Null-pointer dereference through virtio-balloon

[Alexander Bulekov]

Hello,
While fuzzing, I found an input that triggers a null-ptr dereference in
aio_bh_enqueue, through virtio-balloon. Based on the stacktrace below,
I am not positive that this is specific to virtio-balloon, however
I have not encountered the same issue for any of the other virtio
devices I am fuzzing.

AddressSanitizer: SEGV on unknown address 0x000000000000

#0 0x55ee5b93eb28 in aio_bh_enqueue util/async.c:69:27
#1 0x55ee5b93eb28 in qemu_bh_schedule util/async.c:181:5
#2 0x55ee5ae71465 in virtio_queue_notify hw/virtio/virtio.c:2364:9
#3 0x55ee5b51142d in virtio_mmio_write hw/virtio/virtio-mmio.c:369:13
#4 0x55ee5ad0d2d6 in memory_region_write_accessor memory.c:483:5
#5 0x55ee5ad0cc7f in access_with_adjusted_size memory.c:544:18
#6 0x55ee5ad0cc7f in memory_region_dispatch_write memory.c:1476:16
#7 0x55ee5ac221d3 in flatview_write_continue exec.c:3137:23
#8 0x55ee5ac1ab97 in flatview_write exec.c:3177:14
#9 0x55ee5ac1ab97 in address_space_write exec.c:3268:18

I can reproduce it in a qemu 5.0 build using:
cat << EOF | qemu-system-i386 -M pc-q35-5.0 -M 
microvm,x-option-roms=off,pit=off,pic=off,isa-serial=off,rtc=off -nographic 
-device virtio-balloon-device,free-page-hint=true,deflate-on-oom=true 
-nographic -monitor none -display none -serial none -qtest stdio
write 0xc0000e30 0x24 
0x030000000300000003000000030000000300000003000000030000000300000003000000
EOF


I also uploaded the above trace, in case the formatting is broken:

curl https://paste.debian.net/plain/1146094 | qemu-system-i386 -M pc-q35-5.0 -M 
microvm,x-option-roms=off,pit=off,pic=off,isa-serial=off,rtc=off -nographic 
-device virtio-balloon-device,free-page-hint=true,deflate-on-oom=true 
-nographic -monitor none -display none -serial none -qtest stdio

Please let me know if I can provide any further info.
-Alex