* Re: [RFC PATCH 01/17] virtio_ring: Avoid reading unneeded used length [not found] ` <20210517090836.533-2-xieyongji@bytedance.com> @ 2021-05-17 9:11 ` Johannes Berg 0 siblings, 0 replies; 5+ messages in thread From: Johannes Berg @ 2021-05-17 9:11 UTC (permalink / raw) To: Xie Yongji, mst, jasowang, stefanha Cc: ohad, amit, airlied, linux-kernel, bjorn.andersson, miklos, dan.j.williams, virtualization, vgoyal On Mon, 2021-05-17 at 17:08 +0800, Xie Yongji wrote: > If device driver doesn't need used length, it can pass a NULL > len in virtqueue_get_buf()/virtqueue_get_buf_ctx(). > Well, actually, it can't right now? You should probably rephrase this, saying something like Allow passing NULL to len in ... if the device driver doesn't need the length, and don't read it in that case. or so? > Then > we can avoid reading and validating the len value in used > ring entries. Not sure what that "validating" is about, I only see reading? johannes _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 5+ messages in thread
[parent not found: <20210517090836.533-18-xieyongji@bytedance.com>]
* Re: [RFC PATCH 17/17] virtio_ring: Add validation for used length [not found] ` <20210517090836.533-18-xieyongji@bytedance.com> @ 2021-05-17 23:39 ` Michael S. Tsirkin 2021-05-25 1:31 ` Jason Wang 0 siblings, 1 reply; 5+ messages in thread From: Michael S. Tsirkin @ 2021-05-17 23:39 UTC (permalink / raw) To: Xie Yongji Cc: ohad, amit, airlied, linux-kernel, bjorn.andersson, miklos, stefanha, dan.j.williams, virtualization, johannes, vgoyal On Mon, May 17, 2021 at 05:08:36PM +0800, Xie Yongji wrote: > This adds validation for used length (might come > from an untrusted device) when it will be used by > virtio device driver. > > Signed-off-by: Xie Yongji <xieyongji@bytedance.com> > --- > drivers/virtio/virtio_ring.c | 22 +++++++++++++++++++--- > 1 file changed, 19 insertions(+), 3 deletions(-) > > diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c > index d999a1d6d271..7d4845d06f21 100644 > --- a/drivers/virtio/virtio_ring.c > +++ b/drivers/virtio/virtio_ring.c > @@ -68,11 +68,13 @@ > struct vring_desc_state_split { > void *data; /* Data for callback. */ > struct vring_desc *indir_desc; /* Indirect descriptor, if any. */ > + u32 in_len; /* Total length of writable buffer */ > }; > > struct vring_desc_state_packed { > void *data; /* Data for callback. */ > struct vring_packed_desc *indir_desc; /* Indirect descriptor, if any. */ > + u32 in_len; /* Total length of writable buffer */ > u16 num; /* Descriptor list length. */ > u16 last; /* The last desc state in a list. */ > }; Hmm for packed it's aligned to 64 bit anyway, so we are not making it any worse. But for split this pushes struct size up by 1/3 increasing cache pressure. > @@ -486,7 +488,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, > struct vring_virtqueue *vq = to_vvq(_vq); > struct scatterlist *sg; > struct vring_desc *desc; > - unsigned int i, n, avail, descs_used, prev, err_idx; > + unsigned int i, n, avail, descs_used, prev, err_idx, in_len = 0; > int head; > bool indirect; > > @@ -570,6 +572,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, > VRING_DESC_F_NEXT | > VRING_DESC_F_WRITE, > indirect); > + in_len += sg->length; > } > } > /* Last one doesn't continue. */ > @@ -604,6 +607,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, > > /* Store token and indirect buffer state. */ > vq->split.desc_state[head].data = data; > + vq->split.desc_state[head].in_len = in_len; > if (indirect) > vq->split.desc_state[head].indir_desc = desc; > else > @@ -784,6 +788,10 @@ static void *virtqueue_get_buf_ctx_split(struct virtqueue *_vq, > BAD_RING(vq, "id %u is not a head!