* [RFC PATCH untested] vhost: block speculation of translated descriptors
@ 2019-09-08 11:05 Michael S. Tsirkin
2019-09-09 7:19 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: Michael S. Tsirkin @ 2019-09-08 11:05 UTC (permalink / raw)
To: linux-kernel; +Cc: Jason Wang, kvm, virtualization, netdev
iovec addresses coming from vhost are assumed to be
pre-validated, but in fact can be speculated to a value
out of range.
Userspace address are later validated with array_index_nospec so we can
be sure kernel info does not leak through these addresses, but vhost
must also not leak userspace info outside the allowed memory table to
guests.
Following the defence in depth principle, make sure
the address is not validated out of node range.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
drivers/vhost/vhost.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 5dc174ac8cac..0ee375fb7145 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
size = node->size - addr + node->start;
_iov->iov_len = min((u64)len - s, size);
_iov->iov_base = (void __user *)(unsigned long)
- (node->userspace_addr + addr - node->start);
+ (node->userspace_addr +
+ array_index_nospec(addr - node->start,
+ node->size));
s += size;
addr += size;
++ret;
--
MST
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [RFC PATCH untested] vhost: block speculation of translated descriptors
2019-09-08 11:05 [RFC PATCH untested] vhost: block speculation of translated descriptors Michael S. Tsirkin
@ 2019-09-09 7:19 ` Jason Wang
2019-09-09 14:45 ` Michael S. Tsirkin
0 siblings, 1 reply; 6+ messages in thread
From: Jason Wang @ 2019-09-09 7:19 UTC (permalink / raw)
To: Michael S. Tsirkin, linux-kernel; +Cc: kvm, virtualization, netdev
On 2019/9/8 下午7:05, Michael S. Tsirkin wrote:
> iovec addresses coming from vhost are assumed to be
> pre-validated, but in fact can be speculated to a value
> out of range.
>
> Userspace address are later validated with array_index_nospec so we can
> be sure kernel info does not leak through these addresses, but vhost
> must also not leak userspace info outside the allowed memory table to
> guests.
>
> Following the defence in depth principle, make sure
> the address is not validated out of node range.
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
> drivers/vhost/vhost.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 5dc174ac8cac..0ee375fb7145 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
> size = node->size - addr + node->start;
> _iov->iov_len = min((u64)len - s, size);
> _iov->iov_base = (void __user *)(unsigned long)
> - (node->userspace_addr + addr - node->start);
> + (node->userspace_addr +
> + array_index_nospec(addr - node->start,
> + node->size));
> s += size;
> addr += size;
> ++ret;
I've tried this on Kaby Lake smap off metadata acceleration off using
testpmd (virtio-user) + vhost_net. I don't see obvious performance
difference with TX PPS.
Thanks
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFC PATCH untested] vhost: block speculation of translated descriptors
2019-09-09 7:19 ` Jason Wang
@ 2019-09-09 14:45 ` Michael S. Tsirkin
2019-09-10 1:52 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: Michael S. Tsirkin @ 2019-09-09 14:45 UTC (permalink / raw)
To: Jason Wang; +Cc: linux-kernel, kvm, virtualization, netdev
On Mon, Sep 09, 2019 at 03:19:55PM +0800, Jason Wang wrote:
>
> On 2019/9/8 下午7:05, Michael S. Tsirkin wrote:
> > iovec addresses coming from vhost are assumed to be
> > pre-validated, but in fact can be speculated to a value
> > out of range.
> >
> > Userspace address are later validated with array_index_nospec so we can
> > be sure kernel info does not leak through these addresses, but vhost
> > must also not leak userspace info outside the allowed memory table to
> > guests.
> >
> > Following the defence in depth principle, make sure
> > the address is not validated out of node range.
> >
> > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> > ---
> > drivers/vhost/vhost.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> > index 5dc174ac8cac..0ee375fb7145 100644
> > --- a/drivers/vhost/vhost.c
> > +++ b/drivers/vhost/vhost.c
> > @@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
> > size = node->size - addr + node->start;
> > _iov->iov_len = min((u64)len - s, size);
> > _iov->iov_base = (void __user *)(unsigned long)
> > - (node->userspace_addr + addr - node->start);
> > + (node->userspace_addr +
> > + array_index_nospec(addr - node->start,
> > + node->size));
> > s += size;
> > addr += size;
> > ++ret;
>
>
> I've tried this on Kaby Lake smap off metadata acceleration off using
> testpmd (virtio-user) + vhost_net. I don't see obvious performance
> difference with TX PPS.
