From nobody Tue Feb 10 02:00:17 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1685589602; cv=none; d=zohomail.com; s=zohoarc; b=kS4XDVGaZtmvFKVhAGp7fK7jUuswVpwwKSgyuJUBNdRy5pEZAlM6CWUty92A8L4NxfKU1/3T+m0+aepTME74uD3lTIJ5tt6QVJ866WOdgI9Re7zywRZeUvkNGhy3x56+E2j6AR4WWU2xp8JZlG7TmilmgWhng9FzzdQtmWlqLQE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1685589602; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject; bh=zmIxJv/RQZ1r+yT76IboD8L/ibu/PXdMmNY/Ba4zw4E=; b=MbaeBklNIgxoFaq9VvXJSdiJaQtuZwH4yrAwBZdvcvH3Gde355wqxwmYlQnuKgG2ZSGQv66XMCzzw1l/dKJcRRidYL3EHo31dOr27UuatmUsDXlCF+ghdnUVlUl6G7pid2EqqdSd7we2umcDMM8e67GFs1pHzMrM4V+xBWzrlMc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1685589601952258.5273088739734; Wed, 31 May 2023 20:20:01 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.542206.845812 (Exim 4.92) (envelope-from ) id 1q4YqZ-00036b-QX; Thu, 01 Jun 2023 03:19:31 +0000 Received: by outflank-mailman (output) from mailman id 542206.845812; Thu, 01 Jun 2023 03:19:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1q4YqZ-00036P-ND; Thu, 01 Jun 2023 03:19:31 +0000 Received: by outflank-mailman (input) for mailman id 542206; Thu, 01 Jun 2023 03:19:30 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1q4YqY-0002Ws-EU for xen-devel@lists.xenproject.org; Thu, 01 Jun 2023 03:19:30 +0000 Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [2607:f8b0:4864:20::535]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 1e2db27f-002b-11ee-b231-6b7b168915f2; Thu, 01 Jun 2023 05:19:29 +0200 (CEST) Received: by mail-pg1-x535.google.com with SMTP id 41be03b00d2f7-5289cf35eeaso1244522a12.1 for ; Wed, 31 May 2023 20:19:29 -0700 (PDT) Received: from alarm.flets-east.jp ([2400:4050:a840:1e00:78d2:b862:10a7:d486]) by smtp.gmail.com with ESMTPSA id jd5-20020a170903260500b001a245b49731sm2146753plb.128.2023.05.31.20.19.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 May 2023 20:19:27 -0700 (PDT) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 1e2db27f-002b-11ee-b231-6b7b168915f2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=daynix-com.20221208.gappssmtp.com; s=20221208; t=1685589568; x=1688181568; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=zmIxJv/RQZ1r+yT76IboD8L/ibu/PXdMmNY/Ba4zw4E=; b=LifDaFHsjEizUqk1VXUEMNKpYG+2uFwQWZ6WmhqcXRIokhq+sF0/tOYP3m8p66m5Sw ixVkHy6LMbrBelnPG8Q1Q9VRLCT+uqGDYCGM6cpIlvIhSQ3FFZGbw6zk85tp5GfS+ldw Da0krCI3eNH0oCEHagqgTjS5JGpkwahp96+PqTHoZpg3dydVTmpmjawNVceSXeK03RKl uDHry/5Rb534a/JTOwsP6b8N7HJmZpCpM7hLTgB3X2valR5fHWq29yMLiL9qGTiqTqCE IGUaKyP4J9vbFD+3AyXaVCi4WEEzIHEifi3LI1MYz+fnnZmTcLeNYfg5/h7F5O8KGHQI qzIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685589568; x=1688181568; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zmIxJv/RQZ1r+yT76IboD8L/ibu/PXdMmNY/Ba4zw4E=; b=SvGpBABI9Hwz/+ixPn9rhKZF2N+45b7u8BvHuKENyTbb6DwJZBQQN79IPuKozRAGnK tT+k91E1d3NPiWOwpWVVwj5hizRMfoLpvWz1BRp12QXxPNRnzvoGVg8e2ykyDwJXudta vjERt9kJHmWTy226Cnz+TC1XR9lVoa6abFE5YR5I+WY2qaCFDmGwX8uhDOqWR37zAtq+ l2+U7x9XNcnCcMBinFshY1DmKhBfUdvFHbMVgMqTMIWBjSEQaTUexFFbfUuo/ok1+g1u Tsut3WtoFWYI8ZivNVrnZ3ccqRemeEhM/CiqQ1ChrU9Ptv7PnU2k7UFzAlFAcdwq0sNQ m1rg== X-Gm-Message-State: AC+VfDyREjs+PsBjAmSV6Pr5tXKDDuh19s7zAXRGZUl8RnFHpSqULcyg JncRzfJUG09DvB+66fsIOZChLA== X-Google-Smtp-Source: ACHHUZ5miu5cdAr+t12FHP1vTIi7NetVQS5akrT+IyNAzvoVQFkZ1wGN5w557t12H8/USySWfc8W4g== X-Received: by 2002:a17:902:daca:b0:1ad:d542:6e14 with SMTP id q10-20020a170902daca00b001add5426e14mr680893plx.12.1685589567904; Wed, 31 May 2023 20:19:27 -0700 (PDT) From: Akihiko Odaki To: Cc: Mauro Matteo Cascella , P J