Jason Wang bedd7e93d0 virtio-net: fix use after unmap/free for sg ... When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues, E.g a use after free when the descriptor has an address which belongs to the non direct access region. In this case we use bounce buffer that is allocated during address_space_map() and freed during address_space_unmap(). Fixing this by storing the elems temporarily in an array and delay the unmap after we set the the num_buffers. This addresses CVE-2021-3748. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: fbe78f4f55 ("virtio-net support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>		2021-09-17 16:07:52 +08:00
..
can
fsl_etsec
rocker
allwinner-sun8i-emac.c
allwinner_emac.c
cadence_gem.c
dp8393x.c
e1000.c
e1000_regs.h
e1000e.c
e1000e_core.c
e1000e_core.h
e1000x_common.c
e1000x_common.h
eepro100.c
etraxfs_eth.c
ftgmac100.c
i82596.c
i82596.h
imx_fec.c
Kconfig
lan9118.c
lance.c
lasi_i82596.c
mcf_fec.c
meson.build
mipsnet.c
msf2-emac.c
ne2000-isa.c
ne2000-pci.c
ne2000.c
ne2000.h
net_rx_pkt.c
net_rx_pkt.h
net_tx_pkt.c
net_tx_pkt.h
npcm7xx_emc.c
opencores_eth.c
pcnet-pci.c
pcnet.c
pcnet.h
rtl8139.c
smc91c111.c
spapr_llan.c
stellaris_enet.c
sungem.c
sunhme.c
trace-events
trace.h
tulip.c
tulip.h
vhost_net-stub.c
vhost_net.c
virtio-net.c	virtio-net: fix use after unmap/free for sg	2021-09-17 16:07:52 +08:00
vmware_utils.h
vmxnet3.c
vmxnet3.h
vmxnet3_defs.h
vmxnet_debug.h
xen_nic.c
xgmac.c
xilinx_axienet.c
xilinx_ethlite.c