[Bug 1879223] Re: Assertion failure in e1000e_write_rx_descr

[Thomas Huth]

I can reproduce this problem with QEMU v5.0, but with the current
version, it does not run into this assertion anymore. Seems like this
problem got fixed in the course of time? Could you please check whether
you could still reproduce this?

** Changed in: qemu
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1879223

Title:
  Assertion failure in e1000e_write_rx_descr

Status in QEMU:
  Incomplete

Bug description:
  Hello,
  While fuzzing, I found an input which triggers an assertion failure in
  e1000e_write_rx_descr:

  qemu-system-i386: /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1359: 
void e1000e_write_rx_descr(E1000ECore *, uint8_t *, struct NetRxPkt *, const 
E1000E_RSSInfo *, size_t, uint16_t (*)[4]): Assertion `ps_hdr_len == 0' failed.
  Aborted
  #3  0x00007ffff684d092 in __GI___assert_fail (assertion=0x5555583703e0 <str> 
"ps_hdr_len == 0", file=0x555558361080 <str> 
"/home/alxndr/Development/qemu/hw/net/e1000e_core.c", line=0x54f, 
function=0x555558370420 <__PRETTY_FUNCTION__.e1000e_write_rx_descr> "void 
e1000e_write_rx_descr(E1000ECore *, uint8_t *, struct NetRxPkt *, const 
E1000E_RSSInfo *, size_t, uint16_t (*)[4])") at assert.c:101
  #4  0x0000555557206a58 in e1000e_write_rx_descr (core=0x7fffee0dd4e0, 
desc=0x7fffffff8720 "", pkt=0x0, rss_info=0x7fffffff8c50, ps_hdr_len=0x2a, 
written=0x7fffffff87c0) at 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1359
  #5  0x00005555571f8507 in e1000e_write_packet_to_guest (core=0x7fffee0dd4e0, 
pkt=0x61100004b900, rxr=0x7fffffff8c30, rss_info=0x7fffffff8c50) at 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1607
  #6  0x00005555571f5670 in e1000e_receive_iov (core=0x7fffee0dd4e0, 
iov=0x61900004e780, iovcnt=0x4) at 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709
  #7  0x00005555571f1afc in e1000e_nc_receive_iov (nc=0x614000007460, 
iov=0x61900004e780, iovcnt=0x4) at 
/home/alxndr/Development/qemu/hw/net/e1000e.c:213
  #8  0x00005555571d5977 in net_tx_pkt_sendv (pkt=0x631000028800, 
nc=0x614000007460, iov=0x61900004e780, iov_cnt=0x4) at 
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544
  #9  0x00005555571d50e4 in net_tx_pkt_send (pkt=0x631000028800, 
nc=0x614000007460) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620
  #10 0x00005555571d638f in net_tx_pkt_send_loopback (pkt=0x631000028800, 
nc=0x614000007460) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633
  #11 0x000055555722b600 in e1000e_tx_pkt_send (core=0x7fffee0dd4e0, 
tx=0x7fffee0fd748, queue_index=0x0) at 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:664
  #12 0x0000555557229ca6 in e1000e_process_tx_desc (core=0x7fffee0dd4e0, 
tx=0x7fffee0fd748, dp=0x7fffffff9440, queue_index=0x0) at 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:743
  #13 0x0000555557228ea5 in e1000e_start_xmit (core=0x7fffee0dd4e0, 
txr=0x7fffffff9640) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934
  #14 0x000055555721c70f in e1000e_set_tdt (core=0x7fffee0dd4e0, index=0xe06, 
val=0xcb) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451
  #15 0x00005555571fa436 in e1000e_core_write (core=0x7fffee0dd4e0, addr=0x438, 
val=0xcb, size=0x4) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261
  #16 0x00005555571ed11c in e1000e_mmio_write (opaque=0x7fffee0da800, 
addr=0x438, val=0xcb, size=0x4) at 
/home/alxndr/Development/qemu/hw/net/e1000e.c:109
  #17 0x00005555565e78b2 in memory_region_write_accessor (mr=0x7fffee0dd110, 
addr=0x438, value=0x7fffffff9cb0, size=0x4, shift=0x0, mask=0xffffffff, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:483
  #18 0x00005555565e7212 in access_with_adjusted_size (addr=0x438, 
value=0x7fffffff9cb0, size=0x1, access_size_min=0x4, access_size_max=0x4, 
access_fn=0x5555565e72e0 <memory_region_write_accessor>, mr=0x7fffee0dd110, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:544
  #19 0x00005555565e5c31 in memory_region_dispatch_write (mr=0x7fffee0dd110, 
addr=0x438, data=0xcb, op=MO_8, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:1476
  #20 0x00005555563f04b9 in flatview_write_continue (fv=0x606000037880, 
addr=0xe1020438, attrs=..., ptr=0x61900009ba80, len=0x1, addr1=0x438, l=0x1, 
mr=0x7fffee0dd110) at /home/alxndr/Development/qemu/exec.c:3137
  #21 0x00005555563df2dd in flatview_write (fv=0x606000037880, addr=0xe1020077, 
attrs=..., buf=0x61900009ba80, len=0x3c2) at 
/home/alxndr/Development/qemu/exec.c:3177
  #22 0x00005555563deded in address_space_write (as=0x6080000027a0, 
addr=0xe1020077, attrs=..., buf=0x61900009ba80, len=0x3c2) at 
/home/alxndr/Development/qemu/exec.c:3268


