summary refs log tree commit diff stats
path: root/results/classifier/108/other/1914638
diff options
context:
space:
mode:
Diffstat (limited to 'results/classifier/108/other/1914638')
-rw-r--r--results/classifier/108/other/1914638601
1 files changed, 601 insertions, 0 deletions
diff --git a/results/classifier/108/other/1914638 b/results/classifier/108/other/1914638
new file mode 100644
index 000000000..7f7e91655
--- /dev/null
+++ b/results/classifier/108/other/1914638
@@ -0,0 +1,601 @@
+other: 0.889
+vnc: 0.852
+KVM: 0.820
+permissions: 0.816
+device: 0.799
+PID: 0.793
+debug: 0.789
+semantic: 0.779
+performance: 0.773
+socket: 0.767
+files: 0.760
+boot: 0.757
+graphic: 0.746
+network: 0.712
+
+[OSS-Fuzz] Issue 30219: Global-buffer-overflow in mode_sense_page
+
+== Reproducer (build with --enable-sanitizers) ==
+
+cat << EOF | ./qemu-system-i386 -machine q35 -nodefaults \
+-device megasas -device scsi-cd,drive=null0 \
+-blockdev driver=null-co,read-zeroes=on,node-name=null0 \
+-nographic -qtest stdio
+outl 0xcf8 0x80000818
+outl 0xcfc 0xc000
+outl 0xcf8 0x80000804
+outw 0xcfc 0x7
+write 0x0 0x1 0x03
+write 0x7 0x1 0x3f
+write 0x10 0x1 0x03
+write 0x20 0x1 0x55
+write 0x21 0x1 0x10
+write 0x28 0x1 0x10
+write 0x30 0x1 0xff
+write 0x31 0x1 0xff
+write 0x32 0x1 0xff
+write 0x33 0x1 0xff
+write 0x34 0x1 0xff
+write 0x35 0x1 0xff
+write 0x36 0x1 0xff
+write 0x37 0x1 0xff
+write 0x3b 0x1 0x10
+write 0x43 0x1 0x10
+write 0x44 0x1 0x10
+write 0x4f 0x1 0x10
+write 0x53 0x1 0x10
+write 0x5b 0x1 0x10
+write 0x5f 0x1 0x10
+write 0x67 0x1 0x10
+write 0x6b 0x1 0x10
+write 0x73 0x1 0x10
+write 0x75 0x1 0x10
+write 0x7d 0x1 0x10
+write 0x83 0x1 0x10
+write 0x8b 0x1 0x10
+write 0x8f 0x1 0x10
+write 0x97 0x1 0x10
+write 0x9b 0x1 0x10
+write 0xa3 0x1 0x03
+write 0xa6 0x1 0x10
+write 0xae 0x1 0x10
+write 0xb3 0x1 0x10
+write 0xbb 0x1 0x10
+write 0xbf 0x1 0x10
+write 0xc7 0x1 0x10
+write 0xca 0x1 0x10
+write 0xd3 0x1 0x06
+write 0xd7 0x1 0x10
+write 0xdf 0x1 0x10
+write 0xe3 0x1 0x06
+write 0xeb 0x1 0x01
+write 0xef 0x1 0x10
+write 0xf7 0x1 0x10
+write 0xfb 0x1 0x10
+write 0x103 0x1 0x20
+write 0x107 0x1 0x10
+write 0x10f 0x1 0x10
+write 0x113 0x1 0x10
+write 0x11b 0x1 0x10
+write 0x11f 0x1 0x10
+write 0x127 0x1 0x10
+write 0x12b 0x1 0x10
+write 0x130 0x1 0x10
+write 0x137 0x1 0x10
+write 0x13f 0x1 0x40
+write 0x141 0x1 0x10
+write 0x14b 0x1 0x10
+write 0x14f 0x1 0x10
+write 0x157 0x1 0x10
+write 0x15b 0x1 0x10
+write 0x161 0x1 0x10
+write 0x167 0x1 0x03
+write 0x16f 0x1 0x06
+write 0x172 0x1 0x10
+write 0x17b 0x1 0x10
+write 0x17f 0x1 0x10
+write 0x187 0x1 0x10
+write 0x18b 0x1 0x10
+write 0x192 0x1 0x10
+write 0x197 0x1 0x06
+write 0x19f 0x1 0x20
+write 0x1a3 0x1 0x10
+write 0x1ab 0x1 0x40
+write 0x1af 0x1 0x01
+write 0x1b7 0x1 0x10
+write 0x1bb 0x1 0x20
+write 0x1c3 0x1 0x10
+write 0x1c7 0x1 0x20
+write 0x1cc 0x1 0x10
+write 0x1d3 0x1 0x10
+write 0x1db 0x1 0x10
+write 0x1df 0x1 0x10
+write 0x1e7 0x1 0x10
+write 0x1eb 0x1 0x10
+write 0x1f3 0x1 0x10
+write 0x1f4 0x1 0x10
+write 0x1fd 0x1 0x10
+write 0x203 0x1 0x40
