diff options
Diffstat (limited to 'results/classifier/105/instruction/1882065')
| -rw-r--r-- | results/classifier/105/instruction/1882065 | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/results/classifier/105/instruction/1882065 b/results/classifier/105/instruction/1882065 new file mode 100644 index 000000000..8dfea3652 --- /dev/null +++ b/results/classifier/105/instruction/1882065 @@ -0,0 +1,50 @@ +instruction: 0.762 +graphic: 0.749 +network: 0.716 +device: 0.712 +mistranslation: 0.709 +semantic: 0.692 +vnc: 0.659 +socket: 0.636 +other: 0.589 +boot: 0.487 +KVM: 0.422 +assembly: 0.342 + +Could this cause OOB bug ? + +In function megasas_handle_scsi(hw/scsi/megasas.c): + +```c +static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd, + int frame_cmd) +{ + ............................................................................ + cdb = cmd->frame->pass.cdb; + target_id = cmd->frame->header.target_id; + lun_id = cmd->frame->header.lun_id; + cdb_len = cmd->frame->header.cdb_len; + ............................................................................ + if (cdb_len > 16) { + trace_megasas_scsi_invalid_cdb_len( + mfi_frame_desc[frame_cmd], is_logical, + target_id, lun_id, cdb_len); + megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE)); + cmd->frame->header.scsi_status = CHECK_CONDITION; + s->event_count++; + return MFI_STAT_SCSI_DONE_WITH_ERROR; + } +} +``` + +Two variables, frame_cmd and cdb_len, can be controlled by guest os. So can mfi_frame_desc[frame_cmd] cause OOB bug ? + +QEMU emulator version 5.0.50 (v5.0.0-533-gdebe78ce14-dirty) + +You must start the trace function of QEMU to trigger this BUG! + +I think we should fix this anyway, even if it can only be triggered when trace functions are enabled + +Fix has been included: +https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ee760ac80ac1f1 + |