* [RFC PATCH] virtio: document virtio hardening status and TODO
@ 2022-10-14 4:20 Jason Wang
2022-10-14 14:01 ` Jonathan Corbet
2022-10-18 15:39 ` Stefano Garzarella
0 siblings, 2 replies; 4+ messages in thread
From: Jason Wang @ 2022-10-14 4:20 UTC (permalink / raw)
To: mst, jasowang, corbet
Cc: linux-kernel, linux-doc, mikelley, vkuznets, liuwe, kkashanjat,
cohuck, otubo, andavis, aadam, stefanha, sgarzare,
virtualization
This patch summarizes the status of hardening and TODO of hardening
virtio core and drivers.
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
Documentation/security/virtio/core.rst | 49 ++++++++++++++++++++++++++
MAINTAINERS | 1 +
2 files changed, 50 insertions(+)
create mode 100644 Documentation/security/virtio/core.rst
diff --git a/Documentation/security/virtio/core.rst b/Documentation/security/virtio/core.rst
new file mode 100644
index 000000000000..b8baa104d7c8
--- /dev/null
+++ b/Documentation/security/virtio/core.rst
@@ -0,0 +1,49 @@
+================
+Virtio hardening
+================
+
+The virtio core and drivers should not trust the devices. This means
+all kinds of input from the device must be validated before being
+used. This document summarizes the current status and TODO for this
+validation/hardening efforts.
+
+
+Status
+======
+
+The virtio core and drivers has done some basic hardening:
+
+* Config callback hardening: The core makes sure the config interrupt
+ callbacks are enabled after the driver is ready and disable before
+ the driver is removed.
+
+* Descriptor ring hardening: The metadata of a descriptor were copied
+ and stored in a driver private memory that can not be accessed by the
+ device. The eliminates the device triggerable behaviours through the
+ descriptor ring.
+
+* Device configuration space validation: Some of the virtio drivers
+ validates the fields of device configuration space before try to use
+ them.
+
+
+TODO
+====
+
+* Input buffer length validation: The virtio core needs to validate
+ the input buffer length validation before passing them to individual
+ virtio drivers.
+
+* Virtqueue callback hardening: The virtio core (or with the help of
+ the drivers) should guarantee that the virtqueue callbacks should not
+ be triggered before the driver is ready or after the driver is
+ removed.
+
+* Transport specific data validation: The virtio transport driver should
+ validate the virtio transport specific data provided by the device
+ before trying to use them in the probing.
+
+* Device specific validation: Driver should validate the device specific
+ metadata before being used by a specific subsystem.
+
+
diff --git a/MAINTAINERS b/MAINTAINERS
index 673b9f9b8d8a..b33cc5c751c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -21516,6 +21516,7 @@ S: Maintained
F: Documentation/ABI/testing/sysfs-bus-vdpa
F: Documentation/ABI/testing/sysfs-class-vduse
F: Documentation/devicetree/bindings/virtio/
+F: Documentation/security/virtio/core.rst
F: drivers/block/virtio_blk.c
F: drivers/crypto/virtio/
F: drivers/net/virtio_net.c
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [RFC PATCH] virtio: document virtio hardening status and TODO
2022-10-14 4:20 [RFC PATCH] virtio: document virtio hardening status and TODO Jason Wang
@ 2022-10-14 14:01 ` Jonathan Corbet
2022-10-17 6:09 ` Jason Wang
2022-10-18 15:39 ` Stefano Garzarella
1 sibling, 1 reply; 4+ messages in thread
From: Jonathan Corbet @ 2022-10-14 14:01 UTC (permalink / raw)
To: Jason Wang, mst, jasowang
Cc: linux-kernel, linux-doc, mikelley, vkuznets, liuwe, kkashanjat,
cohuck, otubo, andavis, aadam, stefanha, sgarzare,
virtualization
Jason Wang <jasowang@redhat.com> writes:
> This patch summarizes the status of hardening and TODO of hardening
> virtio core and drivers.
>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> Documentation/security/virtio/core.rst | 49 ++++++++++++++++++++++++++
> MAINTAINERS | 1 +
> 2 files changed, 50 insertions(+)
> create mode 100644 Documentation/security/virtio/core.rst
Do you really need to create a new directory for a single file?
Regardless of where it sits, you'll need to add this file to an
index.rst file so that it becomes part of the docs build.
Thanks,
jon
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [RFC PATCH] virtio: document virtio hardening status and TODO
2022-10-14 14:01 ` Jonathan Corbet
@ 2022-10-17 6:09 ` Jason Wang
0 siblings, 0 replies; 4+ messages in thread
From: Jason Wang @ 2022-10-17 6:09 UTC (permalink / raw)
To: Jonathan Corbet
Cc: mst, linux-kernel, linux-doc, mikelley, vkuznets, liuwe,
kkashanjat, cohuck, otubo, andavis, aadam, stefanha, sgarzare,
virtualization
On Fri, Oct 14, 2022 at 10:02 PM Jonathan Corbet <corbet@lwn.net> wrote:
>
> Jason Wang <jasowang@redhat.com> writes:
>
> > This patch summarizes the status of hardening and TODO of hardening
> > virtio core and drivers.