+write 0x20b 0x1 0x10
+write 0x20f 0x1 0x10
+write 0x217 0x1 0x10
+write 0x21b 0x1 0x10
+write 0x223 0x1 0x10
+write 0x225 0x1 0x10
+write 0x22e 0x1 0x10
+write 0x233 0x1 0x06
+write 0x23b 0x1 0x10
+write 0x23f 0x1 0x10
+write 0x247 0x1 0x10
+write 0x24b 0x1 0x10
+write 0x252 0x1 0x10
+write 0x256 0x1 0x10
+write 0x25f 0x1 0x10
+write 0x263 0x1 0x20
+write 0x26b 0x1 0x06
+write 0x26f 0x1 0x40
+write 0x277 0x1 0x10
+write 0x27b 0x1 0x10
+write 0x283 0x1 0x10
+write 0x287 0x1 0x10
+write 0x28f 0x1 0x10
+write 0x290 0x1 0x10
+write 0x29b 0x1 0x10
+write 0x29f 0x1 0x10
+write 0x2a7 0x1 0x10
+write 0x2ab 0x1 0x10
+write 0x2b3 0x1 0x10
+write 0x2b7 0x1 0x10
+write 0x2bf 0x1 0x10
+write 0x2c1 0x1 0x10
+write 0x2c9 0x1 0x10
+write 0x2cf 0x1 0x10
+write 0x2d7 0x1 0x10
+write 0x2db 0x1 0x10
+write 0x2e3 0x1 0x10
+write 0x2e7 0x1 0x10
+write 0x2ef 0x1 0x03
+write 0x2f2 0x1 0x10
+write 0x2fa 0x1 0x10
+write 0x2ff 0x1 0x10
+write 0x307 0x1 0x10
+write 0x30b 0x1 0x10
+write 0x313 0x1 0x10
+write 0x316 0x1 0x10
+write 0x31f 0x1 0x06
+write 0x323 0x1 0x10
+outb 0xc040 0x0
+EOF
+
+=== Stack Trace ===
+==1025760==ERROR: AddressSanitizer: global-buffer-overflow on address 0x558f557253fc at pc 0x558f549ab376 bp
+0x7ffd436e9770 sp 0x7ffd436e9768
+READ of size 4 at 0x558f557253fc thread T0
+SCARINESS: 17 (4-byte-read-global-buffer-overflow)
+#0 0x558f549ab375 in mode_sense_page /src/qemu/hw/scsi/scsi-disk.c:1104:10
+#1 0x558f549afd86 in scsi_disk_check_mode_select /src/qemu/hw/scsi/scsi-disk.c:1447:11
+#2 0x558f549af9a6 in mode_select_pages /src/qemu/hw/scsi/scsi-disk.c:1515:17
+#3 0x558f549ae593 in scsi_disk_emulate_mode_select /src/qemu/hw/scsi/scsi-disk.c:1570:13
+#4 0x558f549a56e9 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1861:9
+#5 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+#6 0x558f548b9fc4 in scsi_req_data /src/qemu/hw/scsi/scsi-bus.c:1427:5
+#7 0x558f549a5554 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1853:9
+#8 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+#9 0x558f54ac7cf6 in megasas_enqueue_req /src/qemu/hw/scsi/megasas.c:1660:9
+#10 0x558f54ab6e09 in megasas_handle_scsi /src/qemu/hw/scsi/megasas.c:1735:5
+#11 0x558f54ab3083 in megasas_handle_frame /src/qemu/hw/scsi/megasas.c:1974:24
+#12 0x558f54ab1c8b in megasas_mmio_write /src/qemu/hw/scsi/megasas.c:2131:9
+#13 0x558f54acc784 in megasas_port_write /src/qemu/hw/scsi/megasas.c:2182:5
+#14 0x558f54f78d57 in memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5
+#15 0x558f54f78be2 in access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18
+#16 0x558f54f78441 in memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13
+#17 0x558f550d5627 in flatview_write_continue /src/qemu/softmmu/physmem.c:2763:23
+#18 0x558f550d02ac in flatview_write /src/qemu/softmmu/physmem.c:2803:14
+#19 0x558f550d00c7 in address_space_write /src/qemu/softmmu/physmem.c:2895:18
+#20 0x558f5506c4ff in cpu_outb /src/qemu/softmmu/ioport.c:60:5
+
++CC Paolo and Fam
+
+scsi-disk.c:1092     static const int mode_sense_valid[0x3f] =
+...
