diff options
author | Alexander Bulekov | 2021-03-01 20:33:43 +0100 |
---|---|---|
committer | Jason Wang | 2021-03-15 09:41:22 +0100 |
commit | e73adfbeec9d4e008630c814759052ed945c3fed (patch) | |
tree | f78236017b4824abb2e54f439f94ff4505f3503a /hw | |
parent | pcnet: switch to use qemu_receive_packet() for loopback (diff) | |
download | qemu-e73adfbeec9d4e008630c814759052ed945c3fed.tar.gz qemu-e73adfbeec9d4e008630c814759052ed945c3fed.tar.xz qemu-e73adfbeec9d4e008630c814759052ed945c3fed.zip |
cadence_gem: switch to use qemu_receive_packet() for loopback
This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.
This is intended to address CVE-2021-3416.
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/net/cadence_gem.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c index 9a4474a084..24b3a0ff66 100644 --- a/hw/net/cadence_gem.c +++ b/hw/net/cadence_gem.c @@ -1275,8 +1275,8 @@ static void gem_transmit(CadenceGEMState *s) /* Send the packet somewhere */ if (s->phy_loop || (s->regs[GEM_NWCTRL] & GEM_NWCTRL_LOCALLOOP)) { - gem_receive(qemu_get_queue(s->nic), s->tx_packet, - total_bytes); + qemu_receive_packet(qemu_get_queue(s->nic), s->tx_packet, + total_bytes); } else { qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet, total_bytes); |