Commit 3933f194 authored by Patrick Wildt's avatar Patrick Wildt Committed by Heinrich Schuchardt

efi_loader: fix use after free in receive path

With DM enabled the ethernet code will receive a packet, call
the push method that's set by the EFI network implementation
and then free the packet.  Unfortunately the push methods only
sets a flag that the packet needs to be handled, but the code
that provides the packet to an EFI application runs after the
packet has already been freed.

To rectify this issue, adjust the push method to accept the packet
and store it in a temporary buffer.  The EFI application then gets
the data copied from that buffer.  This way the packet is cached
until is is needed.

The DM Ethernet stack tries to receive 32 packets at once, thus
we better allocate as many buffers as the stack.
Signed-off-by: default avatarPatrick Wildt <>
Signed-off-by: Heinrich Schuchardt's avatarHeinrich Schuchardt <>
parent 741df4fb
Pipeline #4991 passed with stages
in 29 minutes and 27 seconds