>
> Thanks
Should I push this to Linus right now then? It's a security thing so
maybe we better do it ASAP ... what's your opinion?
--
MST
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFC PATCH untested] vhost: block speculation of translated descriptors
2019-09-09 14:45 ` Michael S. Tsirkin
@ 2019-09-10 1:52 ` Jason Wang
2019-09-10 6:48 ` Michael S. Tsirkin
0 siblings, 1 reply; 6+ messages in thread
From: Jason Wang @ 2019-09-10 1:52 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: linux-kernel, kvm, virtualization, netdev
On 2019/9/9 下午10:45, Michael S. Tsirkin wrote:
> On Mon, Sep 09, 2019 at 03:19:55PM +0800, Jason Wang wrote:
>> On 2019/9/8 下午7:05, Michael S. Tsirkin wrote:
>>> iovec addresses coming from vhost are assumed to be
>>> pre-validated, but in fact can be speculated to a value
>>> out of range.
>>>
>>> Userspace address are later validated with array_index_nospec so we can
>>> be sure kernel info does not leak through these addresses, but vhost
>>> must also not leak userspace info outside the allowed memory table to
>>> guests.
>>>
>>> Following the defence in depth principle, make sure
>>> the address is not validated out of node range.
>>>
>>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>>> ---
>>> drivers/vhost/vhost.c | 4 +++-
>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
>>> index 5dc174ac8cac..0ee375fb7145 100644
>>> --- a/drivers/vhost/vhost.c
>>> +++ b/drivers/vhost/vhost.c
>>> @@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
>>> size = node->size - addr + node->start;
>>> _iov->iov_len = min((u64)len - s, size);
>>> _iov->iov_base = (void __user *)(unsigned long)
>>> - (node->userspace_addr + addr - node->start);
>>> + (node->userspace_addr +
>>> + array_index_nospec(addr - node->start,
>>> + node->size));
>>> s += size;
>>> addr += size;
>>> ++ret;
>>
>> I've tried this on Kaby Lake smap off metadata acceleration off using
>> testpmd (virtio-user) + vhost_net. I don't see obvious performance
>> difference with TX PPS.
>>
>> Thanks
> Should I push this to Linus right now then? It's a security thing so
> maybe we better do it ASAP ... what's your opinion?
Yes, you can.
Acked-by: Jason Wang <jasowang@redhat.com>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFC PATCH untested] vhost: block speculation of translated descriptors
2019-09-10 1:52 ` Jason Wang
@ 2019-09-10 6:48 ` Michael S. Tsirkin
2019-09-10 7:28 ` Jason Wang
0 siblings, 1 reply; 6+ messages in thread
From: Michael S. Tsirkin @ 2019-09-10 6:48 UTC (permalink / raw)
To: Jason Wang; +Cc: linux-kernel, kvm, virtualization, netdev
On Tue, Sep 10, 2019 at 09:52:10AM +0800, Jason Wang wrote:
>
> On 2019/9/9 下午10:45, Michael S. Tsirkin wrote:
> > On Mon, Sep 09, 2019 at 03:19:55PM +0800, Jason Wang wrote:
> > > On 2019/9/8 下午7:05, Michael S. Tsirkin wrote:
> > > > iovec addresses coming from vhost are assumed to be
> > > > pre-validated, but in fact can be speculated to a value
> > > > out of range.
> > > >
> > > > Userspace address are later validated with array_index_nospec so we can
> > > > be sure kernel info does not leak through these addresses, but vhost
> > > > must also not leak userspace info outside the allowed memory table to
> > > > guests.
> > > >
> > > > Following the defence in depth principle, make sure
> > > > the address is not validated out of node range.
