From patchwork Thu Jun 1 03:18:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Akihiko Odaki X-Patchwork-Id: 13262963 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B06DBC7EE2E for ; Thu, 1 Jun 2023 03:19:42 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.542206.845812 (Exim 4.92) (envelope-from ) id 1q4YqZ-00036b-QX; Thu, 01 Jun 2023 03:19:31 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 542206.845812; Thu, 01 Jun 2023 03:19:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1q4YqZ-00036P-ND; Thu, 01 Jun 2023 03:19:31 +0000 Received: by outflank-mailman (input) for mailman id 542206; Thu, 01 Jun 2023 03:19:30 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1q4YqY-0002Ws-EU for xen-devel@lists.xenproject.org; Thu, 01 Jun 2023 03:19:30 +0000 Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [2607:f8b0:4864:20::535]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 1e2db27f-002b-11ee-b231-6b7b168915f2; Thu, 01 Jun 2023 05:19:29 +0200 (CEST) Received: by mail-pg1-x535.google.com with SMTP id 41be03b00d2f7-5289cf35eeaso1244522a12.1 for ; Wed, 31 May 2023 20:19:29 -0700 (PDT) Received: from alarm.flets-east.jp ([2400:4050:a840:1e00:78d2:b862:10a7:d486]) by smtp.gmail.com with ESMTPSA id jd5-20020a170903260500b001a245b49731sm2146753plb.128.2023.05.31.20.19.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 May 2023 20:19:27 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 1e2db27f-002b-11ee-b231-6b7b168915f2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=daynix-com.20221208.gappssmtp.com; s=20221208; t=1685589568; x=1688181568; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=zmIxJv/RQZ1r+yT76IboD8L/ibu/PXdMmNY/Ba4zw4E=; b=LifDaFHsjEizUqk1VXUEMNKpYG+2uFwQWZ6WmhqcXRIokhq+sF0/tOYP3m8p66m5Sw ixVkHy6LMbrBelnPG8Q1Q9VRLCT+uqGDYCGM6cpIlvIhSQ3FFZGbw6zk85tp5GfS+ldw Da0krCI3eNH0oCEHagqgTjS5JGpkwahp96+PqTHoZpg3dydVTmpmjawNVceSXeK03RKl uDHry/5Rb534a/JTOwsP6b8N7HJmZpCpM7hLTgB3X2valR5fHWq29yMLiL9qGTiqTqCE IGUaKyP4J9vbFD+3AyXaVCi4WEEzIHEifi3LI1MYz+fnnZmTcLeNYfg5/h7F5O8KGHQI qzIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685589568; x=1688181568; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zmIxJv/RQZ1r+yT76IboD8L/ibu/PXdMmNY/Ba4zw4E=; b=SvGpBABI9Hwz/+ixPn9rhKZF2N+45b7u8BvHuKENyTbb6DwJZBQQN79IPuKozRAGnK tT+k91E1d3NPiWOwpWVVwj5hizRMfoLpvWz1BRp12QXxPNRnzvoGVg8e2ykyDwJXudta vjERt9kJHmWTy226Cnz+TC1XR9lVoa6abFE5YR5I+WY2qaCFDmGwX8uhDOqWR37zAtq+ l2+U7x9XNcnCcMBinFshY1DmKhBfUdvFHbMVgMqTMIWBjSEQaTUexFFbfUuo/ok1+g1u Tsut3WtoFWYI8ZivNVrnZ3ccqRemeEhM/CiqQ1ChrU9Ptv7PnU2k7UFzAlFAcdwq0sNQ m1rg== X-Gm-Message-State: AC+VfDyREjs+PsBjAmSV6Pr5tXKDDuh19s7zAXRGZUl8RnFHpSqULcyg JncRzfJUG09DvB+66fsIOZChLA== X-Google-Smtp-Source: ACHHUZ5miu5cdAr+t12FHP1vTIi7NetVQS5akrT+IyNAzvoVQFkZ1wGN5w557t12H8/USySWfc8W4g== X-Received: by 2002:a17:902:daca:b0:1ad:d542:6e14 with SMTP id q10-20020a170902daca00b001add5426e14mr680893plx.12.1685589567904; Wed, 31 May 2023 20:19:27 -0700 (PDT) From: Akihiko Odaki To: Cc: Mauro Matteo Cascella , P J P , Alexander Bulekov , Dmitry Fleytman , Beniamino Galvani , Peter Maydell , Strahinja Jankovic , Jason Wang , "Edgar E. Iglesias" , Alistair Francis , Stefan Weil , =?utf-8?q?C=C3=A9dric_Le_Goater?