Re: [PATCH] e1000e: using bottom half to send packets

2020-07-19 Thread Li Qiang
Jason Wang 于2020年7月20日周一 下午12:00写道: > > > On 2020/7/17 下午11:46, Li Qiang wrote: > > Jason Wang 于2020年7月17日周五 下午1:39写道: > >> > >> On 2020/7/17 下午12:46, Li Qiang wrote: > >>> Jason Wang 于2020年7月17日周五 上午11:10写道: > On 2020/7/17 上午12:14, Li Qiang wrote: > > Alexander Bulekov reported a UAF b

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-19 Thread Jason Wang
On 2020/7/17 下午11:52, Peter Maydell wrote: On Fri, 17 Jul 2020 at 04:11, Jason Wang wrote: I think several things were missed in this patch (take virtio-net as a reference), do we need the following things: - Cancel the bh when VM is stopped. Similarly, what should we do with the bh when th

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-19 Thread Jason Wang
On 2020/7/17 下午11:46, Li Qiang wrote: Jason Wang 于2020年7月17日周五 下午1:39写道: On 2020/7/17 下午12:46, Li Qiang wrote: Jason Wang 于2020年7月17日周五 上午11:10写道: On 2020/7/17 上午12:14, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-17 Thread Peter Maydell
On Fri, 17 Jul 2020 at 04:11, Jason Wang wrote: > I think several things were missed in this patch (take virtio-net as a > reference), do we need the following things: > > - Cancel the bh when VM is stopped. Similarly, what should we do with the bh when the device is reset ? > - A throttle to pr

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-17 Thread Li Qiang
Jason Wang 于2020年7月17日周五 下午1:39写道: > > > On 2020/7/17 下午12:46, Li Qiang wrote: > > Jason Wang 于2020年7月17日周五 上午11:10写道: > >> > >> On 2020/7/17 上午12:14, Li Qiang wrote: > >>> Alexander Bulekov reported a UAF bug related e1000e packets send. > >>> > >>> -->https://bugs.launchpad.net/qemu/+bug/188636

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-16 Thread Jason Wang
On 2020/7/17 下午12:46, Li Qiang wrote: Jason Wang 于2020年7月17日周五 上午11:10写道: On 2020/7/17 上午12:14, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-16 Thread Li Qiang
Jason Wang 于2020年7月17日周五 上午11:10写道: > > > On 2020/7/17 上午12:14, Li Qiang wrote: > > Alexander Bulekov reported a UAF bug related e1000e packets send. > > > > -->https://bugs.launchpad.net/qemu/+bug/1886362 > > > > This is because the guest trigger a e1000e packet send and set the > > data's addres

Re: [PATCH] e1000e: using bottom half to send packets

2020-07-16 Thread Jason Wang
On 2020/7/17 上午12:14, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set the data's address to e1000e's MMIO address. So when the e1000e do DMA it will

[PATCH] e1000e: using bottom half to send packets

2020-07-16 Thread Li Qiang
Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set the data's address to e1000e's MMIO address. So when the e1000e do DMA it will write the MMIO again and trigger re-entra