All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jason Wang <jasowang@redhat.com>
To: peter.maydell@linaro.org
Cc: Jason Wang <jasowang@redhat.com>,
	qemu-stable@nongnu.org, qemu-devel@nongnu.org,
	Prasad J Pandit <ppandit@redhat.com>
Subject: [PULL V2 07/20] dp8393x: switch to use qemu_receive_packet() for loopback packet
Date: Mon, 15 Mar 2021 17:14:20 +0800	[thread overview]
Message-ID: <1615799673-31549-8-git-send-email-jasowang@redhat.com> (raw)
In-Reply-To: <1615799673-31549-1-git-send-email-jasowang@redhat.com>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/dp8393x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 205c0de..533a830 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -506,7 +506,7 @@ static void dp8393x_do_transmit_packets(dp8393xState *s)
             s->regs[SONIC_TCR] |= SONIC_TCR_CRSL;
             if (nc->info->can_receive(nc)) {
                 s->loopback_packet = 1;
-                nc->info->receive(nc, s->tx_buffer, tx_len);
+                qemu_receive_packet(nc, s->tx_buffer, tx_len);
             }
         } else {
             /* Transmit packet */
-- 
2.7.4



  parent reply	other threads:[~2021-03-15  9:23 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-15  9:14 [PULL V2 00/20] Net patches Jason Wang
2021-03-15  9:14 ` [PULL V2 01/20] virtio-net: calculating proper msix vectors on init Jason Wang
2021-03-15  9:14 ` [PULL V2 02/20] net: Fix build error when DEBUG_NET is on Jason Wang
2021-03-15  9:14 ` [PULL V2 03/20] net: validate that ids are well formed Jason Wang
2021-03-15  9:14 ` [PULL V2 04/20] e1000: fail early for evil descriptor Jason Wang
2021-03-15  9:14 ` [PULL V2 05/20] net: introduce qemu_receive_packet() Jason Wang
2021-03-15  9:14 ` [PULL V2 06/20] e1000: switch to use qemu_receive_packet() for loopback Jason Wang
2021-03-15  9:14 ` Jason Wang [this message]
2021-03-15  9:14 ` [PULL V2 08/20] msf2-mac: " Jason Wang
2021-03-15  9:14 ` [PULL V2 09/20] sungem: " Jason Wang
2021-03-15  9:14 ` [PULL V2 10/20] tx_pkt: switch to use qemu_receive_packet_iov() " Jason Wang
2021-03-15  9:14 ` [PULL V2 11/20] rtl8139: switch to use qemu_receive_packet() " Jason Wang
2021-03-15  9:14 ` [PULL V2 12/20] pcnet: " Jason Wang
2021-03-15  9:14 ` [PULL V2 13/20] cadence_gem: " Jason Wang
2021-03-15  9:14 ` [PULL V2 14/20] lan9118: " Jason Wang
2021-03-15  9:14 ` [PULL V2 15/20] pvrdma: wean code off pvrdma_ring.h kernel header Jason Wang
2021-03-15  9:14 ` [PULL V2 16/20] qapi: net: Add query-netdev command Jason Wang
2021-03-16 21:27   ` Peter Maydell
2021-03-17  4:16     ` Jason Wang
2021-03-16 21:37   ` Peter Maydell
2021-03-17  3:34     ` Jason Wang
2021-03-25  2:36       ` Jason Wang
2021-03-15  9:14 ` [PULL V2 17/20] tests: Add tests for " Jason Wang
2021-03-15  9:14 ` [PULL V2 18/20] net: Move NetClientState.info_str to dynamic allocations Jason Wang
2021-03-15  9:14 ` [PULL V2 19/20] hmp: Use QAPI NetdevInfo in hmp_info_network Jason Wang
2021-03-15  9:14 ` [PULL V2 20/20] net: Do not fill legacy info_str for backends Jason Wang
2021-03-16 12:30 ` [PULL V2 00/20] Net patches Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1615799673-31549-8-git-send-email-jasowang@redhat.com \
    --to=jasowang@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=ppandit@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.