[PATCH v3 2/2] efi_loader: fix use after free in receive path

[Patrick Wildt]

On Fri, Nov 20, 2020 at 06:31:52PM -0500, Tom Rini wrote:
> On Fri, Nov 20, 2020 at 11:56:27PM +0100, Patrick Wildt wrote:
> > Am Wed, Oct 07, 2020 at 03:26:38PM +0200 schrieb Heinrich Schuchardt:
> > > On 07.10.20 11:04, Patrick Wildt wrote:
> > > > With DM enabled the ethernet code will receive a packet, call
> > > > the push method that's set by the EFI network implementation
> > > > and then free the packet.  Unfortunately the push methods only
> > > > sets a flag that the packet needs to be handled, but the code
> > > > that provides the packet to an EFI application runs after the
> > > > packet has already been freed.
> > > >
> > > > To rectify this issue, adjust the push method to accept the packet
> > > > and store it in a temporary buffer.  The EFI application then gets
> > > > the data copied from that buffer.  This way the packet is cached
> > > > until is is needed.
> > > >
> > > > The DM Ethernet stack tries to receive 32 packets at once, thus
> > > > we better allocate as many buffers as the stack.
> > > >
> > > > Signed-off-by: Patrick Wildt <patrick at blueri.se>
> > > 
> > > Reviewed-by: Heinrich Schuchardt <xypron.glpk at gmx.de>
> > 
> > Was this patchset ever merged?
> 
> commit 42f804fbba2836e64f472306ff7616c812d5c54d
> Author: Patrick Wildt <patrick at blueri.se>
> Date:   Wed Oct 7 11:04:33 2020 +0200
> 
>     efi_loader: fix use after free in rece
> 
> is what I see atm.

Ah, yes, sorry, thanks! :)