On Fri, Nov 20, 2020 at 06:31:52PM -0500, Tom Rini wrote: > On Fri, Nov 20, 2020 at 11:56:27PM +0100, Patrick Wildt wrote: > > Am Wed, Oct 07, 2020 at 03:26:38PM +0200 schrieb Heinrich Schuchardt: > > > On 07.10.20 11:04, Patrick Wildt wrote: > > > > With DM enabled the ethernet code will receive a packet, call > > > > the push method that's set by the EFI network implementation > > > > and then free the packet. Unfortunately the push methods only > > > > sets a flag that the packet needs to be handled, but the code > > > > that provides the packet to an EFI application runs after the > > > > packet has already been freed. > > > > > > > > To rectify this issue, adjust the push method to accept the packet > > > > and store it in a temporary buffer. The EFI application then gets > > > > the data copied from that buffer. This way the packet is cached > > > > until is is needed. > > > > > > > > The DM Ethernet stack tries to receive 32 packets at once, thus > > > > we better allocate as many buffers as the stack. > > > > > > > > Signed-off-by: Patrick Wildt <patr...@blueri.se> > > > > > > Reviewed-by: Heinrich Schuchardt <xypron.g...@gmx.de> > > > > Was this patchset ever merged? > > commit 42f804fbba2836e64f472306ff7616c812d5c54d > Author: Patrick Wildt <patr...@blueri.se> > Date: Wed Oct 7 11:04:33 2020 +0200 > > efi_loader: fix use after free in rece > > is what I see atm.
Ah, yes, sorry, thanks! :)