+scsi-disk.c:1488          page = p[0] & 0x3f;
+
+OSS-Fuzz found this same crash for virtio-scsi, however, since the
+reproducer involved a double-fetch, I don't have a simple QTest
+reproducer
+
+On 210204 1728, Alexander Bulekov wrote:
+> Public bug reported:
+> 
+> == Reproducer (build with --enable-sanitizers) ==
+> 
+> cat << EOF | ./qemu-system-i386 -machine q35 -nodefaults \
+> -device megasas -device scsi-cd,drive=null0 \
+> -blockdev driver=null-co,read-zeroes=on,node-name=null0 \
+> -nographic -qtest stdio
+> outl 0xcf8 0x80000818
+> outl 0xcfc 0xc000
+> outl 0xcf8 0x80000804
+> outw 0xcfc 0x7
+> write 0x0 0x1 0x03
+> write 0x7 0x1 0x3f
+> write 0x10 0x1 0x03
+> write 0x20 0x1 0x55
+> write 0x21 0x1 0x10
+> write 0x28 0x1 0x10
+> write 0x30 0x1 0xff
+> write 0x31 0x1 0xff
+> write 0x32 0x1 0xff
+> write 0x33 0x1 0xff
+> write 0x34 0x1 0xff
+> write 0x35 0x1 0xff
+> write 0x36 0x1 0xff
+> write 0x37 0x1 0xff
+> write 0x3b 0x1 0x10
+> write 0x43 0x1 0x10
+> write 0x44 0x1 0x10
+> write 0x4f 0x1 0x10
+> write 0x53 0x1 0x10
+> write 0x5b 0x1 0x10
+> write 0x5f 0x1 0x10
+> write 0x67 0x1 0x10
+> write 0x6b 0x1 0x10
+> write 0x73 0x1 0x10
+> write 0x75 0x1 0x10
+> write 0x7d 0x1 0x10
+> write 0x83 0x1 0x10
+> write 0x8b 0x1 0x10
+> write 0x8f 0x1 0x10
+> write 0x97 0x1 0x10
+> write 0x9b 0x1 0x10
+> write 0xa3 0x1 0x03
+> write 0xa6 0x1 0x10
+> write 0xae 0x1 0x10
+> write 0xb3 0x1 0x10
+> write 0xbb 0x1 0x10
+> write 0xbf 0x1 0x10
+> write 0xc7 0x1 0x10
+> write 0xca 0x1 0x10
+> write 0xd3 0x1 0x06
+> write 0xd7 0x1 0x10
+> write 0xdf 0x1 0x10
+> write 0xe3 0x1 0x06
+> write 0xeb 0x1 0x01
+> write 0xef 0x1 0x10
+> write 0xf7 0x1 0x10
+> write 0xfb 0x1 0x10
+> write 0x103 0x1 0x20
+> write 0x107 0x1 0x10
+> write 0x10f 0x1 0x10
+> write 0x113 0x1 0x10
+> write 0x11b 0x1 0x10
+> write 0x11f 0x1 0x10
+> write 0x127 0x1 0x10
+> write 0x12b 0x1 0x10
+> write 0x130 0x1 0x10
+> write 0x137 0x1 0x10
+> write 0x13f 0x1 0x40
+> write 0x141 0x1 0x10
+> write 0x14b 0x1 0x10
+> write 0x14f 0x1 0x10
+> write 0x157 0x1 0x10
+> write 0x15b 0x1 0x10
+> write 0x161 0x1 0x10
+> write 0x167 0x1 0x03
+> write 0x16f 0x1 0x06
+> write 0x172 0x1 0x10
+> write 0x17b 0x1 0x10
+> write 0x17f 0x1 0x10
+> write 0x187 0x1 0x10
+> write 0x18b 0x1 0x10
+> write 0x192 0x1 0x10
+> write 0x197 0x1 0x06
+> write 0x19f 0x1 0x20
+> write 0x1a3 0x1 0x10
+> write 0x1ab 0x1 0x40
+> write 0x1af 0x1 0x01
+> write 0x1b7 0x1 0x10
+> write 0x1bb 0x1 0x20
+> write 0x1c3 0x1 0x10
+> write 0x1c7 0x1 0x20
+> write 0x1cc 0x1 0x10
