tree 6ec73e69086dd764748b7c26bd60ddc4f07af6ec
parent d47430a5c786040dcfeaa5a4ff3ab42da197aeb7
author Patrick Wildt <patrick@blueri.se> 1602061473 +0200
committer Heinrich Schuchardt <xypron.glpk@gmx.de> 1603141193 +0200

efi_loader: fix use after free in receive path

With DM enabled the ethernet code will receive a packet, call
the push method that's set by the EFI network implementation
and then free the packet.  Unfortunately the push methods only
sets a flag that the packet needs to be handled, but the code
that provides the packet to an EFI application runs after the
packet has already been freed.

To rectify this issue, adjust the push method to accept the packet
and store it in a temporary buffer.  The EFI application then gets
the data copied from that buffer.  This way the packet is cached
until is is needed.

The DM Ethernet stack tries to receive 32 packets at once, thus
we better allocate as many buffers as the stack.

Signed-off-by: Patrick Wildt <patrick@blueri.se>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>