diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 19:39:53 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-03 19:39:53 +0200 |
| commit | dee4dcba78baf712cab403d47d9db319ab7f95d6 (patch) | |
| tree | 418478faf06786701a56268672f73d6b0b4eb239 /results/classifier/118/none/1393 | |
| parent | 4d9e26c0333abd39bdbd039dcdb30ed429c475ba (diff) | |
| download | emulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.tar.gz emulator-bug-study-dee4dcba78baf712cab403d47d9db319ab7f95d6.zip | |
restructure results
Diffstat (limited to 'results/classifier/118/none/1393')
| -rw-r--r-- | results/classifier/118/none/1393 | 95 |
1 files changed, 0 insertions, 95 deletions
diff --git a/results/classifier/118/none/1393 b/results/classifier/118/none/1393 deleted file mode 100644 index 0fb5373f..00000000 --- a/results/classifier/118/none/1393 +++ /dev/null @@ -1,95 +0,0 @@ -TCG: 0.534 -user-level: 0.454 -VMM: 0.443 -vnc: 0.418 -virtual: 0.414 -permissions: 0.391 -assembly: 0.377 -graphic: 0.370 -hypervisor: 0.368 -performance: 0.363 -network: 0.357 -KVM: 0.353 -peripherals: 0.352 -device: 0.350 -x86: 0.350 -semantic: 0.346 -arm: 0.343 -PID: 0.341 -ppc: 0.339 -debug: 0.336 -register: 0.328 -risc-v: 0.327 -boot: 0.322 -kernel: 0.318 -architecture: 0.306 -mistranslation: 0.271 -files: 0.269 -i386: 0.248 -socket: 0.238 - -Abort in audio_calloc() of ac97 -Description of problem: -Section 5.10.2 of the AC97 specification (https://hands.com/~lkcl/ac97_r23.pdf) -shows the feasibility to support for rates other than 48kHZ. Specifically, -AC97_PCM_Front_DAC_Rate (reg 2Ch) should be from 8kHZ to 48kHZ. - - -An adversary can leverage this to crash QEMU. - -A nornal 48kHZ setting is like this. - -``` -ac97_realize - open_voice - as->freq = 0xbb80 # 0xbb80=48000 - AUD_open_out - audio_pcm_create_voice_pair_out (sw is NULL) - audio_pcm_sw_init_out - sw->info.freq = as->freq (in audio_pcm_init_info()) - sw->ratio = ((int64_t) sw->hw->info.freq << 32) / sw->info.freq - samples = ((int64_t) sw->HWBUF->size << 32) / sw->ratio (in audio_pcm_sw_alloc_resources_out()) -``` - -A non-48kHZ setting is like this. Since `as->freq` is too small, `sw->ratio` is -too large. Finally, `samples` is zero, failing the audio_calloc() in -audio_pcm_sw_alloc_resources_out(). - -``` -nam_writew - open_voice - as->freq = 0x6 - AUD_open_out - audio_pcm_sw_init_out (sw is not NULL) - sw->info.freq = as->freq (in audio_pcm_init_info()) - sw->ratio = ((int64_t) sw->hw->info.freq << 32) / sw->info.freq - samples = ((int64_t) sw->HWBUF->size << 32) / sw->ratio (in audio_pcm_sw_alloc_resources_out()) - audio_calloc(.., samples, ) (in audio_pcm_sw_alloc_resources_out()) -``` -Steps to reproduce: -1. download the prepared rootfs and the image. - - https://drive.google.com/file/d/1IfVCvn76HY-Eb4AZU7yvuyPzM3QC1q10/view?usp=sharing - https://drive.google.com/file/d/1JN6JgvOSI5aSLIdTEFKiskKbrGWFo0BO/view?usp=sharing - -2. run the following script. - -``` bash -QEMU_PATH=../../../qemu-devel/build/x86_64-softmmu/qemu-system-x86_64 -KERNEL_PATH=./bzImage -ROOTFS_PATH=./rootfs.ext2 -$QEMU_PATH \ - -M q35 -m 1G \ - -kernel $KERNEL_PATH \ - -drive file=$ROOTFS_PATH,if=virtio,format=raw \ - -append "root=/dev/vda console=ttyS0" \ - -net nic,model=virtio -net user \ - -device ac97,audiodev=snd0 -audiodev none,id=snd0 \ - -nographic -``` - -3. with spawned shell (the user is root and the password is empty), run -`ac97-00`. -Additional information: -In the latest QEMU, this issue was generally fixed by 12f4abf6a245c43d8411577fd400373c85f08c6b and 0cbc8bd4694f32687bf47c6da48efa48fac35fd2 that remove abort() from the source code. Even though, I still plan to send a -patch so that the warning about the invalid freq will be gone. |
