Re: [Qemu-devel] [PATCH] fw_cfg_mem: add read memory region callback

[Li Qiang]

Hi Laszlo,

Laszlo Ersek <address@hidden> 于2018年9月12日周三 下午6:36写道：

> On 09/12/18 10:02, Li Qiang wrote:
> > Hi,
> >
> > Marc-André Lureau <address@hidden> 于2018年9月12日周三 下午3:16写道：
> >
> >> Hi
> >>
> >> On Wed, Sep 12, 2018 at 9:22 AM Li Qiang <address@hidden> wrote:
> >>>
> >>> The write/read should be paired, this can avoid the
> >>> NULL-deref while the guest reads the fw_cfg port.
> >>>
> >>> Signed-off-by: Li Qiang <address@hidden>
> >>
> >> Do you have a reproducer and/or a backtrace?
> >> memory_region_dispatch_write() checks if ops->write != NULL.
> >>
> >
> > As far as I can see, the fw_cfg_mem is not used in x86 and used in arm.
> > And from my impression, this will NULL read will be a issue. So I just
> > omit the 'read' field in fw_cfg_comb_mem_ops(this is used for x86) to
> > emulate the
> > issue.
> >
> > When using gdb, I got the following backtrack.
> >
> > Thread 5 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
> > [Switching to Thread 0x7fffca15b700 (LWP 7637)]
> > 0x0000000000000000 in ?? ()
> > (gdb) bt
> > #0  0x0000000000000000 in ?? ()
> > #1  0x0000555555872492 in memory_region_oldmmio_read_accessor
> > (mr=0x5555567fa870, addr=1, value=0x7fffca158510, size=1, shift=0,
> > mask=255, attrs=...) at /home/liqiang02/qemu-devel/qemu/memory.c:409
> > #2  0x000055555586f2dd in access_with_adjusted_size (address@hidden,
> > address@hidden, address@hidden,
> > access_size_min=<optimized out>, access_size_max=<optimized out>,
> >     access_fn=0x555555872440 <memory_region_oldmmio_read_accessor>,
> > mr=0x5555567fa870, attrs=...) at
> > /home/liqiang02/qemu-devel/qemu/memory.c:593
> > #3  0x0000555555873e90 in memory_region_dispatch_read1 (attrs=...,
> size=1,
> > pval=0x7fffca158510, addr=1, mr=0x5555567fa870) at
> > /home/liqiang02/qemu-devel/qemu/memory.c:1404
> > #4  memory_region_dispatch_read (address@hidden, addr=1,
> > address@hidden, size=1, address@hidden) at
> > /home/liqiang02/qemu-devel/qemu/memory.c:1423
> > #5  0x0000555555821e42 in flatview_read_continue (address@hidden
> =0x7fffbc03f370,
> > address@hidden, attrs=..., buf=<optimized out>, address@hidden
> =0x7ffff7fee000
> > "", address@hidden, addr1=<optimized out>, l=<optimized out>,
> > mr=0x5555567fa870)
> >     at /home/liqiang02/qemu-devel/qemu/exec.c:3293
> > #6  0x0000555555822006 in flatview_read (fv=0x7fffbc03f370, addr=1297,
> > attrs=..., buf=0x7ffff7fee000 "", len=1) at
> > /home/liqiang02/qemu-devel/qemu/exec.c:3331
> > #7  0x000055555582211f in address_space_read_full (as=<optimized out>,
> > address@hidden, attrs=..., address@hidden "",
> > address@hidden) at /home/liqiang02/qemu-devel/qemu/exec.c:3344
> > #8  0x000055555582225a in address_space_rw (as=<optimized out>,
> > address@hidden, attrs=..., address@hidden, address@hidden
> =0x7ffff7fee000
> > "", address@hidden, address@hidden)
> >     at /home/liqiang02/qemu-devel/qemu/exec.c:3374
> > #9  0x0000555555886239 in kvm_handle_io (count=1, size=1,
> > direction=<optimized out>, data=<optimized out>, attrs=..., port=1297) at
> > /home/liqiang02/qemu-devel/qemu/accel/kvm/kvm-all.c:1731
> > #10 kvm_cpu_exec (address@hidden) at
> > /home/liqiang02/qemu-devel/qemu/accel/kvm/kvm-all.c:1971
> > #11 0x000055555585d3de in qemu_kvm_cpu_thread_fn (arg=0x5555566e9990) at
> > /home/liqiang02/qemu-devel/qemu/cpus.c:1257
> > #12 0x00007fffdbd58494 in start_thread () from
> > /lib/x86_64-linux-gnu/libpthread.so.0
> > #13 0x00007fffdba9aacf in clone () from /lib/x86_64-linux-gnu/libc.so.6
> >
> > So I send out this path.
> >
> > But this time when I not use gdb, there is no segmentation.
> >
> > So this may not a issue.
> >
> > If who has a arm environment, he can try this, the PoC is just easy. just
> > read the 0x510 port with word.
>
> I don't understand your description of how you managed to trigger this
> SIGSEGV.
>
> FWIW, looking at the codebase, there's a good number of static
> MemoryRegionOps structures for which the "read_with_attrs" and "read"
> members are default-initialized to NULL. It seems unlikely they are all
> wrong.
>
>
I uses the debugexit.