\n", i); > return NULL; > } > + if (unlikely(len && vq->split.desc_state[i].in_len < *len)) { > + BAD_RING(vq, "id %u has invalid length: %u!\n", i, *len); > + return NULL; > + } > > /* detach_buf_split clears data, so grab it now. */ > ret = vq->split.desc_state[i].data; > @@ -1059,7 +1067,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, > { > struct vring_packed_desc *desc; > struct scatterlist *sg; > - unsigned int i, n, err_idx; > + unsigned int i, n, err_idx, in_len = 0; > u16 head, id; > dma_addr_t addr; > > @@ -1084,6 +1092,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, > if (vring_mapping_error(vq, addr)) > goto unmap_release; > > + in_len += (n < out_sgs) ? 0 : sg->length; > desc[i].flags = cpu_to_le16(n < out_sgs ? > 0 : VRING_DESC_F_WRITE); > desc[i].addr = cpu_to_le64(addr); > @@ -1141,6 +1150,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, > vq->packed.desc_state[id].data = data; > vq->packed.desc_state[id].indir_desc = desc; > vq->packed.desc_state[id].last = id; > + vq->packed.desc_state[id].in_len = in_len; > > vq->num_added += 1; > > @@ -1173,7 +1183,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, > struct vring_virtqueue *vq = to_vvq(_vq); > struct vring_packed_desc *desc; > struct scatterlist *sg; > - unsigned int i, n, c, descs_used, err_idx; > + unsigned int i, n, c, descs_used, err_idx, in_len = 0; > __le16 head_flags, flags; > u16 head, id, prev, curr, avail_used_flags; > > @@ -1223,6 +1233,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, > if (vring_mapping_error(vq, addr)) > goto unmap_release; > > + in_len += (n < out_sgs) ? 0 : sg->length; > flags = cpu_to_le16(vq->packed.avail_used_flags | > (++c == total_sg ? 0 : VRING_DESC_F_NEXT) | > (n < out_sgs ? 0 : VRING_DESC_F_WRITE)); > @@ -1268,6 +1279,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, > vq->packed.desc_state[id].data = data; > vq->packed.desc_state[id].indir_desc = ctx; > vq->packed.desc_state[id].last = prev; > + vq->packed.desc_state[id].in_len = in_len; > > /* > * A driver MUST NOT make the first descriptor in the list > @@ -1456,6 +1468,10 @@ static void *virtqueue_get_buf_ctx_packed(struct virtqueue *_vq, > BAD_RING(vq, "id %u is not a head!\n", id); > return NULL; > } > + if (unlikely(len && vq->packed.desc_state[id].in_len < *len)) { > + BAD_RING(vq, "id %u has invalid length: %u!\n", id, *len); > + return NULL; > + } > > /* detach_buf_packed clears data, so grab it now. */ > ret = vq->packed.desc_state[id].data; > -- > 2.11.0 _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [RFC PATCH 17/17] virtio_ring: Add validation for used length 2021-05-17 23:39 ` [RFC PATCH 17/17] virtio_ring: Add validation for " Michael S. Tsirkin @ 2021-05-25 1:31 ` Jason Wang 0 siblings, 0 replies; 5+ messages in thread From: Jason Wang @ 2021-05-25 1:31 UTC (permalink / raw) To: Michael S. Tsirkin, Xie Yongji Cc: ohad, amit, airlied, linux-kernel, bjorn.andersson, miklos, stefanha, dan.j.williams, virtualization, johannes, vgoyal 在 2021/5/18 上午7:39, Michael S. Tsirkin 写道: > On Mon, May 17, 2021 at 05:08:36PM +0800, Xie Yongji wrote: >> This adds validation for used length (might come >> from an untrusted device) when it will be used by >> virtio device driver. >> >> Signed-off-by: Xie Yongji <xieyongji@bytedance.com> >> --- >> drivers/virtio/virtio_ring.c | 22 +++++++++++++++++++--- >> 1 file changed, 19 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c >> index d999a1d6d271..7d4845d06f21 100644 >> --- a/drivers/virtio/virtio_ring.c >> +++ b/drivers/virtio/virtio_ring.c >> @@ -68,11 +68,13 @@ >> struct vring_desc_state_split { >> void *data; /* Data for callback. */ >> struct vring_desc *indir_desc; /* Indirect descriptor, if any. */ >> + u32 in_len; /* Total length of writable buffer */ >> }; >> >> struct vring_desc_state_packed { >> void *data; /* Data for callback. */ >> struct vring_packed_desc *indir_desc; /* Indirect descriptor, if any. */ >> + u32 in_len; /* Total length of writable buffer */ >> u16 num; /* Descriptor list length. */ >> u16 last; /* The last desc state in a list. */ >> }; > > Hmm for packed it's aligned to 64 bit anyway, so we are not making it > any worse. But for split this pushes struct size up by 1/3 increasing > cache pressure. We can eliminate this by validating through virtio device driver instead of virtio core. E.g for virtio-net we know the rx buffer size so there's no need to store in twice in the core. Thanks > > >> @@ -486,7 +488,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, >> struct vring_virtqueue *vq = to_vvq(_vq); >> struct scatterlist *sg; >> struct vring_desc *desc; >> - unsigned int i, n, avail, descs_used, prev, err_idx; >> + unsigned int i, n, avail, descs_used, prev, err_idx, in_len = 0; >> int head; >> bool indirect; >> >> @@ -570,6 +572,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, >> VRING_DESC_F_NEXT | >> VRING_DESC_F_WRITE, >> indirect); >> + in_len += sg->length; >> } >> } >> /* Last one doesn't continue. */ >> @@ -604,6 +607,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, >> >> /* Store token and indirect buffer state. */ >> vq->split.desc_state[head].data = data; >> + vq->split.desc_state[head].in_len = in_len; >> if (indirect) >> vq->split.desc_state[head].indir_desc = desc; >> else >> @@ -784,6 +788,10 @@ static void *virtqueue_get_buf_ctx_split(struct virtqueue *_vq, >> BAD_RING(vq, "id %u is not a head!\n", i); >> return NULL; >> } >> + if (unlikely(len && vq->split.desc_state[i].in_len < *len)) { >> + BAD_RING(vq, "id %u has invalid length: %u!\n", i, *len); >> + return NULL; >> + } >> >> /* detach_buf_split clears data, so grab it now. */ >> ret = vq->split.desc_state[i].data; >> @@ -1059,7 +1067,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, >> { >> struct vring_packed_desc *desc; >> struct scatterlist *sg; >> - unsigned int i, n, err_idx; >> + unsigned int i, n, err_idx, in_len = 0; >> u16 head, id; >> dma_addr_t addr; >> >> @@ -1084,6 +1092,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, >> if (vring_mapping_error(vq, addr)) >> goto unmap_release; >> >> + in_len += (n < out_sgs) ? 0 : sg->length; >> desc[i].flags = cpu_to_le16(n < out_sgs ? >> 0 : VRING_DESC_F_WRITE); >> desc[i].addr = cpu_to_le64(addr); >> @@ -1141,6 +1150,7 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq, >> vq->packed.desc_state[id].data = data; >> vq->packed.desc_state[id].indir_desc = desc; >> vq->packed.desc_state[id].last = id; >> + vq->packed.desc_state[id].in_len = in_len; >> >> vq->num_added += 1; >> >> @@ -1173,7 +1183,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, >> struct vring_virtqueue *vq = to_vvq(_vq); >> struct vring_packed_desc *desc; >> struct scatterlist *sg; >> - unsigned int i, n, c, descs_used, err_idx; >> + unsigned int i, n, c, descs_used, err_idx, in_len = 0; >> __le16 head_flags, flags; >> u16 head, id, prev, curr, avail_used_flags; >> >> @@ -1223,6 +1233,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, >> if (vring_mapping_error(vq, addr)) >> goto unmap_release; >> >> + in_len += (n < out_sgs) ? 