All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jason Wang <jasowang@redhat.com>
To: peter.maydell@linaro.org
Cc: Jason Wang <jasowang@redhat.com>,
	Alexander Bulekov <alxndr@bu.edu>,
	qemu-stable@nongnu.org, qemu-devel@nongnu.org,
	Prasad J Pandit <ppandit@redhat.com>
Subject: [PULL 12/16] rtl8139: switch to use qemu_receive_packet() for loopback
Date: Fri, 12 Mar 2021 14:16:22 +0800	[thread overview]
Message-ID: <1615529786-30763-13-git-send-email-jasowang@redhat.com> (raw)
In-Reply-To: <1615529786-30763-1-git-send-email-jasowang@redhat.com>

From: Alexander Bulekov <alxndr@bu.edu>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1910826
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/rtl8139.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 4675ac8..90b4fc6 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -1795,7 +1795,7 @@ static void rtl8139_transfer_frame(RTL8139State *s, uint8_t *buf, int size,
         }
 
         DPRINTF("+++ transmit loopback mode\n");
-        rtl8139_do_receive(qemu_get_queue(s->nic), buf, size, do_interrupt);
+        qemu_receive_packet(qemu_get_queue(s->nic), buf, size);
 
         if (iov) {
             g_free(buf2);
-- 
2.7.4



  parent reply	other threads:[~2021-03-12  6:23 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-12  6:16 [PULL 00/16] Net patches Jason Wang
2021-03-12  6:16 ` [PULL 01/16] virtio-net: calculating proper msix vectors on init Jason Wang
2021-03-12  6:16 ` [PULL 02/16] net: Fix build error when DEBUG_NET is on Jason Wang
2021-03-12  6:16 ` [PULL 03/16] net: validate that ids are well formed Jason Wang
2021-03-12  8:44   ` Paolo Bonzini
2021-03-12 13:26     ` Jason Wang
2021-03-12 14:23       ` Paolo Bonzini
2021-03-12  6:16 ` [PULL 04/16] net: unbreak well-form id check for "-nic" Jason Wang
2021-03-12  6:16 ` [PULL 05/16] e1000: fail early for evil descriptor Jason Wang
2021-03-12  6:16 ` [PULL 06/16] net: introduce qemu_receive_packet() Jason Wang
2021-03-12  6:16 ` [PULL 07/16] e1000: switch to use qemu_receive_packet() for loopback Jason Wang
2021-03-12  6:16 ` [PULL 08/16] dp8393x: switch to use qemu_receive_packet() for loopback packet Jason Wang
2021-03-12  6:16 ` [PULL 09/16] msf2-mac: switch to use qemu_receive_packet() for loopback Jason Wang
2021-03-12  6:16 ` [PULL 10/16] sungem: " Jason Wang
2021-03-12  6:16 ` [PULL 11/16] tx_pkt: switch to use qemu_receive_packet_iov() " Jason Wang
2021-03-12  6:16 ` Jason Wang [this message]
2021-03-12  6:16 ` [PULL 13/16] pcnet: switch to use qemu_receive_packet() " Jason Wang
2021-03-12  6:16 ` [PULL 14/16] cadence_gem: " Jason Wang
2021-03-12  6:16 ` [PULL 15/16] lan9118: " Jason Wang
2021-03-12  6:16 ` [PULL 16/16] pvrdma: wean code off pvrdma_ring.h kernel header Jason Wang
2021-03-14 11:37 ` [PULL 00/16] Net patches Peter Maydell
2021-03-15  3:35   ` Jason Wang
2021-03-15  5:39   ` Thomas Huth
2021-03-15  8:07     ` Jason Wang
2021-03-15  9:52       ` Philippe Mathieu-Daudé

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1615529786-30763-13-git-send-email-jasowang@redhat.com \
    --to=jasowang@redhat.com \
    --cc=alxndr@bu.edu \
    --cc=peter.maydell@linaro.org \
    --cc=ppandit@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.