+> write 0x1d3 0x1 0x10
+> write 0x1db 0x1 0x10
+> write 0x1df 0x1 0x10
+> write 0x1e7 0x1 0x10
+> write 0x1eb 0x1 0x10
+> write 0x1f3 0x1 0x10
+> write 0x1f4 0x1 0x10
+> write 0x1fd 0x1 0x10
+> write 0x203 0x1 0x40
+> write 0x20b 0x1 0x10
+> write 0x20f 0x1 0x10
+> write 0x217 0x1 0x10
+> write 0x21b 0x1 0x10
+> write 0x223 0x1 0x10
+> write 0x225 0x1 0x10
+> write 0x22e 0x1 0x10
+> write 0x233 0x1 0x06
+> write 0x23b 0x1 0x10
+> write 0x23f 0x1 0x10
+> write 0x247 0x1 0x10
+> write 0x24b 0x1 0x10
+> write 0x252 0x1 0x10
+> write 0x256 0x1 0x10
+> write 0x25f 0x1 0x10
+> write 0x263 0x1 0x20
+> write 0x26b 0x1 0x06
+> write 0x26f 0x1 0x40
+> write 0x277 0x1 0x10
+> write 0x27b 0x1 0x10
+> write 0x283 0x1 0x10
+> write 0x287 0x1 0x10
+> write 0x28f 0x1 0x10
+> write 0x290 0x1 0x10
+> write 0x29b 0x1 0x10
+> write 0x29f 0x1 0x10
+> write 0x2a7 0x1 0x10
+> write 0x2ab 0x1 0x10
+> write 0x2b3 0x1 0x10
+> write 0x2b7 0x1 0x10
+> write 0x2bf 0x1 0x10
+> write 0x2c1 0x1 0x10
+> write 0x2c9 0x1 0x10
+> write 0x2cf 0x1 0x10
+> write 0x2d7 0x1 0x10
+> write 0x2db 0x1 0x10
+> write 0x2e3 0x1 0x10
+> write 0x2e7 0x1 0x10
+> write 0x2ef 0x1 0x03
+> write 0x2f2 0x1 0x10
+> write 0x2fa 0x1 0x10
+> write 0x2ff 0x1 0x10
+> write 0x307 0x1 0x10
+> write 0x30b 0x1 0x10
+> write 0x313 0x1 0x10
+> write 0x316 0x1 0x10
+> write 0x31f 0x1 0x06
+> write 0x323 0x1 0x10
+> outb 0xc040 0x0
+> EOF
+> 
+> === Stack Trace ===
+> ==1025760==ERROR: AddressSanitizer: global-buffer-overflow on address 0x558f557253fc at pc 0x558f549ab376 bp
+> 0x7ffd436e9770 sp 0x7ffd436e9768
+> READ of size 4 at 0x558f557253fc thread T0
+> SCARINESS: 17 (4-byte-read-global-buffer-overflow)
+> #0 0x558f549ab375 in mode_sense_page /src/qemu/hw/scsi/scsi-disk.c:1104:10
+> #1 0x558f549afd86 in scsi_disk_check_mode_select /src/qemu/hw/scsi/scsi-disk.c:1447:11
+> #2 0x558f549af9a6 in mode_select_pages /src/qemu/hw/scsi/scsi-disk.c:1515:17
+> #3 0x558f549ae593 in scsi_disk_emulate_mode_select /src/qemu/hw/scsi/scsi-disk.c:1570:13
+> #4 0x558f549a56e9 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1861:9
+> #5 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+> #6 0x558f548b9fc4 in scsi_req_data /src/qemu/hw/scsi/scsi-bus.c:1427:5
+> #7 0x558f549a5554 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1853:9
+> #8 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+> #9 0x558f54ac7cf6 in megasas_enqueue_req /src/qemu/hw/scsi/megasas.c:1660:9
+> #10 0x558f54ab6e09 in megasas_handle_scsi /src/qemu/hw/scsi/megasas.c:1735:5
