block: do not allow guest to not negotiate VIRTIO_BLK_F_RO - #7705
Merged
Merged
Conversation
Unlike most virtio feature bits, VIRTIO_BLK_F_RO is not optional. It indicates that the host is refusing to permit write operations, and the guest must not be allowed to override it. However, the block device currently does not enforce this. If the guest does not negotiate VIRTIO_BLK_F_RO, the block device will think the device is writable and forward write requests to the backend. This is not a security problem right now because the backing device of a read-only device is always opened read-only. The kernel will thus reject the write operations with EBADF. If support is added for receiving the backing device file descriptor via SCM_RIGHTS (cloud-hypervisor#7704), it will be possible to have a read-only block device backed by a writable file descriptor. This would make the bug a genuine security vulnerability. Fix the bug by explicitly checking if VIRTIO_BLK_F_RO was offered but not negotiated. In this case, log a warning and proceed as if the guest did acknowledge the feature. This always indicates a guest driver bug. Fixes: cloud-hypervisor#7697 Signed-off-by: Demi Marie Obenour <[email protected]>
DemiMarie
marked this pull request as ready for review
February 14, 2026 08:25
rbradford
approved these changes
Feb 14, 2026
Merged
via the queue into
cloud-hypervisor:main
with commit Feb 14, 2026
ce93686
42 of 43 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unlike most virtio feature bits, VIRTIO_BLK_F_RO is not optional. It indicates that the host is refusing to permit write operations, and the guest must not be allowed to override it.
However, the block device currently does not enforce this. If the guest does not negotiate VIRTIO_BLK_F_RO, the block device will think the device is writable and forward write requests to the backend.
This is not a security problem right now because the backing device of a read-only device is always opened read-only. The kernel will thus reject the write operations with EBADF. If support is added for receiving the backing device file descriptor via SCM_RIGHTS (#7704), it will be possible to have a read-only block device backed by a writable file descriptor. This would make the bug a genuine security vulnerability.
Fix the bug by explicitly checking if VIRTIO_BLK_F_RO was offered but not negotiated. In this case, log a warning and proceed as if the guest did acknowledge the feature. This always indicates a guest driver bug.
Fixes: #7697