From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefan Hajnoczi Subject: [PATCH 1/8] vhost: add security model documentation to vhost_user.c Date: Mon, 5 Feb 2018 12:16:35 +0000 Message-ID: <20180205121642.26428-2-stefanha@redhat.com> References: <20180205121642.26428-1-stefanha@redhat.com> Cc: Maxime Coquelin , Yuanhan Liu , Stefan Hajnoczi To: dev@dpdk.org Return-path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by dpdk.org (Postfix) with ESMTP id 7C04C1B332 for ; Mon, 5 Feb 2018 13:16:58 +0100 (CET) In-Reply-To: <20180205121642.26428-1-stefanha@redhat.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Input validation is not applied consistently in vhost_user.c. This suggests that not everyone has the same security model in mind when working on the code. Make the security model explicit so that everyone can understand and follow the same model when modifying the code. Signed-off-by: Stefan Hajnoczi --- lib/librte_vhost/vhost_user.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index 1dd1a61b6..a96afbe84 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -2,6 +2,23 @@ * Copyright(c) 2010-2016 Intel Corporation */ +/* Security model + * -------------- + * The vhost-user protocol connection is an external interface, so it must be + * robust against invalid inputs. + * + * This is important because the vhost-user master is only one step removed + * from the guest. Malicious guests that have escaped will then launch further + * attacks from the vhost-user master. + * + * Even in deployments where guests are trusted, a bug in the vhost-user master + * can still cause invalid messages to be sent. Such messages must not + * compromise the stability of the DPDK application by causing crashes, memory + * corruption, or other problematic behavior. + * + * Do not assume received VhostUserMsg fields contain sensible values! + */ + #include #include #include -- 2.14.3