From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vlad Zolotarov Subject: Re: [PATCH 2/2] uio: new driver to support PCI MSI-X Date: Tue, 6 Oct 2015 19:40:41 +0300 Message-ID: <5613F989.6010503@cloudius-systems.com> References: <1443652138-31782-1-git-send-email-stephen@networkplumber.org> <1443652138-31782-3-git-send-email-stephen@networkplumber.org> <20151001104505-mutt-send-email-mst@redhat.com> <20151005215455.GA7608@redhat.com> <20151006013000-mutt-send-email-mst@redhat.com> <561384EF.8020100@cloudius-systems.com> <20151006164259-mutt-send-email-mst@redhat.com> <5613DF71.7090207@cloudius-systems.com> <20151006175634-mutt-send-email-mst@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Cc: dev@dpdk.org, hjk@hansjkoch.de, gregkh@linux-foundation.org, linux-kernel@vger.kernel.org To: "Michael S. Tsirkin" Return-path: Received: from mail-wi0-f170.google.com (mail-wi0-f170.google.com [209.85.212.170]) by dpdk.org (Postfix) with ESMTP id 5A4895697 for ; Tue, 6 Oct 2015 18:40:44 +0200 (CEST) Received: by wicgb1 with SMTP id gb1so173941245wic.1 for ; Tue, 06 Oct 2015 09:40:44 -0700 (PDT) In-Reply-To: <20151006175634-mutt-send-email-mst@redhat.com> List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 10/06/15 18:00, Michael S. Tsirkin wrote: > On Tue, Oct 06, 2015 at 05:49:21PM +0300, Vlad Zolotarov wrote: >>> and read/write the config space. >>> This means that a single userspace bug is enough to corrupt kernel >>> memory. >> Could u, pls., provide and example of this simple bug? Because it's >> absolutely not obvious... > Stick a value that happens to match a kernel address in Msg Addr field > in an unmasked MSI-X entry. This patch neither configures MSI-X entries in the user space nor provides additional means to do so therefore this "sticking" would be a matter of some extra code that is absolutely unrelated to this patch. So, this example seems absolutely irrelevant to this particular discussion. thanks, vlad >