Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 8 Jul 2021 10:22:31 -0400
From:   Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To:     Juergen Gross <jgross@suse.com>
Cc:     xen-devel@lists.xenproject.org, linux-block@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        Stefano Stabellini <sstabellini@kernel.org>,
        Roger Pau =?iso-8859-1?Q?Monn=E9?= <roger.pau@citrix.com>,
        Jens Axboe <axboe@kernel.dk>
Subject: Re: [PATCH v2 0/3] xen: harden blkfront against malicious backends
Message-ID: <YOcKJ6m31tHuq2kh@char.us.oracle.com>
References: <20210708124345.10173-1-jgross@suse.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210708124345.10173-1-jgross@suse.com>
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from char.us.oracle.com (130.44.160.152) by MN2PR10CA0032.namprd10.prod.outlook.com (2603:10b6:208:120::45) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.19 via Frontend Transport; Thu, 8 Jul 2021 14:22:34 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: d36ba2f3-bf74-4b9b-d202-08d9421bd50b
X-MS-TrafficTypeDiagnostic: SJ0PR10MB4784:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <SJ0PR10MB47849DD12284E1917D44FB4489199@SJ0PR10MB4784.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8273;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: NpJNicft54NU0o5bY+ypmRKcSOJzBbttEiPos6zjQgNHWTRB6mv0vygbpsSkhlJBWcLfDP129P2h6ncn4Ao9h0ekIDnbspLQ3QBlo3cbDWJfEIC7rIizcCebUuggqrlhf0G3ugw6BbxJXAQFtHVejXMfg2eenI5RAtDn9T5oKZrbkOOR5BfO1BpTkGRk2c6DXmktXa+nrUx13MoGYRkch6b70jFFVwJQI2F+/ae3bsHJOhQ7Ncx6TXB6jNFwyrdQ4K8TZc1qblpMvwiamDNbJfb12cXOJd5a7LAy1+Ij/If1qYtS47aV1xu7iY7aeLVAGEI2lmg5x/LXUFH/fatCHidvPWI559WRWNZhFG6bP86io3u50+Kl5rquUI5GwNYs2zKVDTsth+xwCAeNdvbTuUN6wy2E5uzRTNT1lGSepZ+tX5EFRaoz7/jLRVRAlks1iZaysOFNVi/y24YBLahyyI6EIscOblnNc6iocZhBMUxTDfJv2g+cmEKo+r+3wO95Z70wbZDqkcqYXAmYsf9nWQGIlez3s+wWGA1IstH1LwlaAUBccQcEOL43yDSGL1JX8uF5QA/wbAGFU9wDowNtwXToysuPc2K3oIQjDQ3ThwJVeI0RCUjWYs8FIKyR9Z0laCsIWQr9AvtBolKGJ23MdgY+hQ9bP/42EyRaGcDtwkTq8v6144XmoqiVQCdmjJPn64/nNgFayKjuLZbYEw18FsafJIOIgeX8rYHER5cEDCHof9aqtLBvtccwJe7p7MytWEcVk4VcjLC7vrlmCzajIIF90bxLCmlgqosgnn8YAu8=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BYAPR10MB2999.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(376002)(346002)(39860400002)(136003)(396003)(478600001)(316002)(38350700002)(86362001)(966005)(38100700002)(2906002)(83380400001)(52116002)(6916009)(26005)(7696005)(8936002)(54906003)(186003)(8676002)(4326008)(6666004)(66476007)(66946007)(66556008)(956004)(5660300002)(55016002);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?y3ARb6nCAKV3Czv7MtYPpmokDhR/zrnUzhjSPOK7Rcq027a1q0auvcQfbfRh?=
 =?us-ascii?Q?GrDKA0zJTL9PIf7YUB+svcFOoUY0z/OMzJ5vf73B54cgM4bdTB24ubBak0+d?=
 =?us-ascii?Q?8CcY/ha3JbHxOzDQlDHtMfdRoKq2/M167r7MpgZPWP39CaFnaR/tm1MBVDfR?=
 =?us-ascii?Q?nOBVmeDeYPA6dOn8SmfcOc86unJHDXZt/13wzafPAL5o6FioyRBB81T49BsX?=
 =?us-ascii?Q?NbUaL0M97O1nmigeGpx+PhBuPPawSUYF0BKq+bCmS6pEZX5KzLZ2Lv62ZSxZ?=
 =?us-ascii?Q?5HxGQWqwXDVK9tygyd+zm0QSA0XLv8dfeuHbLgt8lMUjkjas9MNnwaflR5Gb?=
 =?us-ascii?Q?PuboWg/NHCL646vFWy4qpdDCTUmi7ZonVW19jIn8HYWxRgv7esjeePAPPMPY?=
 =?us-ascii?Q?ZkTFe6RMjz67kX03nQKlle5Eu24zIAO+qg0K0cGo1ebELE78Psjym7ccxtue?=
 =?us-ascii?Q?xPJXYgKB0spNZChvX76VetlRiogU5aqvO5fLs/7LLKiYO9OoHDLJSv/5humf?=
