On 12/16/21 04:36, Philippe Mathieu-Daudé wrote:
Hi Jon,
On 10/21/21 18:10, Jon Maloy wrote:
The fact that the MMIO handler is not re-entrant causes an infinite
loop under certain conditions:
Guest write to TDT -> Loopback -> RX (DMA to TDT) -> TX
We now eliminate the effect of this problem locally in e1000, by adding
a boolean in struct E1000State indicating when the TX side is busy. This
will cause any entering new call to return early instead of interfering
with the ongoing work, and eliminates any risk of looping.
This is intended to address CVE-2021-20257.
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
---
hw/net/e1000.c | 7 +++++++
1 file changed, 7 insertions(+)
I can not find the reproducer in the repository, have you sent one?
No, I did not add it to the repo.
It was referenced from the tracker BZ, but I was unable to get access
back then.
It ended up with that I had it sent by mail to me directly.
What is your question? Is it that it should be in the repo, or that you
cannot find it?