> > > >
> > > > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> > > > ---
> > > > drivers/vhost/vhost.c | 4 +++-
> > > > 1 file changed, 3 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> > > > index 5dc174ac8cac..0ee375fb7145 100644
> > > > --- a/drivers/vhost/vhost.c
> > > > +++ b/drivers/vhost/vhost.c
> > > > @@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
> > > > size = node->size - addr + node->start;
> > > > _iov->iov_len = min((u64)len - s, size);
> > > > _iov->iov_base = (void __user *)(unsigned long)
> > > > - (node->userspace_addr + addr - node->start);
> > > > + (node->userspace_addr +
> > > > + array_index_nospec(addr - node->start,
> > > > + node->size));
> > > > s += size;
> > > > addr += size;
> > > > ++ret;
> > >
> > > I've tried this on Kaby Lake smap off metadata acceleration off using
> > > testpmd (virtio-user) + vhost_net. I don't see obvious performance
> > > difference with TX PPS.
> > >
> > > Thanks
> > Should I push this to Linus right now then? It's a security thing so
> > maybe we better do it ASAP ... what's your opinion?
>
>
> Yes, you can.
>
> Acked-by: Jason Wang <jasowang@redhat.com>
And should I include
Tested-by: Jason Wang <jasowang@redhat.com>
?
>
>
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [RFC PATCH untested] vhost: block speculation of translated descriptors
2019-09-10 6:48 ` Michael S. Tsirkin
@ 2019-09-10 7:28 ` Jason Wang
0 siblings, 0 replies; 6+ messages in thread
From: Jason Wang @ 2019-09-10 7:28 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: linux-kernel, kvm, virtualization, netdev
On 2019/9/10 下午2:48, Michael S. Tsirkin wrote:
> On Tue, Sep 10, 2019 at 09:52:10AM +0800, Jason Wang wrote:
>> On 2019/9/9 下午10:45, Michael S. Tsirkin wrote:
>>> On Mon, Sep 09, 2019 at 03:19:55PM +0800, Jason Wang wrote:
>>>> On 2019/9/8 下午7:05, Michael S. Tsirkin wrote:
>>>>> iovec addresses coming from vhost are assumed to be
>>>>> pre-validated, but in fact can be speculated to a value
>>>>> out of range.
>>>>>
>>>>> Userspace address are later validated with array_index_nospec so we can
>>>>> be sure kernel info does not leak through these addresses, but vhost
>>>>> must also not leak userspace info outside the allowed memory table to
>>>>> guests.
>>>>>
>>>>> Following the defence in depth principle, make sure
>>>>> the address is not validated out of node range.
>>>>>
>>>>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>>>>> ---
>>>>> drivers/vhost/vhost.c | 4 +++-
>>>>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
>>>>> index 5dc174ac8cac..0ee375fb7145 100644
>>>>> --- a/drivers/vhost/vhost.c
>>>>> +++ b/drivers/vhost/vhost.c
>>>>> @@ -2072,7 +2072,9 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
>>>>> size = node->size - addr + node->start;
>>>>> _iov->iov_len = min((u64)len - s, size);
>>>>> _iov->iov_base = (void __user *)(unsigned long)
>>>>> - (node->userspace_addr + addr - node->start);
>>>>> + (node->userspace_addr +
>>>>> + array_index_nospec(addr - node->start,
>>>>> + node->size));
>>>>> s += size;
>>>>> addr += size;
>>>>> ++ret;
>>>> I've tried this on Kaby Lake smap off metadata acceleration off using
>>>> testpmd (virtio-user) + vhost_net. I don't see obvious performance
>>>> difference with TX PPS.
>>>>
>>>> Thanks
>>> Should I push this to Linus right now then? It's a security thing so
>>> maybe we better do it ASAP ... what's your opinion?
>>
>> Yes, you can.
>>
>> Acked-by: Jason Wang <jasowang@redhat.com>
>
> And should I include
>
> Tested-by: Jason Wang <jasowang@redhat.com>
>
> ?
Yes.
Thanks
>
>>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-09-10 7:28 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-08 11:05 [RFC PATCH untested] vhost: block speculation of translated descriptors Michael S. Tsirkin
2019-09-09 7:19 ` Jason Wang
2019-09-09 14:45 ` Michael S. Tsirkin
2019-09-10 1:52 ` Jason Wang
2019-09-10 6:48 ` Michael S. Tsirkin
2019-09-10 7:28 ` Jason Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).