Jason Wang bedd7e93d0 virtio-net: fix use after unmap/free for sg ... When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues, E.g a use after free when the descriptor has an address which belongs to the non direct access region. In this case we use bounce buffer that is allocated during address_space_map() and freed during address_space_unmap(). Fixing this by storing the elems temporarily in an array and delay the unmap after we set the the num_buffers. This addresses CVE-2021-3748. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: fbe78f4f55 ("virtio-net support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>		2021-09-17 16:07:52 +08:00
..
can	hw/net/can: sja1000 fix buff2frame_bas and buff2frame_pel when dlc is out of std CAN 8 bytes	2021-08-02 12:19:18 +08:00
fsl_etsec	hw/net: fsl_etsec: Tx padding length should exclude CRC	2021-03-31 11:10:50 +11:00
rocker	net/rocker: use GDateTime for formatting timestamp in debug messages	2021-07-14 14:15:52 +01:00
allwinner_emac.c
allwinner-sun8i-emac.c	hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value	2021-03-12 12:40:10 +00:00
cadence_gem.c	cadence_gem: switch to use qemu_receive_packet() for loopback	2021-03-15 16:41:22 +08:00
dp8393x.c	dp8393x: don't force 32-bit register access	2021-07-11 22:29:54 +02:00
e1000_regs.h
e1000.c	hw/net: e1000: Correct the initial value of VET register	2021-08-02 12:19:18 +08:00
e1000e_core.c	hw/net: e1000e: Don't zero out the VLAN tag in the legacy RX descriptor	2021-08-02 12:19:18 +08:00
e1000e_core.h
e1000e.c	hw/net: e1000e: Correct the initial value of VET register	2021-08-02 12:19:18 +08:00
e1000x_common.c
e1000x_common.h
eepro100.c
etraxfs_eth.c
ftgmac100.c
i82596.c	Do not include sysemu/sysemu.h if it's not really necessary	2021-05-02 17:24:50 +02:00
i82596.h
imx_fec.c	hw/net/imx_fec: return 0xffff when accessing non-existing PHY	2021-05-27 11:03:07 +08:00
Kconfig
lan9118.c	lan9118: switch to use qemu_receive_packet() for loopback	2021-03-15 16:41:22 +08:00
lance.c
lasi_i82596.c	Do not include sysemu/sysemu.h if it's not really necessary	2021-05-02 17:24:50 +02:00
mcf_fec.c
meson.build	Drop the deprecated lm32 target	2021-05-12 18:20:25 +02:00
mipsnet.c
msf2-emac.c	Do not include exec/address-spaces.h if it's not really necessary	2021-05-02 17:24:51 +02:00
ne2000-isa.c
ne2000-pci.c
ne2000.c
ne2000.h
net_rx_pkt.c
net_rx_pkt.h
net_tx_pkt.c	hw/net/net_tx_pkt: Fix crash detected by fuzzer	2021-07-19 09:33:39 +02:00
net_tx_pkt.h
npcm7xx_emc.c	net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set	2021-03-30 14:05:33 +01:00
opencores_eth.c
pcnet-pci.c
pcnet.c	pcnet: switch to use qemu_receive_packet() for loopback	2021-03-15 16:41:22 +08:00
pcnet.h
rtl8139.c	rtl8139: switch to use qemu_receive_packet() for loopback	2021-03-15 16:41:22 +08:00
smc91c111.c
spapr_llan.c	Do not include cpu.h if it's not really necessary	2021-05-02 17:24:51 +02:00
stellaris_enet.c
sungem.c	sungem: switch to use qemu_receive_packet() for loopback	2021-03-15 16:41:22 +08:00
sunhme.c
trace-events	dp8393x: convert to trace-events	2021-07-02 17:35:08 +02:00
trace.h
tulip.c
tulip.h
vhost_net-stub.c
vhost_net.c	vhost_net: do not assume nvqs is always 2	2021-09-04 17:34:05 -04:00
virtio-net.c	virtio-net: fix use after unmap/free for sg	2021-09-17 16:07:52 +08:00
vmware_utils.h
vmxnet3_defs.h
vmxnet3.c	hw/net/vmxnet3: Do not abort QEMU if guest specified bad queue numbers	2021-08-02 12:19:18 +08:00
vmxnet3.h
vmxnet_debug.h
xen_nic.c	Revert "net: Move NetClientState.info_str to dynamic allocations"	2021-04-08 17:33:59 +08:00
xgmac.c	hw: Do not include qemu/log.h if it is not necessary	2021-05-02 17:24:50 +02:00
xilinx_axienet.c
xilinx_ethlite.c