 =?us-ascii?Q?tcVYDrs6U62UxAa6EaQROPJbweFBUnDgeh5aQNKFiK5licpny3I2iylvDFsj?=
 =?us-ascii?Q?YGmeR0NaD2v3152+HRZ2jHp5J8fVWNTZ2B2ngxJJUxj1ArYvXXNBy+BOS98R?=
 =?us-ascii?Q?N5v35WC2su+E46NwySSmhNIH3kErwjIwEbPObmXnAUdeMTJA5KXchFPn1rp9?=
 =?us-ascii?Q?LiPb4OmXlNTm4RkttT43mDbJytFDhJVLaxSQtOYsxVXO2PKs2htM/mkxf4qP?=
 =?us-ascii?Q?5wJvNyrY/4KyERZ/3IPI8XiEeWySqoFXb4uc2lTI13xlhzvubYQmS95tGppq?=
 =?us-ascii?Q?Ym2e9g+fpuCzY5iptD3K1YrwbOLEJlvdDusgnCqh50IEThCcGRwaTQYzD6cq?=
 =?us-ascii?Q?mdmW3CXXcSCqTp9ldmeKMjG+bW/WjaP/xp9PjXedqX/Hs0sgQUAb0ehogCbo?=
 =?us-ascii?Q?tCwJAb3dqSWiC41Nz+FK9flmFQJYeWCLS4la9FDY/9X3XKQhpH3sOOKlfaVu?=
 =?us-ascii?Q?U4SfGYWPfUHzIULcelfC0OMyiHLK0jSu8Vc+srBdhyMNxpIo5mcIrd7Il6j/?=
 =?us-ascii?Q?Yx6/sz/FKCpOPaCN81TPqk+eZmh+HFAhvCzBQ+XaNcwOFcAhPo5+h/X4au4+?=
 =?us-ascii?Q?FTDdUCvwVn4knty8ZhJMJmSGDWdfLpUxWcJIX7TF9ypwmNtkEPnuKFB/heVd?=
 =?us-ascii?Q?Tw6xkEuFJy0cVUbSFKneVg5efVxxllAsZuG9yjH4rkDulgogwldYa5IH+v3k?=
 =?us-ascii?Q?KOyrwSO3XR81IQ0kesCX+QMZw6xqLmW3ruN9nfinFlK0g9f/7WgcKQCldVPM?=
 =?us-ascii?Q?49gueOoFptQI5UHmwPf3SHiH?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d36ba2f3-bf74-4b9b-d202-08d9421bd50b
X-MS-Exchange-CrossTenant-AuthSource: BYAPR10MB2999.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2021 14:22:35.6637
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tJft0CievwA0O/A/blsVuPrNFEgcrqjXzukmfT7Q9lg5oa/01dqMykVWDAbazvIS2uYBPocCX29YIdHHDW8kww==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4784
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10038 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0
 suspectscore=0 phishscore=0 mlxscore=0 bulkscore=0 adultscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2104190000 definitions=main-2107080078
X-Proofpoint-ORIG-GUID: I-PLq_lY1OLt-zFhG7kTrumscKKdY6nu
X-Proofpoint-GUID: I-PLq_lY1OLt-zFhG7kTrumscKKdY6nu
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Jul 08, 2021 at 02:43:42PM +0200, Juergen Gross wrote:
> Xen backends of para-virtualized devices can live in dom0 kernel, dom0
> user land, or in a driver domain. This means that a backend might
> reside in a less trusted environment than the Xen core components, so
> a backend should not be able to do harm to a Xen guest (it can still
> mess up I/O data, but it shouldn't be able to e.g. crash a guest by
> other means or cause a privilege escalation in the guest).
> 
> Unfortunately blkfront in the Linux kernel is fully trusting its
> backend. This series is fixing blkfront in this regard.
> 
> It was discussed to handle this as a security problem, but the topic
> was discussed in public before, so it isn't a real secret.

Wow. This looks like what Marek did .. in 2018!

https://lists.xenproject.org/archives/html/xen-devel/2018-04/msg02336.html

Would it be worth crediting Marek?
> 
> Changes in V2:
> - put blkfront patches into own series
> - some minor comments addressed
> 
> Juergen Gross (3):
>   xen/blkfront: read response from backend only once
>   xen/blkfront: don't take local copy of a request from the ring page
>   xen/blkfront: don't trust the backend response data blindly
> 
>  drivers/block/xen-blkfront.c | 122 +++++++++++++++++++++++------------
>  1 file changed, 80 insertions(+), 42 deletions(-)
> 
> -- 
> 2.26.2
>