+> #11 0x558f54ab3083 in megasas_handle_frame /src/qemu/hw/scsi/megasas.c:1974:24
+> #12 0x558f54ab1c8b in megasas_mmio_write /src/qemu/hw/scsi/megasas.c:2131:9
+> #13 0x558f54acc784 in megasas_port_write /src/qemu/hw/scsi/megasas.c:2182:5
+> #14 0x558f54f78d57 in memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5
+> #15 0x558f54f78be2 in access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18
+> #16 0x558f54f78441 in memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13
+> #17 0x558f550d5627 in flatview_write_continue /src/qemu/softmmu/physmem.c:2763:23
+> #18 0x558f550d02ac in flatview_write /src/qemu/softmmu/physmem.c:2803:14
+> #19 0x558f550d00c7 in address_space_write /src/qemu/softmmu/physmem.c:2895:18
+> #20 0x558f5506c4ff in cpu_outb /src/qemu/softmmu/ioport.c:60:5
+> 
+> ** Affects: qemu
+>      Importance: Undecided
+>          Status: New
+> 
+> -- 
+> You received this bug notification because you are a member of qemu-
+> devel-ml, which is subscribed to QEMU.
+> https://bugs.launchpad.net/bugs/1914638
+> 
+> Title:
+>   [OSS-Fuzz] Issue 30219: Global-buffer-overflow in mode_sense_page
+> 
+> Status in QEMU:
+>   New
+> 
+> Bug description:
+>   == Reproducer (build with --enable-sanitizers) ==
+> 
+>   cat << EOF | ./qemu-system-i386 -machine q35 -nodefaults \
+>   -device megasas -device scsi-cd,drive=null0 \
+>   -blockdev driver=null-co,read-zeroes=on,node-name=null0 \
+>   -nographic -qtest stdio
+>   outl 0xcf8 0x80000818
+>   outl 0xcfc 0xc000
+>   outl 0xcf8 0x80000804
+>   outw 0xcfc 0x7
+>   write 0x0 0x1 0x03
+>   write 0x7 0x1 0x3f
+>   write 0x10 0x1 0x03
+>   write 0x20 0x1 0x55
+>   write 0x21 0x1 0x10
+>   write 0x28 0x1 0x10
+>   write 0x30 0x1 0xff
+>   write 0x31 0x1 0xff
+>   write 0x32 0x1 0xff
+>   write 0x33 0x1 0xff
+>   write 0x34 0x1 0xff
+>   write 0x35 0x1 0xff
+>   write 0x36 0x1 0xff
+>   write 0x37 0x1 0xff
+>   write 0x3b 0x1 0x10
+>   write 0x43 0x1 0x10
+>   write 0x44 0x1 0x10
+>   write 0x4f 0x1 0x10
+>   write 0x53 0x1 0x10
+>   write 0x5b 0x1 0x10
+>   write 0x5f 0x1 0x10
+>   write 0x67 0x1 0x10
+>   write 0x6b 0x1 0x10
+>   write 0x73 0x1 0x10
+>   write 0x75 0x1 0x10
+>   write 0x7d 0x1 0x10
+>   write 0x83 0x1 0x10
+>   write 0x8b 0x1 0x10
+>   write 0x8f 0x1 0x10
+>   write 0x97 0x1 0x10
+>   write 0x9b 0x1 0x10
+>   write 0xa3 0x1 0x03
+>   write 0xa6 0x1 0x10
+>   write 0xae 0x1 0x10
+>   write 0xb3 0x1 0x10
+>   write 0xbb 0x1 0x10
+>   write 0xbf 0x1 0x10
+>   write 0xc7 0x1 0x10
+>   write 0xca 0x1 0x10
+>   write 0xd3 0x1 0x06
+>   write 0xd7 0x1 0x10
