Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-22 Thread Li Qiang
Jason Wang 于2020年7月22日周三 下午1:49写道： > > > On 2020/7/22 下午12:47, Li Qiang wrote: > > Jason Wang 于2020年7月22日周三 上午11:32写道： > >> > >> On 2020/7/21 下午11:17, Li Qiang wrote: > >>> Alexander Bulekov reported a UAF bug related e1000e packets send. > >>> > >>> -->https://bugs.launchpad.net/qemu/+bug/188636

Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-22 Thread Jason Wang
On 2020/7/22 下午1:49, Jason Wang wrote: On 2020/7/22 下午12:47, Li Qiang wrote: Jason Wang 于2020年7月22日周三 上午11:32写道： On 2020/7/21 下午11:17, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the gu

Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-21 Thread Jason Wang
On 2020/7/22 下午12:47, Li Qiang wrote: Jason Wang 于2020年7月22日周三 上午11:32写道： On 2020/7/21 下午11:17, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set

Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-21 Thread P J P
+-- On Wed, 22 Jul 2020, Jason Wang wrote --+ | On 2020/7/21 下午11:17, Li Qiang wrote: | > Alexander Bulekov reported a UAF bug related e1000e packets send. | > | > -->https://bugs.launchpad.net/qemu/+bug/1886362 | > | > This is because the guest trigger a e1000e packet send and set the | > data's a

Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-21 Thread Li Qiang
Jason Wang 于2020年7月22日周三 上午11:32写道： > > > On 2020/7/21 下午11:17, Li Qiang wrote: > > Alexander Bulekov reported a UAF bug related e1000e packets send. > > > > -->https://bugs.launchpad.net/qemu/+bug/1886362 > > > > This is because the guest trigger a e1000e packet send and set the > > data's addres

Re: [PATCH v3] e1000e: using bottom half to send packets

2020-07-21 Thread Jason Wang
On 2020/7/21 下午11:17, Li Qiang wrote: Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set the data's address to e1000e's MMIO address. So when the e1000e do DMA it will

[PATCH v3] e1000e: using bottom half to send packets

2020-07-21 Thread Li Qiang
Alexander Bulekov reported a UAF bug related e1000e packets send. -->https://bugs.launchpad.net/qemu/+bug/1886362 This is because the guest trigger a e1000e packet send and set the data's address to e1000e's MMIO address. So when the e1000e do DMA it will write the MMIO again and trigger re-entra