e7c2df3fd7
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
so the bus and device use the same guard. Otherwise the
DMA-reentrancy protection can be bypassed.
Fixes: CVE-2024-3446
Cc: qemu-stable@nongnu.org
Suggested-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20240409105537.18308-4-philmd@linaro.org>
(cherry picked from commit
|
||
---|---|---|
.. | ||
avr_usart.c | ||
bcm2835_aux.c | ||
cadence_uart.c | ||
cmsdk-apb-uart.c | ||
debugcon.c | ||
digic-uart.c | ||
escc.c | ||
etraxfs_ser.c | ||
exynos4210_uart.c | ||
goldfish_tty.c | ||
grlib_apbuart.c | ||
ibex_uart.c | ||
imx_serial.c | ||
ipoctal232.c | ||
Kconfig | ||
mcf_uart.c | ||
mchp_pfsoc_mmuart.c | ||
meson.build | ||
nrf51_uart.c | ||
omap_uart.c | ||
parallel-isa.c | ||
parallel.c | ||
pl011.c | ||
renesas_sci.c | ||
riscv_htif.c | ||
sclpconsole-lm.c | ||
sclpconsole.c | ||
serial-isa.c | ||
serial-pci-multi.c | ||
serial-pci.c | ||
serial.c | ||
sh_serial.c | ||
shakti_uart.c | ||
sifive_uart.c | ||
spapr_vty.c | ||
stm32f2xx_usart.c | ||
terminal3270.c | ||
trace-events | ||
trace.h | ||
virtio-console.c | ||
virtio-serial-bus.c | ||
xen_console.c | ||
xilinx_uartlite.c |