linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Paraschiv, Andra-Irina" <andraprs@amazon.com>
To: Stefano Garzarella <sgarzare@redhat.com>,
	Jakub Kicinski <kuba@kernel.org>
Cc: netdev <netdev@vger.kernel.org>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	"David S . Miller" <davem@davemloft.net>,
	David Duncan <davdunc@amazon.com>,
	Dexuan Cui <decui@microsoft.com>, Alexander Graf <graf@amazon.de>,
	Jorgen Hansen <jhansen@vmware.com>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>
Subject: Re: [PATCH net-next v2 1/4] vm_sockets: Include flags field in the vsock address data structure
Date: Wed, 9 Dec 2020 17:17:56 +0200	[thread overview]
Message-ID: <4f2a1ac5-68c7-190f-6abf-452f67b3a7f4@amazon.com> (raw)
In-Reply-To: <20201209104806.qbuemoz3oy6d3v3b@steredhat>



On 09/12/2020 12:48, Stefano Garzarella wrote:
>
> On Tue, Dec 08, 2020 at 10:42:22AM -0800, Jakub Kicinski wrote:
>> On Tue, 8 Dec 2020 20:23:24 +0200 Paraschiv, Andra-Irina wrote:
>>> >> --- a/include/uapi/linux/vm_sockets.h
>>> >> +++ b/include/uapi/linux/vm_sockets.h
>>> >> @@ -145,7 +145,7 @@
>>> >>
>>> >>   struct sockaddr_vm {
>>> >>        __kernel_sa_family_t svm_family;
>>> >> -     unsigned short svm_reserved1;
>>> >> +     unsigned short svm_flags;
>>> >>        unsigned int svm_port;
>>> >>        unsigned int svm_cid;
>>> >>        unsigned char svm_zero[sizeof(struct sockaddr) -
>>> > Since this is a uAPI header I gotta ask - are you 100% sure that it's
>>> > okay to rename this field?
>>> >
>>> > I didn't grasp from just reading the patches whether this is a 
>>> uAPI or
>>> > just internal kernel flag, seems like the former from the reading of
>>> > the comment in patch 2. In which case what guarantees that existing
>>> > users don't pass in garbage since the kernel doesn't check it was 0?
>>>
>>> That's always good to double-check the uapi changes don't break / 
>>> assume
>>> something, thanks for bringing this up. :)
>>>
>>> Sure, let's go through the possible options step by step. Let me 
>>> know if
>>> I get anything wrong and if I can help with clarifications.
>>>
>>> There is the "svm_reserved1" field that is not used in the kernel
>>> codebase. It is set to 0 on the receive (listen) path as part of the
>>> vsock address initialization [1][2]. The "svm_family" and "svm_zero"
>>> fields are checked as part of the address validation [3].
>>>
>>> Now, with the current change to "svm_flags", the flow is the following:
>>>
>>> * On the receive (listen) path, the remote address structure is
>>> initialized as part of the vsock address init logic [2]. Then patch 3/4
>>> of this series sets the "VMADDR_FLAG_TO_HOST" flag given a set of
>>> conditions (local and remote CID > VMADDR_CID_HOST).
>>>
>>> * On the connect path, the userspace logic can set the "svm_flags"
>>> field. It can be set to 0 or 1 (VMADDR_FLAG_TO_HOST); or any other 
>>> value
>>> greater than 1. If the "VMADDR_FLAG_TO_HOST" flag is set, all the vsock
>>> packets are then forwarded to the host.
>>>
>>> * When the vsock transport is assigned, the "svm_flags" field is
>>> checked, and if it has the "VMADDR_FLAG_TO_HOST" flag set, it goes on
>>> with a guest->host transport (patch 4/4 of this series). Otherwise,
>>> other specific flag value is not currently used.
>>>
>>> Given all these points, the question remains what happens if the
>>> "svm_flags" field is set on the connect path to a value higher than 1
>>> (maybe a bogus one, not intended so). And it includes the
>>> "VMADDR_FLAG_TO_HOST" value (the single flag set and specifically used
>>> for now, but we should also account for any further possible flags). In
>>> this case, all the vsock packets would be forwarded to the host and
>>> maybe not intended so, having a bogus value for the flags field. Is 
>>> this
>>> possible case what you are referring to?
>>
>> Correct. What if user basically declared the structure on the stack,
>> and only initialized the fields the kernel used to check?
>>
>> This problem needs to be at the very least discussed in the commit
>> message.
>>
>
> I agree that could be a problem, but here some considerations:
> - I checked some applications (qemu-guest-agent, ncat, iperf-vsock) and
>   all use the same pattern: allocate memory, initialize all the
>   sockaddr_vm to zero (to be sure to initialize the svm_zero), set the
>   cid and port fields.
>   So we should be safe, but of course it may not always be true.
>
> - For now the issue could affect only nested VMs. We introduced this
>   support one year ago, so it's something new and maybe we don't cause
>   too many problems.
>
> As an alternative, what about using 1 or 2 bytes from svm_zero[]?
> These must be set at zero, even if we only check the first byte in the
> kernel.

