vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net: Update MemReentrancyGuard for NIC 

Recently MemReentrancyGuard was added to DeviceState to record that the
device is engaging in I/O. The network device backend needs to update it
when delivering a packet to a device.

This implementation follows what bottom half does, but it does not add
a tracepoint for the case that the network device backend started
delivering a packet to a device which is already engaging in I/O. This
is because such reentrancy frequently happens for
qemu_flush_queued_packets() and is insignificant.

Fixes: CVE-2023-3019
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 9050f976e4)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Akihiko Odaki 2023-06-01 12:18:59 +09:00 committed by Michael Tokarev
parent fdebed6dcd
commit 3c0463a650
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/net/net.h
View File

@ -118,6 +118,7 @@ struct NetClientState {
typedef struct NICState {
NetClientState *ncs;
NICConf *conf;
MemReentrancyGuard *reentrancy_guard;
void *opaque;
bool peer_deleted;
} NICState;

14
net/net.c
View File

@ -332,6 +332,7 @@ NICState *qemu_new_nic(NetClientInfo *info,
nic = g_malloc0(info->size + sizeof(NetClientState) * queues);
nic->ncs = (void *)nic + info->size;
nic->conf = conf;
nic->reentrancy_guard = reentrancy_guard,
nic->opaque = opaque;
for (i = 0; i < queues; i++) {
@ -787,6 +788,7 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *sender,
int iovcnt,
void *opaque)
{
MemReentrancyGuard *owned_reentrancy_guard;
NetClientState *nc = opaque;
int ret;
@ -799,12 +801,24 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *sender,
return 0;
}
if (nc->info->type != NET_CLIENT_DRIVER_NIC ||
qemu_get_nic(nc)->reentrancy_guard->engaged_in_io) {
owned_reentrancy_guard = NULL;
} else {
owned_reentrancy_guard = qemu_get_nic(nc)->reentrancy_guard;
owned_reentrancy_guard->engaged_in_io = true;
}
if (nc->info->receive_iov && !(flags & QEMU_NET_PACKET_FLAG_RAW)) {
ret = nc->info->receive_iov(nc, iov, iovcnt);
} else {
ret = nc_sendv_compat(nc, iov, iovcnt, flags);
}
if (owned_reentrancy_guard) {
owned_reentrancy_guard->engaged_in_io = false;
}
if (ret == 0) {
nc->receive_disabled = 1;
}