id = 2428
title = "Null-pointer-dereference in ufs"
state = "closed"
created_at = "2024-07-05T21:21:58.901Z"
closed_at = "2024-07-25T08:20:29.517Z"
labels = ["Fuzzer", "Storage", "workflow::Triaged"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2428"
host-os = "Ubuntu 22.04.4 LTS"
host-arch = "x86_64"
qemu-version = "commit 3665dd6bb9"
guest-os = "n/a"
guest-arch = "n/a"
description = """The following log reveals it:

```
../hw/ufs/ufs.c:740:13: runtime error: member access within null pointer of type 'UfsSq' (aka 'struct UfsSq')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/ufs/ufs.c:740:13 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==848760==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x6220e29edfce bp 0x7fffea0c6cf0 sp 0x7fffea0c6c40 T0)
==848760==The signal is caused by a READ memory access.
==848760==Hint: address points to the zero page.
    #0 0x6220e29edfce in ufs_mcq_process_db hw/ufs/ufs.c:740:9
    #1 0x6220e29dc10f in ufs_write_mcq_op_reg hw/ufs/ufs.c:758:13
    #2 0x6220e29d85c6 in ufs_mmio_write hw/ufs/ufs.c:813:9
```"""
reproduce = """```
cat << EOF | qemu-system-x86_64  \\
-display none -machine accel=qtest, -m 512M -M q35 -nodefaults -drive \\
file=null-co://,if=none,id=disk0 -device ufs,id=ufs_bus -device \\
ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio
outl 0xcf8 0x80000810
outl 0xcfc 0xe0000000
outl 0xcf8 0x80000804
outw 0xcfc 0x02
write 0xe0001004 0x1 0x01
EOF
```"""
additional = "n/a"