6e7d01
From 89732bf03b26daaebbd3e6e031e79459ae3f77e1 Mon Sep 17 00:00:00 2001
6e7d01
From: Jon Maloy <jmaloy@redhat.com>
6e7d01
Date: Tue, 29 Jun 2021 03:42:39 -0400
6e7d01
Subject: [PATCH 1/9] net: introduce qemu_receive_packet()
6e7d01
MIME-Version: 1.0
6e7d01
Content-Type: text/plain; charset=UTF-8
6e7d01
Content-Transfer-Encoding: 8bit
6e7d01
6e7d01
RH-Author: Jon Maloy <jmaloy@redhat.com>
6e7d01
Message-id: <20210629034247.3286477-2-jmaloy@redhat.com>
6e7d01
Patchwork-id: 101785
6e7d01
O-Subject: [RHEL-8.4.0.z qemu-kvm PATCH v2 1/9] net: introduce qemu_receive_packet()
6e7d01
Bugzilla: 1932917
6e7d01
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
6e7d01
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
6e7d01
RH-Acked-by: Thomas Huth <thuth@redhat.com>
6e7d01
6e7d01
From: Jason Wang <jasowang@redhat.com>
6e7d01
6e7d01
Some NIC supports loopback mode and this is done by calling
6e7d01
nc->info->receive() directly which in fact suppresses the effort of
6e7d01
reentrancy check that is done in qemu_net_queue_send().
6e7d01
6e7d01
Unfortunately we can't use qemu_net_queue_send() here since for
6e7d01
loopback there's no sender as peer, so this patch introduce a
6e7d01
qemu_receive_packet() which is used for implementing loopback mode
6e7d01
for a NIC with this check.
6e7d01
6e7d01
NIC that supports loopback mode will be converted to this helper.
6e7d01
6e7d01
This is intended to address CVE-2021-3416.
6e7d01
6e7d01
Cc: Prasad J Pandit <ppandit@redhat.com>
6e7d01
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
6e7d01
Cc: qemu-stable@nongnu.org
6e7d01
Signed-off-by: Jason Wang <jasowang@redhat.com>
6e7d01
6e7d01
(cherry picked from commit 705df5466c98f3efdd2b68d3b31dad86858acad7)
6e7d01
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
6e7d01
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
6e7d01
---
6e7d01
 include/net/net.h   |  5 +++++
6e7d01
 include/net/queue.h |  8 ++++++++
6e7d01
 net/net.c           | 38 +++++++++++++++++++++++++++++++-------
6e7d01
 net/queue.c         | 22 ++++++++++++++++++++++
6e7d01
 4 files changed, 66 insertions(+), 7 deletions(-)
6e7d01
6e7d01
diff --git a/include/net/net.h b/include/net/net.h
6e7d01
index e175ba9677..1b32a8aaec 100644
6e7d01
--- a/include/net/net.h
6e7d01
+++ b/include/net/net.h
6e7d01
@@ -142,12 +142,17 @@ void *qemu_get_nic_opaque(NetClientState *nc);
6e7d01
 void qemu_del_net_client(NetClientState *nc);
6e7d01
 typedef void (*qemu_nic_foreach)(NICState *nic, void *opaque);
6e7d01
 void qemu_foreach_nic(qemu_nic_foreach func, void *opaque);
6e7d01
+int qemu_can_receive_packet(NetClientState *nc);
6e7d01
 int qemu_can_send_packet(NetClientState *nc);
6e7d01
 ssize_t qemu_sendv_packet(NetClientState *nc, const struct iovec *iov,
6e7d01
                           int iovcnt);
6e7d01
 ssize_t qemu_sendv_packet_async(NetClientState *nc, const struct iovec *iov,
6e7d01
                                 int iovcnt, NetPacketSent *sent_cb);
6e7d01
 ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size);
6e7d01
+ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size);
6e7d01
+ssize_t qemu_receive_packet_iov(NetClientState *nc,
6e7d01
+                                const struct iovec *iov,
6e7d01
+                                int iovcnt);
6e7d01
 ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size);
6e7d01
 ssize_t qemu_send_packet_async(NetClientState *nc, const uint8_t *buf,
6e7d01
                                int size, NetPacketSent *sent_cb);
6e7d01
diff --git a/include/net/queue.h b/include/net/queue.h
6e7d01
index c0269bb1dc..9f2f289d77 100644
6e7d01
--- a/include/net/queue.h
6e7d01
+++ b/include/net/queue.h
6e7d01
@@ -55,6 +55,14 @@ void qemu_net_queue_append_iov(NetQueue *queue,
6e7d01
 
