diff options
| author | Jason Wang | 2021-02-24 04:44:36 +0100 |
|---|---|---|
| committer | Jason Wang | 2021-03-15 09:41:22 +0100 |
| commit | 705df5466c98f3efdd2b68d3b31dad86858acad7 (patch) | |
| tree | f07da22288195fe5fb2a9aa912d082ad3056bb47 /include/net | |
| parent | e1000: fail early for evil descriptor (diff) | |
| download | qemu-705df5466c98f3efdd2b68d3b31dad86858acad7.tar.gz qemu-705df5466c98f3efdd2b68d3b31dad86858acad7.tar.xz qemu-705df5466c98f3efdd2b68d3b31dad86858acad7.zip | |
net: introduce qemu_receive_packet()
Some NIC supports loopback mode and this is done by calling
nc->info->receive() directly which in fact suppresses the effort of
reentrancy check that is done in qemu_net_queue_send().
Unfortunately we can't use qemu_net_queue_send() here since for
loopback there's no sender as peer, so this patch introduce a
qemu_receive_packet() which is used for implementing loopback mode
for a NIC with this check.
NIC that supports loopback mode will be converted to this helper.
This is intended to address CVE-2021-3416.
Cc: Prasad J Pandit <ppandit@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/net.h | 5 | ||||
| -rw-r--r-- | include/net/queue.h | 8 |
2 files changed, 13 insertions, 0 deletions
diff --git a/include/net/net.h b/include/net/net.h index 919facaad2..4f56cae0fa 100644 --- a/include/net/net.h +++ b/include/net/net.h @@ -144,12 +144,17 @@ void *qemu_get_nic_opaque(NetClientState *nc); void qemu_del_net_client(NetClientState *nc); typedef void (*qemu_nic_foreach)(NICState *nic, void *opaque); void qemu_foreach_nic(qemu_nic_foreach func, void *opaque); +int qemu_can_receive_packet(NetClientState *nc); int qemu_can_send_packet(NetClientState *nc); ssize_t qemu_sendv_packet(NetClientState *nc, const struct iovec *iov, int iovcnt); ssize_t qemu_sendv_packet_async(NetClientState *nc, const struct iovec *iov, int iovcnt, NetPacketSent *sent_cb); ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size); +ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size); +ssize_t qemu_receive_packet_iov(NetClientState *nc, + const struct iovec *iov, + int iovcnt); ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size); ssize_t qemu_send_packet_async(NetClientState *nc, const uint8_t *buf, int size, NetPacketSent *sent_cb); diff --git a/include/net/queue.h b/include/net/queue.h index c0269bb1dc..9f2f289d77 100644 --- a/include/net/queue.h +++ b/include/net/queue.h @@ -55,6 +55,14 @@ void qemu_net_queue_append_iov(NetQueue *queue, void qemu_del_net_queue(NetQueue *queue); +ssize_t qemu_net_queue_receive(NetQueue *queue, + const uint8_t *data, + size_t size); + +ssize_t qemu_net_queue_receive_iov(NetQueue *queue, + const struct iovec *iov, + int iovcnt); + ssize_t qemu_net_queue_send(NetQueue *queue, NetClientState *sender, unsigned flags, |