Commit df12999cc8 for qemu.org
commit df12999cc81339ffb252875608919c72ccc37bcd
Author: Laurent Vivier <lvivier@redhat.com>
Date: Fri Jul 24 01:35:55 2026 +0200
hw/net/virtio-net: Protect from DMA re-entrancy bugs
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
so the bus and device use the same guard. Otherwise the
DMA-reentrancy protection can be bypassed.
This update was missing in CVE-2024-3446 fix.
Fixes: CVE-2026-66022
Cc: qemu-stable@nongnu.org
Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Cc: alxndr@bu.edu
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
Reported-by: Giovanni Vignone <gio@octane.security>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260723233555.2970619-1-lvivier@redhat.com>
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7e0c984ec6..814b99a43d 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3009,8 +3009,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
n->vqs[index].tx_vq =
virtio_add_queue(vdev, n->net_conf.tx_queue_size,
virtio_net_handle_tx_bh);
- n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
- &DEVICE(vdev)->mem_reentrancy_guard);
+ n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
+ virtio_net_tx_bh,
+ &n->vqs[index]);
}
n->vqs[index].tx_waiting = 0;