+>   write 0xdf 0x1 0x10
+>   write 0xe3 0x1 0x06
+>   write 0xeb 0x1 0x01
+>   write 0xef 0x1 0x10
+>   write 0xf7 0x1 0x10
+>   write 0xfb 0x1 0x10
+>   write 0x103 0x1 0x20
+>   write 0x107 0x1 0x10
+>   write 0x10f 0x1 0x10
+>   write 0x113 0x1 0x10
+>   write 0x11b 0x1 0x10
+>   write 0x11f 0x1 0x10
+>   write 0x127 0x1 0x10
+>   write 0x12b 0x1 0x10
+>   write 0x130 0x1 0x10
+>   write 0x137 0x1 0x10
+>   write 0x13f 0x1 0x40
+>   write 0x141 0x1 0x10
+>   write 0x14b 0x1 0x10
+>   write 0x14f 0x1 0x10
+>   write 0x157 0x1 0x10
+>   write 0x15b 0x1 0x10
+>   write 0x161 0x1 0x10
+>   write 0x167 0x1 0x03
+>   write 0x16f 0x1 0x06
+>   write 0x172 0x1 0x10
+>   write 0x17b 0x1 0x10
+>   write 0x17f 0x1 0x10
+>   write 0x187 0x1 0x10
+>   write 0x18b 0x1 0x10
+>   write 0x192 0x1 0x10
+>   write 0x197 0x1 0x06
+>   write 0x19f 0x1 0x20
+>   write 0x1a3 0x1 0x10
+>   write 0x1ab 0x1 0x40
+>   write 0x1af 0x1 0x01
+>   write 0x1b7 0x1 0x10
+>   write 0x1bb 0x1 0x20
+>   write 0x1c3 0x1 0x10
+>   write 0x1c7 0x1 0x20
+>   write 0x1cc 0x1 0x10
+>   write 0x1d3 0x1 0x10
+>   write 0x1db 0x1 0x10
+>   write 0x1df 0x1 0x10
+>   write 0x1e7 0x1 0x10
+>   write 0x1eb 0x1 0x10
+>   write 0x1f3 0x1 0x10
+>   write 0x1f4 0x1 0x10
+>   write 0x1fd 0x1 0x10
+>   write 0x203 0x1 0x40
+>   write 0x20b 0x1 0x10
+>   write 0x20f 0x1 0x10
+>   write 0x217 0x1 0x10
+>   write 0x21b 0x1 0x10
+>   write 0x223 0x1 0x10
+>   write 0x225 0x1 0x10
+>   write 0x22e 0x1 0x10
+>   write 0x233 0x1 0x06
+>   write 0x23b 0x1 0x10
+>   write 0x23f 0x1 0x10
+>   write 0x247 0x1 0x10
+>   write 0x24b 0x1 0x10
+>   write 0x252 0x1 0x10
+>   write 0x256 0x1 0x10
+>   write 0x25f 0x1 0x10
+>   write 0x263 0x1 0x20
+>   write 0x26b 0x1 0x06
+>   write 0x26f 0x1 0x40
+>   write 0x277 0x1 0x10
+>   write 0x27b 0x1 0x10
+>   write 0x283 0x1 0x10
+>   write 0x287 0x1 0x10
+>   write 0x28f 0x1 0x10
+>   write 0x290 0x1 0x10
+>   write 0x29b 0x1 0x10
+>   write 0x29f 0x1 0x10
+>   write 0x2a7 0x1 0x10
+>   write 0x2ab 0x1 0x10
+>   write 0x2b3 0x1 0x10
+>   write 0x2b7 0x1 0x10
+>   write 0x2bf 0x1 0x10
+>   write 0x2c1 0x1 0x10
+>   write 0x2c9 0x1 0x10
+>   write 0x2cf 0x1 0x10
+>   write 0x2d7 0x1 0x10
+>   write 0x2db 0x1 0x10
+>   write 0x2e3 0x1 0x10
+>   write 0x2e7 0x1 0x10
+>   write 0x2ef 0x1 0x03
+>   write 0x2f2 0x1 0x10
+>   write 0x2fa 0x1 0x10
+>   write 0x2ff 0x1 0x10
+>   write 0x307 0x1 0x10
+>   write 0x30b 0x1 0x10
+>   write 0x313 0x1 0x10
+>   write 0x316 0x1 0x10
+>   write 0x31f 0x1 0x06
+>   write 0x323 0x1 0x10
