motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-07-27 04:13:53 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: introduce qemu_receive_packet()

Browse source 
Some NIC supports loopback mode and this is done by calling
nc->info->receive() directly which in fact suppresses the effort of
reentrancy check that is done in qemu_net_queue_send().

Unfortunately we can't use qemu_net_queue_send() here since for
loopback there's no sender as peer, so this patch introduce a
qemu_receive_packet() which is used for implementing loopback mode
for a NIC with this check.

NIC that supports loopback mode will be converted to this helper.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
Jason Wang 2021-02-24 11:44:36 +08:00
parent 3de46e6fc4
commit 705df5466c
4 changed files with 66 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

38
net/net.c
View file

@ -529,6 +529,17 @@ int qemu_set_vnet_be(NetClientState *nc, bool is_be)
#endif
}
int qemu_can_receive_packet(NetClientState *nc)
{
if (nc->receive_disabled) {
return 0;
} else if (nc->info->can_receive &&
!nc->info->can_receive(nc)) {
return 0;
}
return 1;
}
int qemu_can_send_packet(NetClientState *sender)
{
int vm_running = runstate_is_running();
@ -541,13 +552,7 @@ int qemu_can_send_packet(NetClientState *sender)
return 1;
}
if (sender->peer->receive_disabled) {
return 0;
} else if (sender->peer->info->can_receive &&
!sender->peer->info->can_receive(sender->peer)) {
return 0;
}
return 1;
return qemu_can_receive_packet(sender->peer);
}
static ssize_t filter_receive_iov(NetClientState *nc,
@ -680,6 +685,25 @@ ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size)
return qemu_send_packet_async(nc, buf, size, NULL);
}
ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size)
{
if (!qemu_can_receive_packet(nc)) {
return 0;
}
return qemu_net_queue_receive(nc->incoming_queue, buf, size);
}
ssize_t qemu_receive_packet_iov(NetClientState *nc, const struct iovec *iov,
int iovcnt)
{
if (!qemu_can_receive_packet(nc)) {
return 0;
}
return qemu_net_queue_receive_iov(nc->incoming_queue, iov, iovcnt);
}
ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size)
{
return qemu_send_packet_async_with_flags(nc, QEMU_NET_PACKET_FLAG_RAW,