6e7d01
 void qemu_del_net_queue(NetQueue *queue);
6e7d01
 
6e7d01
+ssize_t qemu_net_queue_receive(NetQueue *queue,
6e7d01
+                               const uint8_t *data,
6e7d01
+                               size_t size);
6e7d01
+
6e7d01
+ssize_t qemu_net_queue_receive_iov(NetQueue *queue,
6e7d01
+                                   const struct iovec *iov,
6e7d01
+                                   int iovcnt);
6e7d01
+
6e7d01
 ssize_t qemu_net_queue_send(NetQueue *queue,
6e7d01
                             NetClientState *sender,
6e7d01
                             unsigned flags,
6e7d01
diff --git a/net/net.c b/net/net.c
6e7d01
index 84aa6d8d00..d0b651ca95 100644
6e7d01
--- a/net/net.c
6e7d01
+++ b/net/net.c
6e7d01
@@ -516,6 +516,17 @@ int qemu_set_vnet_be(NetClientState *nc, bool is_be)
6e7d01
 #endif
6e7d01
 }
6e7d01
 
6e7d01
+int qemu_can_receive_packet(NetClientState *nc)
6e7d01
+{
6e7d01
+    if (nc->receive_disabled) {
6e7d01
+        return 0;
6e7d01
+    } else if (nc->info->can_receive &&
6e7d01
+               !nc->info->can_receive(nc)) {
6e7d01
+        return 0;
6e7d01
+    }
6e7d01
+    return 1;
6e7d01
+}
6e7d01
+
6e7d01
 int qemu_can_send_packet(NetClientState *sender)
6e7d01
 {
6e7d01
     int vm_running = runstate_is_running();
6e7d01
@@ -528,13 +539,7 @@ int qemu_can_send_packet(NetClientState *sender)
6e7d01
         return 1;
6e7d01
     }
6e7d01
 
6e7d01
-    if (sender->peer->receive_disabled) {
6e7d01
-        return 0;
6e7d01
-    } else if (sender->peer->info->can_receive &&
6e7d01
-               !sender->peer->info->can_receive(sender->peer)) {
6e7d01
-        return 0;
6e7d01
-    }
6e7d01
-    return 1;
6e7d01
+    return qemu_can_receive_packet(sender->peer);
6e7d01
 }
6e7d01
 
6e7d01
 static ssize_t filter_receive_iov(NetClientState *nc,
6e7d01
@@ -667,6 +672,25 @@ ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size)
6e7d01
     return qemu_send_packet_async(nc, buf, size, NULL);
6e7d01
 }
6e7d01
 
6e7d01
+ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size)
6e7d01
+{
6e7d01
+    if (!qemu_can_receive_packet(nc)) {
6e7d01
+        return 0;
6e7d01
+    }
6e7d01
+
6e7d01
+    return qemu_net_queue_receive(nc->incoming_queue, buf, size);
6e7d01
+}
6e7d01
+
6e7d01
+ssize_t qemu_receive_packet_iov(NetClientState *nc, const struct iovec *iov,
6e7d01
+                                int iovcnt)
6e7d01
+{
6e7d01
+    if (!qemu_can_receive_packet(nc)) {
6e7d01
+        return 0;
6e7d01
+    }
6e7d01
+
6e7d01
+    return qemu_net_queue_receive_iov(nc->incoming_queue, iov, iovcnt);
6e7d01
+}
6e7d01
+
6e7d01
 ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size)
6e7d01
 {
6e7d01
     return qemu_send_packet_async_with_flags(nc, QEMU_NET_PACKET_FLAG_RAW,
6e7d01
diff --git a/net/queue.c b/net/queue.c
6e7d01
index c679d79f4b..5f0f9ffcaf 100644
6e7d01
--- a/net/queue.c
6e7d01
+++ b/net/queue.c
6e7d01
@@ -182,6 +182,28 @@ static ssize_t qemu_net_queue_deliver_iov(NetQueue *queue,
6e7d01
     return ret;
6e7d01
 }
6e7d01
 
6e7d01
+ssize_t qemu_net_queue_receive(NetQueue *queue,
6e7d01
+                               const uint8_t *data,
6e7d01
+                               size_t size)
6e7d01
+{
6e7d01
+    if (queue->delivering) {
6e7d01
+        return 0;
6e7d01
+    }
6e7d01
+
6e7d01
+    return qemu_net_queue_deliver(queue, NULL, 0, data, size);
6e7d01
+}
6e7d01
+
6e7d01
+ssize_t qemu_net_queue_receive_iov(NetQueue *queue,
6e7d01
+                                   const struct iovec *iov,
6e7d01
+                                   int iovcnt)
6e7d01
+{
6e7d01
+    if (queue->delivering) {
6e7d01
+        return 0;
6e7d01
+    }
6e7d01
+
6e7d01
+    return qemu_net_queue_deliver_iov(queue, NULL, 0, iov, iovcnt);
6e7d01
+}
6e7d01
+
6e7d01
 ssize_t qemu_net_queue_send(NetQueue *queue,
6e7d01
                             NetClientState *sender,
6e7d01
                             unsigned flags,
6e7d01
-- 
6e7d01
2.27.0
6e7d01