Thanks for the follow-up info.

We can also consider the "svm_zero" option and could use 2 bytes from 
that field for "svm_flags", keeping the same "unsigned short" type.

Thanks,
Andra



Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.

  reply	other threads:[~2020-12-09 15:19 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-04 17:02 [PATCH net-next v2 0/4] vsock: Add flags field in the vsock address Andra Paraschiv
2020-12-04 17:02 ` [PATCH net-next v2 1/4] vm_sockets: Include flags field in the vsock address data structure Andra Paraschiv
2020-12-07  9:59   ` Stefano Garzarella
2020-12-07 19:25     ` Paraschiv, Andra-Irina
2020-12-07 21:29   ` Jakub Kicinski
2020-12-08 18:23     ` Paraschiv, Andra-Irina
2020-12-08 18:42       ` Jakub Kicinski
2020-12-09 10:48         ` Stefano Garzarella
2020-12-09 15:17           ` Paraschiv, Andra-Irina [this message]
2020-12-09 17:30             ` Jakub Kicinski
2020-12-10 15:29               ` Paraschiv, Andra-Irina
2020-12-04 17:02 ` [PATCH net-next v2 2/4] vm_sockets: Add VMADDR_FLAG_TO_HOST vsock flag Andra Paraschiv
2020-12-07  9:59   ` Stefano Garzarella
2020-12-07 19:45     ` Paraschiv, Andra-Irina
2020-12-04 17:02 ` [PATCH net-next v2 3/4] af_vsock: Set VMADDR_FLAG_TO_HOST flag on the receive path Andra Paraschiv
2020-12-07  9:59   ` Stefano Garzarella
2020-12-04 17:02 ` [PATCH net-next v2 4/4] af_vsock: Assign the vsock transport considering the vsock address flags Andra Paraschiv
2020-12-07 10:00   ` Stefano Garzarella
2020-12-07 19:51     ` Paraschiv, Andra-Irina
2020-12-07 10:05 ` [PATCH net-next v2 0/4] vsock: Add flags field in the vsock address Stefano Garzarella
2020-12-07 19:18   ` Paraschiv, Andra-Irina

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4f2a1ac5-68c7-190f-6abf-452f67b3a7f4@amazon.com \
    --to=andraprs@amazon.com \
    --cc=davdunc@amazon.com \
    --cc=davem@davemloft.net \
    --cc=decui@microsoft.com \
    --cc=graf@amazon.de \
    --cc=jhansen@vmware.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=sgarzare@redhat.com \
    --cc=stefanha@redhat.com \
    --cc=vkuznets@redhat.com \
    --subject='Re: [PATCH net-next v2 1/4] vm_sockets: Include flags field in the vsock address data structure' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).