1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
|
[OSS-Fuzz] Issue 31875 megasas: Null-ptr dereference in megasas_finish_dcmd
Hello,
== QTest Reproducer ==
/*
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
* 512M -machine q35 -nodefaults -device megasas -device \
* scsi-cd,drive=null0 -blockdev \
* driver=null-co,read-zeroes=on,node-name=null0 -qtest stdio
* outl 0xcf8 0x80000801
* outl 0xcfc 0x05000000
* outl 0xcf8 0x80000816
* outl 0xcfc 0x19000000
* write 0x1e1ed300 0x1 0x01
* write 0x1e1ed307 0x1 0x01
* write 0x1e1ed316 0x1 0x01
* write 0x1e1ed328 0x1 0x01
* write 0x1e1ed32f 0x1 0x01
* outl 0x1940 0x1e1ed300
* outl 0x19c0 0x00
* EOF
*/
static void null_deref_megasas_finish_dcmd(void)
{
QTestState *s = qtest_init(
"-display none , -m 512M -machine q35 -nodefaults -device megasas -device "
"scsi-cd,drive=null0 -blockdev driver=null-co,read-zeroes=on,node-name=null0 ");
qtest_outl(s, 0xcf8, 0x80000801);
qtest_outl(s, 0xcfc, 0x05000000);
qtest_outl(s, 0xcf8, 0x80000816);
qtest_outl(s, 0xcfc, 0x19000000);
qtest_bufwrite(s, 0x1e1ed300, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed307, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed316, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed328, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed32f, "\x01", 0x1);
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_outl(s, 0x19c0, 0x00);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_init(&argc, &argv, NULL);
if (strcmp(arch, "i386") == 0) {
qtest_add_func("fuzz/null_deref_megasas_finish_dcmd",
null_deref_megasas_finish_dcmd);
}
return g_test_run();
}
== Stack Trace ==
../hw/scsi/megasas.c:1884:21: runtime error: member access within null pointer of type 'union mfi_frame'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/scsi/megasas.c:1884:21 in
../hw/scsi/megasas.c:1884:21: runtime error: member access within null pointer of type 'struct mfi_frame_header'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/scsi/megasas.c:1884:21 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==314546==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x55b1b4f4de73 bp 0x7ffcfc5a8bb0 sp 0x7ffcfc5a8900 T0)
==314546==The signal is caused by a WRITE memory access.
==314546==Hint: address points to the zero page.
#0 0x55b1b4f4de73 in megasas_command_complete build/../hw/scsi/megasas.c:1884:40
#1 0x55b1b5613914 in scsi_req_complete build/../hw/scsi/scsi-bus.c:1515:5
#2 0x55b1b5448aeb in scsi_dma_complete_noio build/../hw/scsi/scsi-disk.c:345:9
#3 0x55b1b5446fc7 in scsi_dma_complete build/../hw/scsi/scsi-disk.c:366:5
#4 0x55b1b4fffc56 in dma_complete build/../softmmu/dma-helpers.c:121:9
#5 0x55b1b4fffc56 in dma_blk_cb build/../softmmu/dma-helpers.c:139:9
#6 0x55b1b6856016 in blk_aio_complete build/../block/block-backend.c:1412:9
#7 0x55b1b6f48b06 in aio_bh_poll build/../util/async.c:164:13
#8 0x55b1b6f08cec in aio_dispatch build/../util/aio-posix.c:381:5
#9 0x55b1b6f4d59c in aio_ctx_dispatch build/../util/async.c:306:5
#10 0x7fd88c098baa in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51baa)
#11 0x55b1b6f59a3c in glib_pollfds_poll build/../util/main-loop.c:232:9
#12 0x55b1b6f59a3c in os_host_main_loop_wait build/../util/main-loop.c:255:5
#13 0x55b1b6f59a3c in main_loop_wait build/../util/main-loop.c:531:11
#14 0x55b1b61a78a9 in qemu_main_loop build/../softmmu/runstate.c:725:9
#15 0x55b1b4c751e5 in main build/../softmmu/main.c:50:5
#16 0x7fd88aec6d09 in __libc_start_main csu/../csu/libc-start.c:308:16
#17 0x55b1b4bc8bb9 in _start (system-i386+0x2b5fbb9)
I posted a reproducer for a different bug. Here are the correct
reproducer and stacktrace:
/*
* Autogenerated Fuzzer Test Case
*/
#include "qemu/osdep.h"
#include "libqos/libqtest.h"
/*
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest \
* -m 512M -machine q35 -nodefaults -device megasas -device \
* scsi-cd,drive=null0 -blockdev \
* driver=null-co,read-zeroes=on,node-name=null0 -qtest stdio
* outl 0xcf8 0x80000801
* outl 0xcfc 0x05000000
* outl 0xcf8 0x80000816
* outl 0xcfc 0x19000000
* write 0x1e1ed300 0x1 0x01
* write 0x1e1ed307 0x1 0x01
* write 0x1e1ed316 0x1 0x01
* write 0x1e1ed328 0x1 0x01
* write 0x1e1ed32f 0x1 0x01
* outl 0x1940 0x1e1ed300
* outl 0x1940 0x1e1ed300
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* outb 0x1940 0x0
