| Message ID | 20200630153200.1537105-1-lkmlabelt@gmail.com |
|---|---|
| Headers | show |
| Series | Drivers: hv: vmbus: vmbus_requestor data structure for VMBus hardening | expand |
On Tue, Jun 30, 2020 at 11:31:57AM -0400, Andres Beltran wrote: > Currently, VMbus drivers use pointers into guest memory as request IDs > for interactions with Hyper-V. To be more robust in the face of errors > or malicious behavior from a compromised Hyper-V, avoid exposing > guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a > bad request ID that is then treated as the address of a guest data > structure with no validation. Instead, encapsulate these memory > addresses and provide small integers as request IDs. > > The first patch creates the definitions for the data structure, provides > helper methods to generate new IDs and retrieve data, and > allocates/frees the memory needed for vmbus_requestor. > > The second and third patches make use of vmbus_requestor to send request > IDs to Hyper-V in storvsc and netvsc respectively. > > Thanks. > Andres Beltran > > Tested-by: Andrea Parri <parri.andrea@gmail.com> Em, I don't expect the changes introduced since v1 to have any observable effects, but I really don't know: I should be able to complete my testing of this by tomorrow or so; for now, please just ignore this tag. Thanks, Andrea > > Cc: linux-scsi@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: James E.J. Bottomley <jejb@linux.ibm.com> > Cc: Martin K. Petersen <martin.petersen@oracle.com> > Cc: David S. Miller <davem@davemloft.net> > > Andres Beltran (3): > Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus > hardening > scsi: storvsc: Use vmbus_requestor to generate transaction IDs for > VMBus hardening > hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus > hardening > > drivers/hv/channel.c | 154 ++++++++++++++++++++++++++++++ > drivers/net/hyperv/hyperv_net.h | 13 +++ > drivers/net/hyperv/netvsc.c | 79 ++++++++++++--- > drivers/net/hyperv/rndis_filter.c | 1 + > drivers/scsi/storvsc_drv.c | 85 ++++++++++++++--- > include/linux/hyperv.h | 22 +++++ > 6 files changed, 329 insertions(+), 25 deletions(-) > > -- > 2.25.1 >
On Tue, 30 Jun 2020 11:31:57 -0400 Andres Beltran <lkmlabelt@gmail.com> wrote: > Currently, VMbus drivers use pointers into guest memory as request IDs > for interactions with Hyper-V. To be more robust in the face of errors > or malicious behavior from a compromised Hyper-V, avoid exposing > guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a > bad request ID that is then treated as the address of a guest data > structure with no validation. Instead, encapsulate these memory > addresses and provide small integers as request IDs. > > The first patch creates the definitions for the data structure, provides > helper methods to generate new IDs and retrieve data, and > allocates/frees the memory needed for vmbus_requestor. > > The second and third patches make use of vmbus_requestor to send request > IDs to Hyper-V in storvsc and netvsc respectively. > > Thanks. > Andres Beltran > > Tested-by: Andrea Parri <parri.andrea@gmail.com> > > Cc: linux-scsi@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: James E.J. Bottomley <jejb@linux.ibm.com> > Cc: Martin K. Petersen <martin.petersen@oracle.com> > Cc: David S. Miller <davem@davemloft.net> > > Andres Beltran (3): > Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus > hardening > scsi: storvsc: Use vmbus_requestor to generate transaction IDs for > VMBus hardening > hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus > hardening > > drivers/hv/channel.c | 154 ++++++++++++++++++++++++++++++ > drivers/net/hyperv/hyperv_net.h | 13 +++ > drivers/net/hyperv/netvsc.c | 79 ++++++++++++--- > drivers/net/hyperv/rndis_filter.c | 1 + > drivers/scsi/storvsc_drv.c | 85 ++++++++++++++--- > include/linux/hyperv.h | 22 +++++ > 6 files changed, 329 insertions(+), 25 deletions(-) > How does this interact with use of the vmbus in usermode by DPDK through hv_uio_generic? Will it still work?
