Commit df12999cc8 for qemu.org

commit df12999cc81339ffb252875608919c72ccc37bcd
Author: Laurent Vivier <lvivier@redhat.com>
Date:   Fri Jul 24 01:35:55 2026 +0200

    hw/net/virtio-net: Protect from DMA re-entrancy bugs

    Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
    so the bus and device use the same guard. Otherwise the
    DMA-reentrancy protection can be bypassed.

    This update was missing in CVE-2024-3446 fix.

    Fixes: CVE-2026-66022
    Cc: qemu-stable@nongnu.org
    Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Cc: alxndr@bu.edu
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
    Reported-by: Giovanni Vignone <gio@octane.security>
    Signed-off-by: Laurent Vivier <lvivier@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260723233555.2970619-1-lvivier@redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7e0c984ec6..814b99a43d 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3009,8 +3009,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
         n->vqs[index].tx_vq =
             virtio_add_queue(vdev, n->net_conf.tx_queue_size,
                              virtio_net_handle_tx_bh);
-        n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
-                                                  &DEVICE(vdev)->mem_reentrancy_guard);
+        n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
+                                                    virtio_net_tx_bh,
+                                                    &n->vqs[index]);
     }

     n->vqs[index].tx_waiting = 0;