* write 0x0 0x1 0x01
* write 0x7 0x1 0x01
* write 0x16 0x1 0x01
* write 0x28 0x1 0x01
* write 0x2f 0x1 0x01
* outb 0x1940 0x0
* write 0x0 0x1 0x05
* write 0x7 0x1 0x01
* write 0x19 0x1 0x02
* write 0x1a 0x1 0x01
* write 0x1b 0x1 0x08
* write 0x2f 0x1 0x01
* outb 0x1940 0x0
* EOF
*/
static void
null_deref_megasas_finish_dcmd(void)
{
QTestState *s = qtest_init(
"-display none , -m 512M -machine q35 -nodefaults -device "
"megasas -device scsi-cd,drive=null0 -blockdev "
"driver=null-co,read-zeroes=on,node-name=null0 ");
qtest_outl(s, 0xcf8, 0x80000801);
qtest_outl(s, 0xcfc, 0x05000000);
qtest_outl(s, 0xcf8, 0x80000816);
qtest_outl(s, 0xcfc, 0x19000000);
qtest_bufwrite(s, 0x1e1ed300, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed307, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed316, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed328, "\x01", 0x1);
qtest_bufwrite(s, 0x1e1ed32f, "\x01", 0x1);
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_clock_step_next(s);
qtest_outb(s, 0x1940, 0x0);
qtest_bufwrite(s, 0x0, "\x01", 0x1);
qtest_bufwrite(s, 0x7, "\x01", 0x1);
qtest_bufwrite(s, 0x16, "\x01", 0x1);
qtest_bufwrite(s, 0x28, "\x01", 0x1);
qtest_bufwrite(s, 0x2f, "\x01", 0x1);
qtest_outb(s, 0x1940, 0x0);
qtest_bufwrite(s, 0x0, "\x05", 0x1);
qtest_bufwrite(s, 0x7, "\x01", 0x1);
qtest_bufwrite(s, 0x19, "\x02", 0x1);
qtest_bufwrite(s, 0x1a, "\x01", 0x1);
qtest_bufwrite(s, 0x1b, "\x08", 0x1);
qtest_bufwrite(s, 0x2f, "\x01", 0x1);
qtest_outb(s, 0x1940, 0x0);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_init(&argc, &argv, NULL);
if (strcmp(arch, "i386") == 0) {
qtest_add_func("fuzz/null_deref_megasas_finish_dcmd",
null_deref_megasas_finish_dcmd);
}
return g_test_run();
}
=== Stack Trace ===
../hw/scsi/megasas.c:726:25: runtime error: member access within null pointer of type 'union mfi_frame'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/scsi/megasas.c:726:25 in
../hw/scsi/megasas.c:726:25: runtime error: member access within null pointer of type 'struct mfi_dcmd_frame'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/scsi/megasas.c:726:25 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==966650==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000002c (pc 0x55abf56c7955 bp 0x7fff888f64d0 sp 0x7fff888f6400 T0)
==966650==The signal is caused by a WRITE memory access.
==966650==Hint: address points to the zero page.
#0 0x55abf56c7955 in megasas_finish_dcmd build/../hw/scsi/megasas.c
#1 0x55abf56b97c1 in megasas_handle_dcmd build/../hw/scsi/megasas.c:1601:9
#2 0x55abf56b97c1 in megasas_handle_frame build/../hw/scsi/megasas.c:1965:24
#3 0x55abf56b0e54 in megasas_mmio_write build/../hw/scsi/megasas.c:2129:9
#4 0x55abf6a867f6 in memory_region_write_accessor build/../softmmu/memory.c:491:5
#5 0x55abf6a86263 in access_with_adjusted_size build/../softmmu/memory.c:552:18
#6 0x55abf6a85ac0 in memory_region_dispatch_write build/../softmmu/memory.c
#7 0x55abf6696d86 in flatview_write_continue build/../softmmu/physmem.c:2776:23
#8 0x55abf668c74b in flatview_write build/../softmmu/physmem.c:2816:14
#9 0x55abf668c74b in address_space_write build/../softmmu/physmem.c:2908:18
#10 0x55abf67e6571 in cpu_outb build/../softmmu/ioport.c:60:5
#11 0x55abf6b68ec9 in qtest_process_command build/../softmmu/qtest.c:479:13
#12 0x55abf6b66d6f in qtest_process_inbuf build/../softmmu/qtest.c:797:9
#13 0x55abf6d4c65e in fd_chr_read build/../chardev/char-fd.c:68:9
#14 0x7f976e846aae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
#15 0x55abf76eba3c in glib_pollfds_poll build/../util/main-loop.c:232:9
#16 0x55abf76eba3c in os_host_main_loop_wait build/../util/main-loop.c:255:5
#17 0x55abf76eba3c in main_loop_wait build/../util/main-loop.c:531:11
#18 0x55abf69398a9 in qemu_main_loop build/../softmmu/runstate.c:725:9
#19 0x55abf54071e5 in main build/../softmmu/main.c:50:5
#20 0x7f976d674d09 in __libc_start_main csu/../csu/libc-start.c:308:16
#21 0x55abf535abb9 in _start (system-i386+0x2b5fbb9)
This is still reproducible with the current qemu git version (commit 7fe7fae8b48e3f9c647f)
I moved this report over to QEMU's new bug tracker on gitlab.com.
Please continue with the discussion here:
https://gitlab.com/qemu-project/qemu/-/issues/548
Thanks for moving it over! ... let's close this one here on Launchpad now.
|