  I can reproduce this in qemu 5.0  using these qtest commands:

  cat << EOF | ./qemu-system-i386 \
  -qtest stdio -nographic -monitor none -serial none \
  -M pc-q35-5.0
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001014
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x800010a2
  write 0xe1025008 0x4 0xfbffa3fa
  write 0xed040c 0x3 0x080047
  write 0xe1020077 0x3c2 
0xce0004ed0000000000cb008405120002e100000000ff000801ffff02ce0004ed0000000000cb008405120002e100000000ff000a01ffff02ce0004ed0000000000cb008405120002e100000000ff000c01ffff02ce0004ed0000000000cb008405120002e100000000ff000e01ffff02ce0004ed0000000000cb008405120002e100000000ff001001ffff02ce0004ed0000000000cb008405120002e100000000ff001201ffff02ce0004ed0000000000cb008405120002e100000000ff001401ffff02ce0004ed0000000000cb008405120002e100000000ff001601ffff02ce0004ed0000000000cb008405120002e100000000ff001801ffff02ce0004ed0000000000cb008405120002e100000000ff001a01ffff02ce0004ed0000000000cb008405120002e100000000ff001c01ffff02ce0004ed0000000000cb008405120002e100000000ff001e01ffff02ce0004ed0000000000cb008405120002e100000000ff002001ffff02ce0004ed0000000000cb008405120002e100000000ff002201ffff02ce0004ed0000000000cb008405120002e100000000ff002401ffff02ce0004ed0000000000cb008405120002e100000000ff002601ffff02ce0004ed0000000000cb008405120002e100000000ff002801ffff02ce0004ed0000000000cb008405120002e100000000ff002a01ffff02ce0004ed0000000000cb008405120002e100000000ff002c01ffff02ce0004ed0000000000cb008405120002e100000000ff002e01ffff02ce0004ed0000000000cb008405120002e100000000ff003001ffff02ce0004ed0000000000cb008405120002e100000000ff003201ffff02ce0004ed0000000000cb008405120002e100000000ff003401ffff02ce0004ed0000000000cb008405120002e100000000ff003601ffff02ce0004ed0000000000cb008405120002e100000000ff003801ffff02ce0004ed0000000000cb008405120002e100000000ff003a01ffff02ce0004ed0000000000cb008405120002e100000000ff003c01ffff02ce0004ed0000000000cb008405120002e100000000ff003e01ffff02ce0004ed0000000000cb008405120002e100000000ff004001ffff02ce0004ed0000000000cb008405120002e100000000ff004201ffff02ce0004ed0000000000cb008405120002e100000000ff004401ffff02ce0004ed0000000000cb008405120002e100000000ff004601ffff02ce0004ed0000000000cb008405120002e100000000ff004801ffff02ce0004ed0000000000cb008405120002e100000000ff004a01ffff02ce0004ed0000000000cb
  EOF

  Also attaching them to this report, in case they are formatted incorrectly:
  ./qemu-system-i386 \
  -qtest stdio -nographic -monitor none -serial none \
  -M pc-q35-5.0 < attachment

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1879223/+subscriptions