DF-4508
e1000_i210: e1000_release_swfw_sync_i210 acquires the SWSM hardware semaphore in an unbounded empty-body loop on every NVM/PHY release path — a stuck SMBI bit pins the calling thread forever
Summary
The release path retries the hw semaphore with 'while (get_hw_semaphore != SUCCESS) ;' - no timeout, unlike the acquire side's 200x5ms cap. A wedged SMBI/SW_FW_SYNC (surprise removal MMIO all-ones, stuck firmware) pins the thread in-kernel forever, wedging the interface under the serializer. DF-4306 class (80003es2lan twin); upstream igb shares it. Hardware-gated on guest. Bound-the-retry fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4508 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 932 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
not_testable
bound-the-release-retry diff in finding markdown
per-fix-DF-4508
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Release path retries the hw semaphore with an empty-body unbounded while; acquire side is capped 200x5ms. Same class as DF-4306 (80003es2lan); upstream Linux igb shares it. No igb NIC on guest.
Verdict
not_run: hardware-gated (no I210/I211 on guest); code-certain
No comments yet.