From: Stefan Hajnoczi Date: Mon, 5 Feb 2018 12:16:00 +0000 (+0100) Subject: vhost: add security model documentation X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=c45427a48e5eb797e59a55d19d1e9577aff0d4b0;p=dpdk.git vhost: add security model documentation Input validation is not applied consistently in vhost_user.c. This suggests that not everyone has the same security model in mind when working on the code. Make the security model explicit so that everyone can understand and follow the same model when modifying the code. Signed-off-by: Stefan Hajnoczi Acked-by: John McNamara Reviewed-by: Maxime Coquelin --- diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index 90ed2112e0..6db50affaf 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -2,6 +2,23 @@ * Copyright(c) 2010-2016 Intel Corporation */ +/* Security model + * -------------- + * The vhost-user protocol connection is an external interface, so it must be + * robust against invalid inputs. + * + * This is important because the vhost-user master is only one step removed + * from the guest. Malicious guests that have escaped will then launch further + * attacks from the vhost-user master. + * + * Even in deployments where guests are trusted, a bug in the vhost-user master + * can still cause invalid messages to be sent. Such messages must not + * compromise the stability of the DPDK application by causing crashes, memory + * corruption, or other problematic behavior. + * + * Do not assume received VhostUserMsg fields contain sensible values! + */ + #include #include #include