hw/net/virtio-net: Protect from DMA re-entrancy bugs

[PATCH] hw/net/virtio-net: Protect from DMA re-entrancy bugs

Posted by Laurent Vivier 2 days, 9 hours ago

Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
so the bus and device use the same guard. Otherwise the
DMA-reentrancy protection can be bypassed.

This update was missing in CVE-2024-3446 fix.

Fixes: CVE-2026-66022
Cc: qemu-stable@nongnu.org
Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Cc: alxndr@bu.edu
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
 hw/net/virtio-net.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index f0e3beb29032..7033664ac0c8 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -2991,8 +2991,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
         n->vqs[index].tx_vq =
             virtio_add_queue(vdev, n->net_conf.tx_queue_size,
                              virtio_net_handle_tx_bh);
-        n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
-                                                  &DEVICE(vdev)->mem_reentrancy_guard);
+        n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
+                                                    virtio_net_tx_bh,
+                                                    &n->vqs[index]);
     }
 
     n->vqs[index].tx_waiting = 0;
-- 
2.54.0

Re: [PATCH] hw/net/virtio-net: Protect from DMA re-entrancy bugs

Posted by Philippe Mathieu-Daudé 2 days, 1 hour ago

On 24/7/26 01:35, Laurent Vivier wrote:
> Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
> so the bus and device use the same guard. Otherwise the
> DMA-reentrancy protection can be bypassed.
> 
> This update was missing in CVE-2024-3446 fix.
> 
> Fixes: CVE-2026-66022
> Cc: qemu-stable@nongnu.org
> Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> Cc: alxndr@bu.edu
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
> Signed-off-by: Laurent Vivier <lvivier@redhat.com>
> ---
>   hw/net/virtio-net.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index f0e3beb29032..7033664ac0c8 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -2991,8 +2991,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
>           n->vqs[index].tx_vq =
>               virtio_add_queue(vdev, n->net_conf.tx_queue_size,
>                                virtio_net_handle_tx_bh);
> -        n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
> -                                                  &DEVICE(vdev)->mem_reentrancy_guard);
> +        n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
> +                                                    virtio_net_tx_bh,
> +                                                    &n->vqs[index]);
>       }

This matches commits b4295bff25f and f4729ec39ad9, so:
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>