QEMU command: gdb --args qemu-system-x86_64  -m 2048 -hda
/home/liqiang02/ubuntu1801.img -enable-kvm  -vnc :100 -device isa-debug-exit

guest: inw(0x501)

We can get the following backtrack.

Starting program: /usr/local/bin/qemu-system-x86_64 -m 2048 -hda
/home/liqiang02/ubuntu1801.img -enable-kvm -vnc :100 -device isa-debug-exit
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffcde12700 (LWP 52824)]
[New Thread 0x7fffcd41f700 (LWP 52825)]
WARNING: Image format was not specified for
'/home/liqiang02/ubuntu1801.img' and probing guessed raw.
         Automatically detecting the format is dangerous for raw images,
write operations on block 0 will be restricted.
         Specify the 'raw' format explicitly to remove the restrictions.
[New Thread 0x7fffcca3c700 (LWP 52826)]
[New Thread 0x7fff463ff700 (LWP 52828)]
[Thread 0x7fffcd41f700 (LWP 52825) exited]
[New Thread 0x7fffcd41f700 (LWP 52857)]
[Thread 0x7fffcd41f700 (LWP 52857) exited]
[New Thread 0x7fffcd41f700 (LWP 52935)]

Thread 4 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffcca3c700 (LWP 52826)]
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00005555557c1f81 in memory_region_oldmmio_read_accessor
(mr=0x5555577b32b0, addr=0, value=0x7fffcca39568, size=2, shift=0,
mask=65535, attrs=...) at /home/liqiang02/qemu_max_cpu/qemu-2.8/memory.c:409
#2  0x00005555557c2697 in access_with_adjusted_size (addr=0,
value=0x7fffcca39568, size=2, access_size_min=1, access_size_max=4,
access=0x5555557c1f31 <memory_region_oldmmio_read_accessor>,
mr=0x5555577b32b0, attrs=...)
    at /home/liqiang02/qemu_max_cpu/qemu-2.8/memory.c:592
#3  0x00005555557c4aa2 in memory_region_dispatch_read1 (mr=0x5555577b32b0,
addr=0, pval=0x7fffcca39568, size=2, attrs=...) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/memory.c:1254
#4  0x00005555557c4b26 in memory_region_dispatch_read (mr=0x5555577b32b0,
addr=0, pval=0x7fffcca39568, size=2, attrs=...) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/memory.c:1273
#5  0x00005555557708ba in address_space_read_continue (as=0x5555562cc760
<address_space_io>, addr=1281, attrs=..., buf=0x7ffff7fee000 "", len=2,
addr1=0, l=2, mr=0x5555577b32b0) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/exec.c:2692
#6  0x0000555555770a53 in address_space_read_full (as=0x5555562cc760
<address_space_io>, addr=1281, attrs=..., buf=0x7ffff7fee000 "", len=2) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/exec.c:2743
#7  0x0000555555770b15 in address_space_read (len=2, buf=0x7ffff7fee000 "",
attrs=..., addr=1281, as=0x5555562cc760 <address_space_io>) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/include/exec/memory.h:1527
#8  address_space_rw (as=0x5555562cc760 <address_space_io>, addr=1281,
attrs=..., buf=0x7ffff7fee000 "", len=2, is_write=false) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/exec.c:2757
#9  0x00005555557bea59 in kvm_handle_io (port=1281, attrs=...,
data=0x7ffff7fee000, direction=0, size=2, count=1) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/kvm-all.c:1800
#10 0x00005555557bef5f in kvm_cpu_exec (cpu=0x5555568279c0) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/kvm-all.c:1958
#11 0x00005555557a5d5f in qemu_kvm_cpu_thread_fn (arg=0x5555568279c0) at
/home/liqiang02/qemu_max_cpu/qemu-2.8/cpus.c:998
#12 0x00007fffdbf89494 in start_thread () from
/lib/x86_64-linux-gnu/libpthread.so.0
#13 0x00007fffdbccbacf in clone () from /lib/x86_64-linux-gnu/libc.so.6
(gdb)

Seems the root cause is in 'memory_region_oldmmio_read_accessor '.
Anyway I have sent out another patch to address issue.

Thanks,
Li Qiang



> - exec.c:                    notdirty_mem_ops, readonly_mem_ops
> - hw/misc/debugexit.c:       debug_exit_ops
> - hw/misc/hyperv_testdev.c:  synic_test_sint_ops
> - hw/misc/pc-testdev.c:      test_irq_ops, test_flush_ops
> - hw/pci-host/designware.c:  designware_pci_host_msi_ops
> - hw/rdma/vmw/pvrdma_main.c: uar_ops
> - hw/sparc64/sun4u.c:        power_mem_ops
>
> Laszlo
>