P , Alexander Bulekov , Dmitry Fleytman , Beniamino Galvani , Peter Maydell , Strahinja Jankovic , Jason Wang , "Edgar E. Iglesias" , Alistair Francis , Stefan Weil , =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Andrew Jeffery , Joel Stanley , Richard Henderson , Helge Deller , Sriram Yagnaraman , Thomas Huth , Aleksandar Rikalo , Subbaraya Sundeep , Jan Kiszka , Tyrone Ting , Hao Wu , Max Filippov , Jiri Pirko , Daniel Henrique Barboza , David Gibson , Greg Kurz , Harsh Prateek Bora , Sven Schnelle , "Michael S. Tsirkin" , Stefano Stabellini , Anthony Perard , Paul Durrant , Rob Herring , Gerd Hoffmann , qemu-arm@nongnu.org, qemu-devel@nongnu.org, qemu-ppc@nongnu.org, xen-devel@lists.xenproject.org, Akihiko Odaki Subject: [PATCH v2 2/2] net: Update MemReentrancyGuard for NIC Date: Thu, 1 Jun 2023 12:18:59 +0900 Message-Id: <20230601031859.7115-3-akihiko.odaki@daynix.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601031859.7115-1-akihiko.odaki@daynix.com> References: <20230601031859.7115-1-akihiko.odaki@daynix.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @daynix-com.20221208.gappssmtp.com) X-ZM-MESSAGEID: 1685589603057100001 Content-Type: text/plain; charset="utf-8" Recently MemReentrancyGuard was added to DeviceState to record that the device is engaging in I/O. The network device backend needs to update it when delivering a packet to a device. This implementation follows what bottom half does, but it does not add a tracepoint for the case that the network device backend started delivering a packet to a device which is already engaging in I/O. This is because such reentrancy frequently happens for qemu_flush_queued_packets() and is insignificant. Fixes: CVE-2023-3019 Reported-by: Alexander Bulekov Signed-off-by: Akihiko Odaki Acked-by: Alexander Bulekov --- include/net/net.h | 1 + net/net.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/include/net/net.h b/include/net/net.h index a7d8deaccb..685ec58318 100644 --- a/include/net/net.h +++ b/include/net/net.h @@ -124,6 +124,7 @@ typedef QTAILQ_HEAD(NetClientStateList, NetClientState)= NetClientStateList; typedef struct NICState { NetClientState *ncs; NICConf *conf; + MemReentrancyGuard *reentrancy_guard; void *opaque; bool peer_deleted; } NICState; diff --git a/net/net.c b/net/net.c index 982df2479f..3523cceafc 100644 --- a/net/net.c +++ b/net/net.c @@ -332,6 +332,7 @@ NICState *qemu_new_nic(NetClientInfo *info, nic =3D g_malloc0(info->size + sizeof(NetClientState) * queues); nic->ncs =3D (void *)nic + info->size; nic->conf =3D conf; + nic->reentrancy_guard =3D reentrancy_guard, nic->opaque =3D opaque; =20 for (i =3D 0; i < queues; i++) { @@ -805,6 +806,7 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *= sender, int iovcnt, void *opaque) { + MemReentrancyGuard *owned_reentrancy_guard; NetClientState *nc =3D opaque; int ret; =20 @@ -817,12 +819,24 @@ static ssize_t qemu_deliver_packet_iov(NetClientState= *sender, return 0; } =20 + if (nc->info->type !=3D NET_CLIENT_DRIVER_NIC || + qemu_get_nic(nc)->reentrancy_guard->engaged_in_io) { + owned_reentrancy_guard =3D NULL; + } else { + owned_reentrancy_guard =3D qemu_get_nic(nc)->reentrancy_guard; + owned_reentrancy_guard->engaged_in_io =3D true; + } + if (nc->info->receive_iov && !(flags & QEMU_NET_PACKET_FLAG_RAW)) { ret =3D nc->info->receive_iov(nc, iov, iovcnt); } else { ret =3D nc_sendv_compat(nc, iov, iovcnt, flags); } =20 + if (owned_reentrancy_guard) { + owned_reentrancy_guard->engaged_in_io =3D false; + } + if (ret =3D=3D 0) { nc->receive_disabled =3D 1; } --=20 2.40.1