapper: Target parameters must not overlap next " Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 06/16] device-mapper: Avoid double-fetch of version Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 07/16] device-mapper: Allow userspace to opt-in to strict parameter checks Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 08/16] device-mapper: Allow userspace to provide expected diskseq Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 09/16] device-mapper: Allow userspace to suppress uevent generation Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 10/16] device-mapper: Refuse to create device named "control" Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 11/16] device-mapper: "." and ".." are not valid symlink names Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 12/16] device-mapper: inform caller about already-existing device Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 13/16] xen-blkback: Implement diskseq checks Demi Marie Obenour
2023-06-06 8:25 ` Roger Pau Monné
2023-06-06 17:01 ` Demi Marie Obenour
2023-06-07 8:20 ` Roger Pau Monné
2023-06-07 16:14 ` Demi Marie Obenour
2023-06-08 8:29 ` Roger Pau Monné
2023-06-08 15:33 ` Demi Marie Obenour
2023-06-09 15:13 ` Roger Pau Monné
2023-06-09 16:55 ` Demi Marie Obenour
2023-06-12 8:09 ` Roger Pau Monné
2023-06-21 1:14 ` Demi Marie Obenour
2023-06-21 10:07 ` Roger Pau Monné
2023-05-30 20:31 ` [PATCH v2 14/16] block, loop: Increment diskseq when releasing a loop device Demi Marie Obenour
2023-05-30 20:31 ` [PATCH v2 15/16] xen-blkback: Minor cleanups Demi Marie Obenour
2023-06-06 8:36 ` Roger Pau Monné
2023-05-30 20:31 ` [PATCH v2 16/16] xen-blkback: Inform userspace that device has been opened Demi Marie Obenour
2023-06-06 9:15 ` Roger Pau Monné
2023-06-06 17:31 ` Demi Marie Obenour
2023-06-07 8:44 ` Roger Pau Monné
2023-06-07 16:29 ` Demi Marie Obenour
2023-06-08 9:11 ` Roger Pau Monné
2023-06-08 15:23 ` Demi Marie Obenour
2023-06-08 10:08 ` Roger Pau Monné
2023-06-08 15:24 ` Demi Marie Obenour
2023-05-31 13:06 ` [dm-devel] [PATCH v2 00/16] Diskseq support in loop, device-mapper, and blkback Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230530203116.2008-1-demi@invisiblethingslab.com \
--to=demi@invisiblethingslab.com \
--cc=agk@redhat.com \
--cc=axboe@kernel.dk \
--cc=dm-devel@redhat.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marmarek@invisiblethingslab.com \
--cc=roger.pau@citrix.com \
--cc=snitzer@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).