0 : sg->length; >> flags = cpu_to_le16(vq->packed.avail_used_flags | >> (++c == total_sg ? 0 : VRING_DESC_F_NEXT) | >> (n < out_sgs ? 0 : VRING_DESC_F_WRITE)); >> @@ -1268,6 +1279,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, >> vq->packed.desc_state[id].data = data; >> vq->packed.desc_state[id].indir_desc = ctx; >> vq->packed.desc_state[id].last = prev; >> + vq->packed.desc_state[id].in_len = in_len; >> >> /* >> * A driver MUST NOT make the first descriptor in the list >> @@ -1456,6 +1468,10 @@ static void *virtqueue_get_buf_ctx_packed(struct virtqueue *_vq, >> BAD_RING(vq, "id %u is not a head!\n", id); >> return NULL; >> } >> + if (unlikely(len && vq->packed.desc_state[id].in_len < *len)) { >> + BAD_RING(vq, "id %u has invalid length: %u!\n", id, *len); >> + return NULL; >> + } >> >> /* detach_buf_packed clears data, so grab it now. */ >> ret = vq->packed.desc_state[id].data; >> -- >> 2.11.0 _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [RFC PATCH 00/17] Add validation for used length [not found] <20210517090836.533-1-xieyongji@bytedance.com> [not found] ` <20210517090836.533-2-xieyongji@bytedance.com> [not found] ` <20210517090836.533-18-xieyongji@bytedance.com> @ 2021-05-17 23:40 ` Michael S. Tsirkin [not found] ` <CACycT3uWexPNTiroO5EBT9q8YOorvvVaY_kymapWkLZ078J7aQ@mail.gmail.com> 2 siblings, 1 reply; 5+ messages in thread From: Michael S. Tsirkin @ 2021-05-17 23:40 UTC (permalink / raw) To: Xie Yongji Cc: ohad, amit, airlied, linux-kernel, bjorn.andersson, miklos, stefanha, dan.j.williams, virtualization, johannes, vgoyal On Mon, May 17, 2021 at 05:08:19PM +0800, Xie Yongji wrote: > Current virtio device drivers may trust the used length returned > in virtqueue_get_buf()/virtqueue_get_buf_ctx(). But the used length > might come from an untrusted device when VDUSE[1] is enabled. To > protect this case, this series tries to add validation for the > used length. > > Since many legacy devices will also set the used length incorrectly, > we did not add the validation unconditionally. Instead, we will do > the validation only when the device driver needs the used length. > A NULL len passed to virtqueue_get_buf()/virtqueue_get_buf_ctx() > will mean the used length is not needed by the device driver. Can we be more specific? Which drivers have problems when used len is incorrect? Maybe there's an easier way like validating the length in the driver ... > [1] https://lore.kernel.org/kvm/20210331080519.172-1-xieyongji@bytedance.com/ > > Xie Yongji (17): > virtio_ring: Avoid reading unneeded used length > virtio-blk: Remove unused used length > virtio_console: Remove unused used length > crypto: virtio - Remove unused used length > drm/virtio: Remove unused used length > caif_virtio: Remove unused used length > virtio_net: Remove unused used length > mac80211_hwsim: Remove unused used length > virtio_pmem: Remove unused used length > rpmsg: virtio: Remove unused used length > virtio_scsi: Remove unused used length > virtio_balloon: Remove unused used length > virtio_input: Remove unused used length > virtio_mem: Remove unused used length > virtiofs: Remove unused used length > vsock: Remove unused used length > virtio_ring: Add