> >
> > Signed-off-by: Jason Wang <jasowang@redhat.com>
> > ---
> > Documentation/security/virtio/core.rst | 49 ++++++++++++++++++++++++++
> > MAINTAINERS | 1 +
> > 2 files changed, 50 insertions(+)
> > create mode 100644 Documentation/security/virtio/core.rst
>
> Do you really need to create a new directory for a single file?
>
Not sure, but I think we can start without a dedicated directory.
> Regardless of where it sits, you'll need to add this file to an
> index.rst file so that it becomes part of the docs build.
Yes, I will fix it.
Thanks
>
> Thanks,
>
> jon
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [RFC PATCH] virtio: document virtio hardening status and TODO
2022-10-14 4:20 [RFC PATCH] virtio: document virtio hardening status and TODO Jason Wang
2022-10-14 14:01 ` Jonathan Corbet
@ 2022-10-18 15:39 ` Stefano Garzarella
1 sibling, 0 replies; 4+ messages in thread
From: Stefano Garzarella @ 2022-10-18 15:39 UTC (permalink / raw)
To: Jason Wang
Cc: mst, corbet, linux-kernel, linux-doc, mikelley, vkuznets, liuwe,
kkashanjat, cohuck, otubo, andavis, aadam, stefanha,
virtualization
I'm not a native speaker, so the following suggestions can be wrong :-)
On Fri, Oct 14, 2022 at 12:20:37PM +0800, Jason Wang wrote:
>This patch summarizes the status of hardening and TODO of hardening
>virtio core and drivers.
>
>Signed-off-by: Jason Wang <jasowang@redhat.com>
>---
> Documentation/security/virtio/core.rst | 49 ++++++++++++++++++++++++++
> MAINTAINERS | 1 +
> 2 files changed, 50 insertions(+)
> create mode 100644 Documentation/security/virtio/core.rst
>
>diff --git a/Documentation/security/virtio/core.rst b/Documentation/security/virtio/core.rst
>new file mode 100644
>index 000000000000..b8baa104d7c8
>--- /dev/null
>+++ b/Documentation/security/virtio/core.rst
>@@ -0,0 +1,49 @@
>+================
>+Virtio hardening
>+================
>+
>+The virtio core and drivers should not trust the devices. This means
>+all kinds of input from the device must be validated before being
>+used. This document summarizes the current status and TODO for this
>+validation/hardening efforts.
s/efforts/effort
>+
>+
>+Status
>+======
>+
>+The virtio core and drivers has done some basic hardening:
>+
>+* Config callback hardening: The core makes sure the config interrupt
>+ callbacks are enabled after the driver is ready and disable before
>+ the driver is removed.
>+
>+* Descriptor ring hardening: The metadata of a descriptor were copied
>+ and stored in a driver private memory that can not be accessed by the
>+ device. The eliminates the device triggerable behaviours through the
s/The/This ? (not sure)
)
>+ descriptor ring.
>+
>+* Device configuration space validation: Some of the virtio drivers
>+ validates the fields of device configuration space before try to use
s/validates/validate
>+ them.
>+
>+
>+TODO
>+====
>+
>+* Input buffer length validation: The virtio core needs to validate
>+ the input buffer length validation before passing them to individual
Remove "validation"?
>+ virtio drivers.
>+
>+* Virtqueue callback hardening: The virtio core (or with the help of
>+ the drivers) should guarantee that the virtqueue callbacks should not
>+ be triggered before the driver is ready or after the driver is
>+ removed.
>+
>+* Transport specific data validation: The virtio transport driver should
>+ validate the virtio transport specific data provided by the device
>+ before trying to use them in the probing.
s/in the probing/during the probe ?
>+
>+* Device specific validation: Driver should validate the device specific
>+ metadata before being used by a specific subsystem.
>+
>+
>diff --git a/MAINTAINERS b/MAINTAINERS
>index 673b9f9b8d8a..b33cc5c751c1 100644
>--- a/MAINTAINERS
>+++ b/MAINTAINERS
>@@ -21516,6 +21516,7 @@ S: Maintained
> F: Documentation/ABI/testing/sysfs-bus-vdpa
> F: Documentation/ABI/testing/sysfs-class-vduse
> F: Documentation/devicetree/bindings/virtio/
>+F: Documentation/security/virtio/core.rst
> F: drivers/block/virtio_blk.c
> F: drivers/crypto/virtio/
> F: drivers/net/virtio_net.c
>--
>2.25.1
>
Thanks,
Stefano
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-10-18 15:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-14 4:20 [RFC PATCH] virtio: document virtio hardening status and TODO Jason Wang
2022-10-14 14:01 ` Jonathan Corbet
2022-10-17 6:09 ` Jason Wang
2022-10-18 15:39 ` Stefano Garzarella
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).