hw/net/virtio-net: Protect from DMA re-entrancy bugs
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection can be bypassed. This update was missing in CVE-2024-3446 fix. Fixes: CVE-2026-66022 Cc: qemu-stable@nongnu.org Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Cc: alxndr@bu.edu Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073 Reported-by: Giovanni Vignone <gio@octane.security> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260723233555.2970619-1-lvivier@redhat.com>
Laurent Vivier committed
Jul 24, 2026 at 01:35 UTC
df12999cc81339ffb252875608919c72ccc37bcd
1 file changed
+3
-2
hw/net/virtio-net.c
+3
-2
@@ -3009,8 +3009,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
3009
n->vqs[index].tx_vq =
3010
virtio_add_queue(vdev, n->net_conf.tx_queue_size,
3011
virtio_net_handle_tx_bh);
3012
- n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
3013
- &DEVICE(vdev)->mem_reentrancy_guard);
3012
+ n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
3013
+ virtio_net_tx_bh,
3014
+ &n->vqs[index]);
3015
}
3016
3017
n->vqs[index].tx_waiting = 0;