summaryrefslogtreecommitdiffstats
path: root/hw
diff options
context:
space:
mode:
authorAlexander Bulekov2021-03-01 20:33:43 +0100
committerJason Wang2021-03-15 09:41:22 +0100
commite73adfbeec9d4e008630c814759052ed945c3fed (patch)
treef78236017b4824abb2e54f439f94ff4505f3503a /hw
parentpcnet: switch to use qemu_receive_packet() for loopback (diff)
downloadqemu-e73adfbeec9d4e008630c814759052ed945c3fed.tar.gz
qemu-e73adfbeec9d4e008630c814759052ed945c3fed.tar.xz
qemu-e73adfbeec9d4e008630c814759052ed945c3fed.zip
cadence_gem: switch to use qemu_receive_packet() for loopback
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/net/cadence_gem.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 9a4474a084..24b3a0ff66 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1275,8 +1275,8 @@ static void gem_transmit(CadenceGEMState *s)
/* Send the packet somewhere */
if (s->phy_loop || (s->regs[GEM_NWCTRL] &
GEM_NWCTRL_LOCALLOOP)) {
- gem_receive(qemu_get_queue(s->nic), s->tx_packet,
- total_bytes);
+ qemu_receive_packet(qemu_get_queue(s->nic), s->tx_packet,
+ total_bytes);
} else {
qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
total_bytes);