From: Dominique Martinet <asmadeus@codewreck.org>
To: Juergen Gross <jgross@suse.com>
Cc: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>,
v9fs@lists.linux.dev, Eric Van Hensbergen <ericvh@kernel.org>,
Latchesar Ionkov <lucho@ionkov.net>,
Christian Schoenebeck <linux_oss@crudebyte.com>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>,
Ao Wang <wangao@seu.edu.cn>, Xuewei Feng <fengxw06@126.com>,
Qi Li <qli01@tsinghua.edu.cn>, Ke Xu <xuke@tsinghua.edu.cn>,
Stefano Stabellini <sstabellini@kernel.org>
Subject: Re: [PATCH] 9p/xen: drain response work after unbinding IRQ
Date: Thu, 29 Oct 2026 06:05:58 +0900 [thread overview]
Message-ID: <auJjtiJbYfZnVxbC@codewreck.org> (raw)
In-Reply-To: <4d97500e-a489-4e64-aa11-29c3430909f3@suse.com>
Juergen Gross wrote on Thu, Oct 08, 2026 at 12:42:21PM +0200:
> > This one makes sense to me and I've picked it up, but I think
> > "9p/xen: fix use-after-free in p9_xen_request"[1] adding a refcount to
> > the front_priv is too much complexity vs. my understanding of the
> > current threat model -- I can pick it up if someome who understands xen
> > better than me has a proper look.
> >
> > Stefano or Jürgen if you care / have time?
> >
> > [1] https://lore.kernel.org/r/20260529103416.81378-1-zhaoyz24@mails.tsinghua.edu.cn
>
> I think [1] should be taken.
>
> We try to harden frontends against potentially malicious backends running
> in a driver domain. Such a backend could cause the device to be removed on
> the frontend side, so the attack vector is present.
>
> The only reason this doesn't qualify as a Xen security issue is that the
> 9pfs frontend hasn't been yet declared to be security supported regarding
> attacks by the backend. Hopefully we will get there.
As said above I'm happy to take it under the condition that someone who
can validate the patch has a proper look; I don't have much time for 9p
right now and my setup doesn't include any test for xen so I'd rather be
cautious
Thanks,
--
Dominique Martinet | Asmadeus
prev parent reply other threads:[~2026-10-28 21:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-09 15:52 [PATCH] 9p/xen: drain response work after unbinding IRQ Yizhou Zhao
2026-09-13 13:10 ` Dominique Martinet
2026-10-08 10:42 ` Juergen Gross
2026-10-28 21:05 ` Dominique Martinet [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=auJjtiJbYfZnVxbC@codewreck.org \
--to=asmadeus@codewreck.org \
--cc=ericvh@kernel.org \
--cc=fengxw06@126.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux_oss@crudebyte.com \
--cc=lucho@ionkov.net \
--cc=qli01@tsinghua.edu.cn \
--cc=sstabellini@kernel.org \
--cc=stable@vger.kernel.org \
--cc=v9fs@lists.linux.dev \
--cc=wangao@seu.edu.cn \
--cc=xuke@tsinghua.edu.cn \
--cc=yangyx22@mails.tsinghua.edu.cn \
--cc=zhaoyz24@mails.tsinghua.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.