+>   outb 0xc040 0x0
+>   EOF
+> 
+>   === Stack Trace ===
+>   ==1025760==ERROR: AddressSanitizer: global-buffer-overflow on address 0x558f557253fc at pc 0x558f549ab376 bp
+>   0x7ffd436e9770 sp 0x7ffd436e9768
+>   READ of size 4 at 0x558f557253fc thread T0
+>   SCARINESS: 17 (4-byte-read-global-buffer-overflow)
+>   #0 0x558f549ab375 in mode_sense_page /src/qemu/hw/scsi/scsi-disk.c:1104:10
+>   #1 0x558f549afd86 in scsi_disk_check_mode_select /src/qemu/hw/scsi/scsi-disk.c:1447:11
+>   #2 0x558f549af9a6 in mode_select_pages /src/qemu/hw/scsi/scsi-disk.c:1515:17
+>   #3 0x558f549ae593 in scsi_disk_emulate_mode_select /src/qemu/hw/scsi/scsi-disk.c:1570:13
+>   #4 0x558f549a56e9 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1861:9
+>   #5 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+>   #6 0x558f548b9fc4 in scsi_req_data /src/qemu/hw/scsi/scsi-bus.c:1427:5
+>   #7 0x558f549a5554 in scsi_disk_emulate_write_data /src/qemu/hw/scsi/scsi-disk.c:1853:9
+>   #8 0x558f548b9b49 in scsi_req_continue /src/qemu/hw/scsi/scsi-bus.c:0
+>   #9 0x558f54ac7cf6 in megasas_enqueue_req /src/qemu/hw/scsi/megasas.c:1660:9
+>   #10 0x558f54ab6e09 in megasas_handle_scsi /src/qemu/hw/scsi/megasas.c:1735:5
+>   #11 0x558f54ab3083 in megasas_handle_frame /src/qemu/hw/scsi/megasas.c:1974:24
+>   #12 0x558f54ab1c8b in megasas_mmio_write /src/qemu/hw/scsi/megasas.c:2131:9
+>   #13 0x558f54acc784 in megasas_port_write /src/qemu/hw/scsi/megasas.c:2182:5
+>   #14 0x558f54f78d57 in memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5
+>   #15 0x558f54f78be2 in access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18
+>   #16 0x558f54f78441 in memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13
+>   #17 0x558f550d5627 in flatview_write_continue /src/qemu/softmmu/physmem.c:2763:23
+>   #18 0x558f550d02ac in flatview_write /src/qemu/softmmu/physmem.c:2803:14
+>   #19 0x558f550d00c7 in address_space_write /src/qemu/softmmu/physmem.c:2895:18
+>   #20 0x558f5506c4ff in cpu_outb /src/qemu/softmmu/ioport.c:60:5
+> 
+> To manage notifications about this bug go to:
+> https://bugs.launchpad.net/qemu/+bug/1914638/+subscriptions
+> 
+
+
+Proposed fix:
+https://<email address hidden>/msg779652.html
+
+What happened to your patch, Philippe? Did it get stalled?
+
+I moved this report over to QEMU's new bug tracker on gitlab.com.
+Please continue with the discussion here:
+
+https://gitlab.com/qemu-project/qemu/-/issues/546
+
+Thanks for moving it over! ... let's close this one here on Launchpad now.
+
+