63c3424617
openeuler !302!305 e1000-fail-early-for-evil-descriptor.patch e1000-fix-tx-re-entrancy-problem.patch hw-sd-sdcard-Restrict-Class-6-commands-to-SCSD-cards.patch hw-sd-sdcard-Simplify-realize-a-bit.patch hw-sd-sdcard-Do-not-allow-invalid-SD-card-sizes.patch hw-sd-sdcard-Update-coding-style-to-make-checkpatch..patch hw-sd-sdcard-Do-not-switch-to-ReceivingData-if-addre.patch scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch curses-Fixes-curses-compiling-errors.patch net-dump.c-Suppress-spurious-compiler-warning.patch tests-Replace-deprecated-ASN1-code.patch
59 lines
1.6 KiB
Diff
59 lines
1.6 KiB
Diff
From c28382f7ef531e10a45d240cdb29145f8638232e Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Thu, 21 Oct 2021 12:10:47 -0400
|
|
Subject: [PATCH 2/7] e1000: fix tx re-entrancy problem
|
|
|
|
The fact that the MMIO handler is not re-entrant causes an infinite
|
|
loop under certain conditions:
|
|
|
|
Guest write to TDT -> Loopback -> RX (DMA to TDT) -> TX
|
|
|
|
We now eliminate the effect of this problem locally in e1000, by adding
|
|
a boolean in struct E1000State indicating when the TX side is busy. This
|
|
will cause any entering new call to return early instead of interfering
|
|
with the ongoing work, and eliminates any risk of looping.
|
|
|
|
This is intended to address CVE-2021-20257.
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
---
|
|
hw/net/e1000.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
|
|
index f0219d363c..a41b5b116d 100644
|
|
--- a/hw/net/e1000.c
|
|
+++ b/hw/net/e1000.c
|
|
@@ -104,6 +104,7 @@ typedef struct E1000State_st {
|
|
e1000x_txd_props props;
|
|
e1000x_txd_props tso_props;
|
|
uint16_t tso_frames;
|
|
+ bool busy;
|
|
} tx;
|
|
|
|
struct {
|
|
@@ -748,6 +749,11 @@ start_xmit(E1000State *s)
|
|
return;
|
|
}
|
|
|
|
+ if (s->tx.busy) {
|
|
+ return;
|
|
+ }
|
|
+ s->tx.busy = true;
|
|
+
|
|
while (s->mac_reg[TDH] != s->mac_reg[TDT]) {
|
|
base = tx_desc_base(s) +
|
|
sizeof(struct e1000_tx_desc) * s->mac_reg[TDH];
|
|
@@ -774,6 +780,7 @@ start_xmit(E1000State *s)
|
|
break;
|
|
}
|
|
}
|
|
+ s->tx.busy = false;
|
|
set_ics(s, 0, cause);
|
|
}
|
|
|
|
--
|
|
2.17.1
|
|
|