validation for used length > > drivers/block/virtio_blk.c | 3 +-- > drivers/char/virtio_console.c | 12 ++++-------- > drivers/crypto/virtio/virtio_crypto_algs.c | 6 ++---- > drivers/gpu/drm/virtio/virtgpu_vq.c | 3 +-- > drivers/net/caif/caif_virtio.c | 3 +-- > drivers/net/virtio_net.c | 10 ++++------ > drivers/net/wireless/mac80211_hwsim.c | 3 +-- > drivers/nvdimm/nd_virtio.c | 3 +-- > drivers/rpmsg/virtio_rpmsg_bus.c | 3 +-- > drivers/scsi/virtio_scsi.c | 3 +-- > drivers/virtio/virtio_balloon.c | 21 ++++++++++----------- > drivers/virtio/virtio_input.c | 6 ++---- > drivers/virtio/virtio_mem.c | 3 +-- > drivers/virtio/virtio_ring.c | 28 +++++++++++++++++++++++----- > fs/fuse/virtio_fs.c | 6 ++---- > net/vmw_vsock/virtio_transport.c | 3 +-- > 16 files changed, 56 insertions(+), 60 deletions(-) > > -- > 2.11.0 _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 5+ messages in thread
[parent not found: <CACycT3uWexPNTiroO5EBT9q8YOorvvVaY_kymapWkLZ078J7aQ@mail.gmail.com>]
* Re: Re: [RFC PATCH 00/17] Add validation for used length [not found] ` <CACycT3uWexPNTiroO5EBT9q8YOorvvVaY_kymapWkLZ078J7aQ@mail.gmail.com> @ 2021-05-18 9:52 ` Michael S. Tsirkin 0 siblings, 0 replies; 5+ messages in thread From: Michael S. Tsirkin @ 2021-05-18 9:52 UTC (permalink / raw) To: Yongji Xie Cc: Ohad Ben Cohen, amit, airlied, linux-kernel, bjorn.andersson, miklos, Stefan Hajnoczi, dan.j.williams, virtualization, Johannes Berg, vgoyal On Tue, May 18, 2021 at 04:29:44PM +0800, Yongji Xie wrote: > On Tue, May 18, 2021 at 7:40 AM Michael S. Tsirkin <mst@redhat.com> wrote: > > > > On Mon, May 17, 2021 at 05:08:19PM +0800, Xie Yongji wrote: > > > Current virtio device drivers may trust the used length returned > > > in virtqueue_get_buf()/virtqueue_get_buf_ctx(). But the used length > > > might come from an untrusted device when VDUSE[1] is enabled. To > > > protect this case, this series tries to add validation for the > > > used length. > > > > > > Since many legacy devices will also set the used length incorrectly, > > > we did not add the validation unconditionally. Instead, we will do > > > the validation only when the device driver needs the used length. > > > A NULL len passed to virtqueue_get_buf()/virtqueue_get_buf_ctx() > > > will mean the used length is not needed by the device driver. > > > > Can we be more specific? Which drivers have problems when used len > > is incorrect? Maybe there's an easier way like validating the length > > in the driver ... > > > > It's ok to me. But this means all future new drivers need to remember > to do the validation. > > Now only virtio-net and virtio-console drivers have this problem. I > can send some patches to fix it. > > Thanks, > Yongji I'd say let's just document the requirement for now. -- MST _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-05-25 1:31 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20210517090836.533-1-xieyongji@bytedance.com>
[not found] ` <20210517090836.533-2-xieyongji@bytedance.com>
2021-05-17 9:11 ` [RFC PATCH 01/17] virtio_ring: Avoid reading unneeded used length Johannes Berg
[not found] ` <20210517090836.533-18-xieyongji@bytedance.com>
2021-05-17 23:39 ` [RFC PATCH 17/17] virtio_ring: Add validation for " Michael S. Tsirkin
2021-05-25 1:31 ` Jason Wang
2021-05-17 23:40 ` [RFC PATCH 00/17] " Michael S. Tsirkin
[not found] ` <CACycT3uWexPNTiroO5EBT9q8YOorvvVaY_kymapWkLZ078J7aQ@mail.gmail.com>
2021-05-18 9:52 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).