[PATCH v3 2/2] efi_loader: fix use after free in receive path

[Tom Rini]

On Fri, Nov 20, 2020 at 11:56:27PM +0100, Patrick Wildt wrote:
> Am Wed, Oct 07, 2020 at 03:26:38PM +0200 schrieb Heinrich Schuchardt:
> > On 07.10.20 11:04, Patrick Wildt wrote:
> > > With DM enabled the ethernet code will receive a packet, call
> > > the push method that's set by the EFI network implementation
> > > and then free the packet.  Unfortunately the push methods only
> > > sets a flag that the packet needs to be handled, but the code
> > > that provides the packet to an EFI application runs after the
> > > packet has already been freed.
> > >
> > > To rectify this issue, adjust the push method to accept the packet
> > > and store it in a temporary buffer.  The EFI application then gets
> > > the data copied from that buffer.  This way the packet is cached
> > > until is is needed.
> > >
> > > The DM Ethernet stack tries to receive 32 packets at once, thus
> > > we better allocate as many buffers as the stack.
> > >
> > > Signed-off-by: Patrick Wildt <patrick at blueri.se>
> > 
> > Reviewed-by: Heinrich Schuchardt <xypron.glpk at gmx.de>
> 
> Was this patchset ever merged?

commit 42f804fbba2836e64f472306ff7616c812d5c54d
Author: Patrick Wildt <patrick at blueri.se>
Date:   Wed Oct 7 11:04:33 2020 +0200

    efi_loader: fix use after free in rece

is what I see atm.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20201120/7a1c3817/attachment.sig>