Re: [PATCH v2 1/4] virtio-mem: validate device-reported block size

[David Hildenbrand (Arm)]

On 7/17/26 12:44, Greg Kroah-Hartman wrote:
> On Fri, Jul 17, 2026 at 11:21:34AM +0100, David Hildenbrand (Arm) wrote:
>> On 7/17/26 12:15, Greg Kroah-Hartman wrote:
>>>
>>> Ok, so you want this patch :)
>>
>> I fail to see the value of this patch given that there are plenty of other cases
>> the device can mess with us.
> 
> How can the device mess with us?

I raised some examples already, like lying about which memory chunks it makes
available.

I guess it could also throw a random "requested_size" at us. It could make up a
wrong physical address region. I assume there is plenty more we'd have to check.

Again, I'm not saying that this couldn't/shouldn't be done, but it requires some
*real thought* about all possible things a device could do.

> 
>> But sure, let's check for some conditions if it makes us feel warm and fluffy as
>> we audited a driver and it's now super safe, fine with me.
> 
> I'm all for the folly of "it's an audited driver!" claims, but you all
> need to decide either you do or you do not trust the device.  Either way
> is fine with me.

Well, exactly, that is what I am saying. I don't know what we care about. This
patch here feels incomplete and that's what grinds my gears. It doesn't
magically make us deal with malicious devices.

And I don't buy the story about "buggy virtio-mem devices that set
block_size==0", which doesn't make any sense in any possible reality.

> 
> If you don't trust it, great, take patches that fix that.  If you do
> trust it, great, reject those types of patches.
> 
> But pick one please.

Yes, I'd expect that we have general virtio guifance. I only co-maintain some
virtio bits and have no idea about the expected trust model and when we would
consider a devices trusted.

And what it would take to get there.

-- 
Cheers,

David