From: "Roger Pau Monné" <roger.pau@citrix.com>
To: Paul Durrant <paul@xen.org>
Cc: <xen-devel@lists.xenproject.org>, <linux-block@vger.kernel.org>,
<linux-kernel@vger.kernel.org>,
Paul Durrant <pdurrant@amazon.com>,
"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
Jens Axboe <axboe@kernel.dk>,
"Dongli Zhang" <dongli.zhang@oracle.com>
Subject: Re: [PATCH v2] xen-blkback: fix compatibility bug with single page rings
Date: Tue, 2 Feb 2021 17:28:57 +0100 [thread overview]
Message-ID: <YBl9ycif3bG/Y+eR@Air-de-Roger> (raw)
In-Reply-To: <20210128130441.11744-1-paul@xen.org>
On Thu, Jan 28, 2021 at 01:04:41PM +0000, Paul Durrant wrote:
> From: Paul Durrant <pdurrant@amazon.com>
>
> Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid
> inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the
> behaviour of xen-blkback when connecting to a frontend was:
>
> - read 'ring-page-order'
> - if not present then expect a single page ring specified by 'ring-ref'
> - else expect a ring specified by 'ring-refX' where X is between 0 and
> 1 << ring-page-order
>
> This was correct behaviour, but was broken by the afforementioned commit to
> become:
>
> - read 'ring-page-order'
> - if not present then expect a single page ring (i.e. ring-page-order = 0)
> - expect a ring specified by 'ring-refX' where X is between 0 and
> 1 << ring-page-order
> - if that didn't work then see if there's a single page ring specified by
> 'ring-ref'
>
> This incorrect behaviour works most of the time but fails when a frontend
> that sets 'ring-page-order' is unloaded and replaced by one that does not
> because, instead of reading 'ring-ref', xen-blkback will read the stale
> 'ring-ref0' left around by the previous frontend will try to map the wrong
> grant reference.
>
> This patch restores the original behaviour.
>
> Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid inconsistent xenstore 'ring-page-order' set by malicious blkfront")
> Signed-off-by: Paul Durrant <pdurrant@amazon.com>
> ---
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Cc: "Roger Pau Monné" <roger.pau@citrix.com>
> Cc: Jens Axboe <axboe@kernel.dk>
> Cc: Dongli Zhang <dongli.zhang@oracle.com>
>
> v2:
> - Remove now-spurious error path special-case when nr_grefs == 1
> ---
> drivers/block/xen-blkback/common.h | 1 +
> drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++-----------------
> 2 files changed, 17 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
> index b0c71d3a81a0..524a79f10de6 100644
> --- a/drivers/block/xen-blkback/common.h
> +++ b/drivers/block/xen-blkback/common.h
> @@ -313,6 +313,7 @@ struct xen_blkif {
>
> struct work_struct free_work;
> unsigned int nr_ring_pages;
> + bool multi_ref;
You seem to have used spaces between the type and the variable name
here, while neighbors also use hard tabs.
The rest LGTM:
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
We should have forbidden the usage of ring-page-order = 0 and we could
have avoided having to add the multi_ref variable, but that's too late
now.
Thanks, Roger.
next prev parent reply other threads:[~2021-02-02 16:30 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-28 13:04 [PATCH v2] xen-blkback: fix compatibility bug with single page rings Paul Durrant
2021-01-29 6:20 ` Dongli Zhang
2021-01-29 7:35 ` Jürgen Groß
2021-01-29 8:13 ` Paul Durrant
2021-01-30 5:09 ` Dongli Zhang
2021-02-02 9:36 ` Paul Durrant
2021-02-02 16:28 ` Roger Pau Monné [this message]
2021-02-02 16:42 ` Paul Durrant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YBl9ycif3bG/Y+eR@Air-de-Roger \
--to=roger.pau@citrix.com \
--cc=axboe@kernel.dk \
--cc=dongli.zhang@oracle.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@xen.org \
--cc=pdurrant@amazon.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).