[Devel] [PATCH hci-8.1] drivers/vhost/blk: fail guest writes to a read-only backend

[Alexander Ivanov]

When a disk is attached read-only, QEMU opens the backing block device
O_RDONLY and advertises VIRTIO_BLK_F_RO. vhost_blk_set_backend() checks
only that the fd is a block device, and requests are submitted as bios
straight to the bdev, so a guest that ignores VIRTIO_BLK_F_RO and sends
VIRTIO_BLK_T_OUT gets VIRTIO_BLK_S_OK and modifies the disk.

Complete VIRTIO_BLK_T_OUT with VIRTIO_BLK_S_IOERR when the backend file
lacks FMODE_WRITE or the bdev itself is read-only, as the userspace
virtio-blk device does. The bdev is checked per request since it can be
switched read-only at runtime. Flush stays allowed: it does not modify
data.

Fixes: d8722ff88c5d ("drivers/vhost: vhost-blk accelerator for virtio-blk guests")
https://virtuozzo.atlassian.net/browse/VSTOR-152127
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests

Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/vhost/blk.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index b170439a1806..11ded3214c45 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -443,6 +443,12 @@ static int vhost_blk_req_submit(struct vhost_blk_req *req)
 	return ret;
 }
 
+static bool vhost_blk_backend_ro(struct file *f)
+{
+	return !(f->f_mode & FMODE_WRITE) ||
+	       bdev_read_only(I_BDEV(f->f_mapping->host));
+}
+
 static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 				struct virtio_blk_outhdr *hdr,
 				u16 head, u16 out, u16 in)
@@ -480,6 +486,15 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 
 	switch (hdr->type) {
 	case VIRTIO_BLK_T_OUT:
+		if (vhost_blk_backend_ro(vhost_vq_get_backend(vq))) {
+			status = VIRTIO_BLK_S_IOERR;
+			ret = vhost_blk_set_status(req, status);
+			if (ret)
+				break;
+			vhost_add_used_and_signal(&blk->dev, vq, head,
+						  sizeof(status));
+			break;
+		}
 		req->bi_opf = REQ_OP_WRITE;
 		ret = vhost_blk_req_submit(req);
 		break;
-- 
2.53.0