Skip to content
Commit 42f804fb authored by Patrick Wildt's avatar Patrick Wildt Committed by Heinrich Schuchardt
Browse files

efi_loader: fix use after free in receive path



With DM enabled the ethernet code will receive a packet, call
the push method that's set by the EFI network implementation
and then free the packet.  Unfortunately the push methods only
sets a flag that the packet needs to be handled, but the code
that provides the packet to an EFI application runs after the
packet has already been freed.

To rectify this issue, adjust the push method to accept the packet
and store it in a temporary buffer.  The EFI application then gets
the data copied from that buffer.  This way the packet is cached
until is is needed.

The DM Ethernet stack tries to receive 32 packets at once, thus
we better allocate as many buffers as the stack.

Signed-off-by: default avatarPatrick Wildt <patrick@blueri.se>
Signed-off-by: default avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
parent 36ea0cab
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment