[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Bug 1878034] Re: memcpy param-overlap through e1000e_write_to_rx_bu
|
From: |
Alexander Bulekov |
|
Subject: |
Re: [Bug 1878034] Re: memcpy param-overlap through e1000e_write_to_rx_buffers |
|
Date: |
Tue, 25 May 2021 16:45:58 -0000 |
Seems to still be a problem. Here's the reproducer found by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29586
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
512M -M q35 -nodefaults -device e1000e,netdev=net0 -netdev user,id=net0 \
-qtest /dev/null -qtest stdio
outl 0xcf8 0x80000811
outl 0xcfc 0x5ac600
outl 0xcf8 0x80000801
outl 0xcfc 0x06000000
write 0x5ac60100 0x4 0x56000302
write 0x5ac6011a 0x2 0x0106
write 0x5ac60120 0x1 0x25
write 0x5ac6042a 0x2 0x0248
write 0x5ac60431 0x1 0x04
write 0x4240 0x1 0xff
write 0x4241 0x1 0x01
write 0x4249 0x1 0xf5
write 0x1ff 0x1 0x01
write 0x5ac60403 0x1 0x02
write 0x5ac6043a 0x2 0x2800
write 0x5ac60112 0x2 0xf090
write 0x5ac60430 0x1 0x00
write 0x239 0x1 0xff
write 0x23b 0x1 0x01
write 0x9531 0x1 0xff
write 0x9532 0x1 0xff
write 0x9533 0x1 0xff
write 0x9534 0x1 0xff
write 0x9535 0x1 0xff
write 0x9536 0x1 0xff
write 0x9537 0x1 0xff
write 0x5ac60403 0x1 0x02
EOF
On 210525 0820, Thomas Huth wrote:
> Can you still reproduce the crash with the current version of QEMU? At
> least I cannot reproduce the crash anymore, so it seems like this got
> fixed at one point in time?
>
> ** Changed in: qemu
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1878034
>
> Title:
> memcpy param-overlap through e1000e_write_to_rx_buffers
>
> Status in QEMU:
> Incomplete
>
> Bug description:
> Hello,
> While fuzzing, I found an input that triggers an overlapping memcpy (caught
> by AddressSanitizer).
> Overlapping memcpys are undefined behavior according to the POSIX and C
> standards, and can lead to bugs.
>
> ==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges
> #0 0x563c9f4823d4 in __asan_memcpy
> (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4)
> #1 0x563c9f4cb2b1 in flatview_write_continue
> /home/alxndr/Development/qemu/exec.c:3142:13
> #2 0x563c9f4c3b97 in flatview_write
> /home/alxndr/Development/qemu/exec.c:3177:14
> #3 0x563c9f4c3b97 in address_space_write
> /home/alxndr/Development/qemu/exec.c:3268:18
> #4 0x563c9fbc457b in dma_memory_rw_relaxed
> /home/alxndr/Development/qemu/include/sysemu/dma.h:87:18
> #5 0x563c9fbc457b in dma_memory_rw
> /home/alxndr/Development/qemu/include/sysemu/dma.h:110:12
> #6 0x563c9fbc457b in pci_dma_rw
> /home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5
> #7 0x563c9fbc457b in pci_dma_write
> /home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12
> #8 0x563c9fbc457b in e1000e_write_to_rx_buffers
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9
> #9 0x563c9fbb9c98 in e1000e_write_packet_to_guest
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21
> #10 0x563c9fbb9c98 in e1000e_receive_iov
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9
> #11 0x563c9fba8080 in net_tx_pkt_sendv
> /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9
> #12 0x563c9fba8080 in net_tx_pkt_send
> /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9
> #13 0x563c9fba8827 in net_tx_pkt_send_loopback
> /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11
> #14 0x563c9fbd2052 in e1000e_tx_pkt_send
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16
> #15 0x563c9fbd2052 in e1000e_process_tx_desc
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17
> #16 0x563c9fbd2052 in e1000e_start_xmit
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9
> #17 0x563c9fbcecf0 in e1000e_set_tdt
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9
> #18 0x563c9fbbf20c in e1000e_core_write
> /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9
> #19 0x563c9f5b68d6 in memory_region_write_accessor
> /home/alxndr/Development/qemu/memory.c:483:5
> #20 0x563c9f5b627f in access_with_adjusted_size
> /home/alxndr/Development/qemu/memory.c:544:18
> #21 0x563c9f5b627f in memory_region_dispatch_write
> /home/alxndr/Development/qemu/memory.c:1476:16
>
> I can reproduce it in qemu 5.0 built with --enable-sanitizers using:
> cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M
> pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none
> outl 0xcf8 0x80001010
> outl 0xcfc 0xe1020000
> outl 0xcf8 0x80001014
> outl 0xcf8 0x80001004
> outw 0xcfc 0x7
> outl 0xcf8 0x800010a2
> write 0xe102003a 0x3ff
> 0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63
> EOF
>
> I also attached the trace to this launchpad report, in case the
> formatting is broken:
>
> qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic
> -monitor none -serial none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878034
Title:
memcpy param-overlap through e1000e_write_to_rx_buffers
Status in QEMU:
Incomplete
Bug description:
Hello,
While fuzzing, I found an input that triggers an overlapping memcpy (caught
by AddressSanitizer).
Overlapping memcpys are undefined behavior according to the POSIX and C
standards, and can lead to bugs.
==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges
#0 0x563c9f4823d4 in __asan_memcpy
(/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4)
#1 0x563c9f4cb2b1 in flatview_write_continue
/home/alxndr/Development/qemu/exec.c:3142:13
#2 0x563c9f4c3b97 in flatview_write
/home/alxndr/Development/qemu/exec.c:3177:14
#3 0x563c9f4c3b97 in address_space_write
/home/alxndr/Development/qemu/exec.c:3268:18
#4 0x563c9fbc457b in dma_memory_rw_relaxed
/home/alxndr/Development/qemu/include/sysemu/dma.h:87:18
#5 0x563c9fbc457b in dma_memory_rw
/home/alxndr/Development/qemu/include/sysemu/dma.h:110:12
#6 0x563c9fbc457b in pci_dma_rw
/home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5
#7 0x563c9fbc457b in pci_dma_write
/home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12
#8 0x563c9fbc457b in e1000e_write_to_rx_buffers
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9
#9 0x563c9fbb9c98 in e1000e_write_packet_to_guest
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21
#10 0x563c9fbb9c98 in e1000e_receive_iov
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9
#11 0x563c9fba8080 in net_tx_pkt_sendv
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9
#12 0x563c9fba8080 in net_tx_pkt_send
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9
#13 0x563c9fba8827 in net_tx_pkt_send_loopback
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11
#14 0x563c9fbd2052 in e1000e_tx_pkt_send
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16
#15 0x563c9fbd2052 in e1000e_process_tx_desc
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17
#16 0x563c9fbd2052 in e1000e_start_xmit
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9
#17 0x563c9fbcecf0 in e1000e_set_tdt
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9
#18 0x563c9fbbf20c in e1000e_core_write
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9
#19 0x563c9f5b68d6 in memory_region_write_accessor
/home/alxndr/Development/qemu/memory.c:483:5
#20 0x563c9f5b627f in access_with_adjusted_size
/home/alxndr/Development/qemu/memory.c:544:18
#21 0x563c9f5b627f in memory_region_dispatch_write
/home/alxndr/Development/qemu/memory.c:1476:16
I can reproduce it in qemu 5.0 built with --enable-sanitizers using:
cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M
pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none
outl 0xcf8 0x80001010
outl 0xcfc 0xe1020000
outl 0xcf8 0x80001014
outl 0xcf8 0x80001004
outw 0xcfc 0x7
outl 0xcf8 0x800010a2
write 0xe102003a 0x3ff
0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63
EOF
I also attached the trace to this launchpad report, in case the
formatting is broken:
qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic
-monitor none -serial none < attachment
Please let me know if I can provide any further info.
-Alex
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions