From 25ddb946e6301f42cff3094ea1c25fb78813e7e9 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Thu, 21 Oct 2021 12:10:47 -0400 Subject: [PATCH 1/2] e1000: fix tx re-entrancy problem The fact that the MMIO handler is not re-entrant causes an infinite loop under certain conditions: Guest write to TDT -> Loopback -> RX (DMA to TDT) -> TX We now eliminate the effect of this problem locally in e1000, by adding a boolean in struct E1000State indicating when the TX side is busy. This will cause any entering new call to return early instead of interfering with the ongoing work, and eliminates any risk of looping. This is intended to address CVE-2021-20257. Signed-off-by: Jon Maloy Signed-off-by: Jason Wang --- hw/net/e1000.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/net/e1000.c b/hw/net/e1000.c index a30546c5d5..f5bc81296d 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -107,6 +107,7 @@ struct E1000State_st { e1000x_txd_props props; e1000x_txd_props tso_props; uint16_t tso_frames; + bool busy; } tx; struct { @@ -763,6 +764,11 @@ start_xmit(E1000State *s) return; } + if (s->tx.busy) { + return; + } + s->tx.busy = true; + while (s->mac_reg[TDH] != s->mac_reg[TDT]) { base = tx_desc_base(s) + sizeof(struct e1000_tx_desc) * s->mac_reg[TDH]; @@ -789,6 +795,7 @@ start_xmit(E1000State *s) break; } } + s->tx.busy = false; set_ics(s, 0, cause); } From 3fd641ac5ec713e67129c1a57e8b6281182bd843 Mon Sep 17 00:00:00 2001 From: Eduardo Habkost Date: Wed, 3 Nov 2021 12:38:31 +0100 Subject: [PATCH 2/2] Fix virtio-net-pci* "vectors" compat hw_compat_5_2 has an issue: it affects only "virtio-net-pci" but not "virtio-net-pci-transitional" and "virtio-net-pci-non-transitional". The solution is to use the "virtio-net-pci-base" type in compat_props. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999141 Signed-off-by: Eduardo Habkost Signed-off-by: Jean-Louis Dupond Acked-by: Jason Wang Acked-by: Jean-Louis Dupond Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang --- hw/core/machine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/core/machine.c b/hw/core/machine.c index 948b3d9524..26ec54e726 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -56,7 +56,7 @@ GlobalProperty hw_compat_5_2[] = { { "ICH9-LPC", "smm-compat", "on"}, { "PIIX4_PM", "smm-compat", "on"}, { "virtio-blk-device", "report-discard-granularity", "off" }, - { "virtio-net-pci", "vectors", "3"}, + { "virtio-net-pci-base", "vectors", "3"}, }; const size_t hw_compat_5_2_len = G_N_ELEMENTS(hw_compat_5_2);