From: Stephen Hemminger <stephen@networkplumber.org> Sent: Tuesday, June 30, 2020 10:16 AM > > On Tue, 30 Jun 2020 11:31:57 -0400 > Andres Beltran <lkmlabelt@gmail.com> wrote: > > > Currently, VMbus drivers use pointers into guest memory as request IDs > > for interactions with Hyper-V. To be more robust in the face of errors > > or malicious behavior from a compromised Hyper-V, avoid exposing > > guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a > > bad request ID that is then treated as the address of a guest data > > structure with no validation. Instead, encapsulate these memory > > addresses and provide small integers as request IDs. > > > > The first patch creates the definitions for the data structure, provides > > helper methods to generate new IDs and retrieve data, and > > allocates/frees the memory needed for vmbus_requestor. > > > > The second and third patches make use of vmbus_requestor to send request > > IDs to Hyper-V in storvsc and netvsc respectively. > > > > Thanks. > > Andres Beltran > > > > Tested-by: Andrea Parri <parri.andrea@gmail.com> > > > > Cc: linux-scsi@vger.kernel.org > > Cc: netdev@vger.kernel.org > > Cc: James E.J. Bottomley <jejb@linux.ibm.com> > > Cc: Martin K. Petersen <martin.petersen@oracle.com> > > Cc: David S. Miller <davem@davemloft.net> > > > > Andres Beltran (3): > > Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus > > hardening > > scsi: storvsc: Use vmbus_requestor to generate transaction IDs for > > VMBus hardening > > hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus > > hardening > > > > drivers/hv/channel.c | 154 ++++++++++++++++++++++++++++++ > > drivers/net/hyperv/hyperv_net.h | 13 +++ > > drivers/net/hyperv/netvsc.c | 79 ++++++++++++--- > > drivers/net/hyperv/rndis_filter.c | 1 + > > drivers/scsi/storvsc_drv.c | 85 ++++++++++++++--- > > include/linux/hyperv.h | 22 +++++ > > 6 files changed, 329 insertions(+), 25 deletions(-) > > > > How does this interact with use of the vmbus in usermode by DPDK through > hv_uio_generic? > Will it still work? This new mechanism for generating requestIDs to pass to Hyper-V is available for VMbus drivers to use, but drivers that have not been updated to use it are unaffected. So hv_uio_generic will work as it always has. Michael
Currently, VMbus drivers use pointers into guest memory as request IDs for interactions with Hyper-V. To be more robust in the face of errors or malicious behavior from a compromised Hyper-V, avoid exposing guest memory addresses to Hyper-V. Also avoid Hyper-V giving back a bad request ID that is then treated as the address of a guest data structure with no validation. Instead, encapsulate these memory addresses and provide small integers as request IDs. The first patch creates the definitions for the data structure, provides helper methods to generate new IDs and retrieve data, and allocates/frees the memory needed for vmbus_requestor. The second and third patches make use of vmbus_requestor to send request IDs to Hyper-V in storvsc and netvsc respectively. Thanks. Andres Beltran Tested-by: Andrea Parri <parri.andrea@gmail.com> Cc: linux-scsi@vger.kernel.org Cc: netdev@vger.kernel.org Cc: James E.J. Bottomley <jejb@linux.ibm.com> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: David S. Miller <davem@davemloft.net> Andres Beltran (3): Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening drivers/hv/channel.c | 154 ++++++++++++++++++++++++++++++ drivers/net/hyperv/hyperv_net.h | 13 +++ drivers/net/hyperv/netvsc.c | 79 ++++++++++++--- drivers/net/hyperv/rndis_filter.c | 1 + drivers/scsi/storvsc_drv.c | 85 ++++++++++++++--- include/linux/hyperv.h | 22 +++++ 6 files changed, 329 insertions(+), 25 deletions(-)