[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v2] xen-blkback: fix compatibility bug with single page rings


  • To: Paul Durrant <paul@xxxxxxx>
  • From: Roger Pau Monné <roger.pau@xxxxxxxxxx>
  • Date: Tue, 2 Feb 2021 17:28:57 +0100
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=477fdphrfKsIiITpaPq/t+BDg5TfuMxQzRB9zww6uxs=; b=YgHdQBVQe4YK0jTGVYBCEpV/HCcKM79et6AiJePiA8SzxCfdLcwPZ7nN6sVUb81ouvt9dGSg64TjLsWVqRF9+FvdE0ryrCiNJu3P06y04yrc6SZUV8ef8TSq6yGl+JhhthSzZbk15SiXS7RIa/qTnew0wpwK/0DE3Zqp4vbZTzGuZyRz5AHLTHIRTxO+mD0EEqY6sPsUm8VKOrLaszOIg3Up/CZNTs9yqkv7CN4y6vqpS8Huwhdf6M72OwNQVWY+V4WaY44OhqLFug/UOVBzrvpNHDYui1A6b6avzeMfxy1i9QC6XPfs4JsJNXo1FvdhkSL+1YPe4I1W3rl+I8bvJQ==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bRMZ35rgrDiN7iJc+THoOBqsWObnzNauYCn3OxFTnsnDKn9sVdEwRchaVnmu9ta6VzvMwCmTF0P8GrthTKb8kKJzp87IB9uR5Dj2Mnla4r1sWh3Q1RSW/dnil20QPYmyFhTveoAHq2mG3DnrPNL3sIDx2QjbSqiw5VwgBPtfU6FuviJjInD3XjA52Ym7eKniRtaBrQdUmJTdu6by0CpbBbJ2CcuXaAR8tursU+07W+errJQOELlHQeZyIPGV2uTrJQLbZPX7WfsmL+zWb9R/0BTEpxTG60KPfjWMzmcpN6M3jrVp+heoRUyuKk55g4/S2+RBeK8T7orJEd2zZ31+nQ==
  • Authentication-results: esa3.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
  • Cc: <xen-devel@xxxxxxxxxxxxxxxxxxxx>, <linux-block@xxxxxxxxxxxxxxx>, <linux-kernel@xxxxxxxxxxxxxxx>, Paul Durrant <pdurrant@xxxxxxxxxx>, "Konrad Rzeszutek Wilk" <konrad.wilk@xxxxxxxxxx>, Jens Axboe <axboe@xxxxxxxxx>, "Dongli Zhang" <dongli.zhang@xxxxxxxxxx>
  • Delivery-date: Tue, 02 Feb 2021 16:29:55 +0000
  • Ironport-sdr: JQ93LLghNXf1Y8neF05Kz5wNtUOiKwNdjXI3niqK8NhImntjVl55u8MT3spGic9X3ByUSKhTFL hQxmhxbyAUN5wq/baQWYxDE0TuGxrJIhS79nzyBF3mQfyzqaVy/sOjeIObqLH7c54TvOnNIN7u dXHBTdyK6yrA3uLr3VMlIjjuknu7XU6y4ymDxmCQiVgi6h8QUQhC/KtMaA24ad4u9gguqACZSs zSc7PBwPfNlQYbJV2Xg1GQaP/LUxQVF1nqWznMMnme2aH/otsbmtsi+IvZCbq/+gGtLQHO2xDg axQ=
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

On Thu, Jan 28, 2021 at 01:04:41PM +0000, Paul Durrant wrote:
> From: Paul Durrant <pdurrant@xxxxxxxxxx>
> 
> Prior to commit 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid
> inconsistent xenstore 'ring-page-order' set by malicious blkfront"), the
> behaviour of xen-blkback when connecting to a frontend was:
> 
> - read 'ring-page-order'
> - if not present then expect a single page ring specified by 'ring-ref'
> - else expect a ring specified by 'ring-refX' where X is between 0 and
>   1 << ring-page-order
> 
> This was correct behaviour, but was broken by the afforementioned commit to
> become:
> 
> - read 'ring-page-order'
> - if not present then expect a single page ring (i.e. ring-page-order = 0)
> - expect a ring specified by 'ring-refX' where X is between 0 and
>   1 << ring-page-order
> - if that didn't work then see if there's a single page ring specified by
>   'ring-ref'
> 
> This incorrect behaviour works most of the time but fails when a frontend
> that sets 'ring-page-order' is unloaded and replaced by one that does not
> because, instead of reading 'ring-ref', xen-blkback will read the stale
> 'ring-ref0' left around by the previous frontend will try to map the wrong
> grant reference.
> 
> This patch restores the original behaviour.
> 
> Fixes: 4a8c31a1c6f5 ("xen/blkback: rework connect_ring() to avoid 
> inconsistent xenstore 'ring-page-order' set by malicious blkfront")
> Signed-off-by: Paul Durrant <pdurrant@xxxxxxxxxx>
> ---
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
> Cc: "Roger Pau Monné" <roger.pau@xxxxxxxxxx>
> Cc: Jens Axboe <axboe@xxxxxxxxx>
> Cc: Dongli Zhang <dongli.zhang@xxxxxxxxxx>
> 
> v2:
>  - Remove now-spurious error path special-case when nr_grefs == 1
> ---
>  drivers/block/xen-blkback/common.h |  1 +
>  drivers/block/xen-blkback/xenbus.c | 38 +++++++++++++-----------------
>  2 files changed, 17 insertions(+), 22 deletions(-)
> 
> diff --git a/drivers/block/xen-blkback/common.h 
> b/drivers/block/xen-blkback/common.h
> index b0c71d3a81a0..524a79f10de6 100644
> --- a/drivers/block/xen-blkback/common.h
> +++ b/drivers/block/xen-blkback/common.h
> @@ -313,6 +313,7 @@ struct xen_blkif {
>  
>       struct work_struct      free_work;
>       unsigned int            nr_ring_pages;
> +     bool                    multi_ref;

You seem to have used spaces between the type and the variable name
here, while neighbors also use hard tabs.

The rest LGTM:

Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>

We should have forbidden the usage of ring-page-order = 0 and we could
have avoided having to add the multi_ref variable, but that's too late
now.

Thanks, Roger.



 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.