On 24/7/26 01:35, Laurent Vivier wrote:
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
so the bus and device use the same guard. Otherwise the
DMA-reentrancy protection can be bypassed.
This update was missing in CVE-2024-3446 fix.
Fixes: CVE-2026-66022
Cc: [email protected]
Cc: Philippe Mathieu-Daudé <[email protected]>
Cc: [email protected]
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
Signed-off-by: Laurent Vivier <[email protected]>
---
hw/net/virtio-net.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index f0e3beb29032..7033664ac0c8 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -2991,8 +2991,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
n->vqs[index].tx_vq =
virtio_add_queue(vdev, n->net_conf.tx_queue_size,
virtio_net_handle_tx_bh);
- n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh,
&n->vqs[index],
-
&DEVICE(vdev)->mem_reentrancy_guard);
+ n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
+ virtio_net_tx_bh,
+ &n->vqs[index]);
}
This matches commits b4295bff25f and f4729ec39ad9, so:
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