= , Andrew Jeffery , Joel Stanley , Richard Henderson , Helge Deller , Sriram Yagnaraman , Thomas Huth , Aleksandar Rikalo , Subbaraya Sundeep , Jan Kiszka , Tyrone Ting , Hao Wu , Max Filippov , Jiri Pirko , Daniel Henrique Barboza , David Gibson , Greg Kurz , Harsh Prateek Bora , Sven Schnelle , "Michael S. Tsirkin" , Stefano Stabellini , Anthony Perard , Paul Durrant , Rob Herring , Gerd Hoffmann , qemu-arm@nongnu.org, qemu-devel@nongnu.org, qemu-ppc@nongnu.org, xen-devel@lists.xenproject.org, Akihiko Odaki Subject: [PATCH v2 2/2] net: Update MemReentrancyGuard for NIC Date: Thu, 1 Jun 2023 12:18:59 +0900 Message-Id: <20230601031859.7115-3-akihiko.odaki@daynix.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230601031859.7115-1-akihiko.odaki@daynix.com> References: <20230601031859.7115-1-akihiko.odaki@daynix.com> MIME-Version: 1.0 Recently MemReentrancyGuard was added to DeviceState to record that the device is engaging in I/O. The network device backend needs to update it when delivering a packet to a device. This implementation follows what bottom half does, but it does not add a tracepoint for the case that the network device backend started delivering a packet to a device which is already engaging in I/O. This is because such reentrancy frequently happens for qemu_flush_queued_packets() and is insignificant. Fixes: CVE-2023-3019 Reported-by: Alexander Bulekov Signed-off-by: Akihiko Odaki Acked-by: Alexander Bulekov --- include/net/net.h | 1 + net/net.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/include/net/net.h b/include/net/net.h index a7d8deaccb..685ec58318 100644 --- a/include/net/net.h +++ b/include/net/net.h @@ -124,6 +124,7 @@ typedef QTAILQ_HEAD(NetClientStateList, NetClientState) NetClientStateList; typedef struct NICState { NetClientState *ncs; NICConf *conf; + MemReentrancyGuard *reentrancy_guard; void *opaque; bool peer_deleted; } NICState; diff --git a/net/net.c b/net/net.c index 982df2479f..3523cceafc 100644 --- a/net/net.c +++ b/net/net.c @@ -332,6 +332,7 @@ NICState *qemu_new_nic(NetClientInfo *info, nic = g_malloc0(info->size + sizeof(NetClientState) * queues); nic->ncs = (void *)nic + info->size; nic->conf = conf; + nic->reentrancy_guard = reentrancy_guard, nic->opaque = opaque; for (i = 0; i < queues; i++) { @@ -805,6 +806,7 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *sender, int iovcnt, void *opaque) { + MemReentrancyGuard *owned_reentrancy_guard; NetClientState *nc = opaque; int ret; @@ -817,12 +819,24 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *sender, return 0; } + if (nc->info->type != NET_CLIENT_DRIVER_NIC || + qemu_get_nic(nc)->reentrancy_guard->engaged_in_io) { + owned_reentrancy_guard = NULL; + } else { + owned_reentrancy_guard = qemu_get_nic(nc)->reentrancy_guard; + owned_reentrancy_guard->engaged_in_io = true; + } + if (nc->info->receive_iov && !(flags & QEMU_NET_PACKET_FLAG_RAW)) { ret = nc->info->receive_iov(nc, iov, iovcnt); } else { ret = nc_sendv_compat(nc, iov, iovcnt, flags); } + if (owned_reentrancy_guard) { + owned_reentrancy_guard->engaged_in_io = false; + } + if (ret == 0) { nc->receive_disabled = 1; }