qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Bug 1878034] Re: memcpy param-overlap through e1000e_write_to_rx_buffer


From: Thomas Huth
Subject: [Bug 1878034] Re: memcpy param-overlap through e1000e_write_to_rx_buffers
Date: Sat, 21 Aug 2021 06:11:29 -0000

Thanks for moving it over! ... let's close this one here on Launchpad
now.

** Changed in: qemu
       Status: Confirmed => Invalid

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878034

Title:
  memcpy param-overlap through e1000e_write_to_rx_buffers

Status in QEMU:
  Invalid

Bug description:
  Hello,
  While fuzzing, I found an input that triggers an overlapping memcpy (caught 
by AddressSanitizer).
  Overlapping memcpys are undefined behavior according to the POSIX and C 
standards, and can lead to bugs.

  ==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges
  #0 0x563c9f4823d4 in __asan_memcpy 
(/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4)
  #1 0x563c9f4cb2b1 in flatview_write_continue 
/home/alxndr/Development/qemu/exec.c:3142:13
  #2 0x563c9f4c3b97 in flatview_write 
/home/alxndr/Development/qemu/exec.c:3177:14
  #3 0x563c9f4c3b97 in address_space_write 
/home/alxndr/Development/qemu/exec.c:3268:18
  #4 0x563c9fbc457b in dma_memory_rw_relaxed 
/home/alxndr/Development/qemu/include/sysemu/dma.h:87:18
  #5 0x563c9fbc457b in dma_memory_rw 
/home/alxndr/Development/qemu/include/sysemu/dma.h:110:12
  #6 0x563c9fbc457b in pci_dma_rw 
/home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5
  #7 0x563c9fbc457b in pci_dma_write 
/home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12
  #8 0x563c9fbc457b in e1000e_write_to_rx_buffers 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9
  #9 0x563c9fbb9c98 in e1000e_write_packet_to_guest 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21
  #10 0x563c9fbb9c98 in e1000e_receive_iov 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9
  #11 0x563c9fba8080 in net_tx_pkt_sendv 
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9
  #12 0x563c9fba8080 in net_tx_pkt_send 
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9
  #13 0x563c9fba8827 in net_tx_pkt_send_loopback 
/home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11
  #14 0x563c9fbd2052 in e1000e_tx_pkt_send 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16
  #15 0x563c9fbd2052 in e1000e_process_tx_desc 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17
  #16 0x563c9fbd2052 in e1000e_start_xmit 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9
  #17 0x563c9fbcecf0 in e1000e_set_tdt 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9
  #18 0x563c9fbbf20c in e1000e_core_write 
/home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9
  #19 0x563c9f5b68d6 in memory_region_write_accessor 
/home/alxndr/Development/qemu/memory.c:483:5
  #20 0x563c9f5b627f in access_with_adjusted_size 
/home/alxndr/Development/qemu/memory.c:544:18
  #21 0x563c9f5b627f in memory_region_dispatch_write 
/home/alxndr/Development/qemu/memory.c:1476:16

  I can reproduce it in qemu 5.0 built with --enable-sanitizers using:
  cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M 
pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001014
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  outl 0xcf8 0x800010a2
  write 0xe102003a 0x3ff 
0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63
  EOF

  I also attached the trace to this launchpad report, in case the
  formatting is broken:

  qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic
  -monitor none -serial none < attachment

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions




reply via email to

[Prev in Thread] Current Thread [Next in Thread]