Null-pointer dereference in megasas_handle_frame
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Hello,
While fuzzing, I found an input that triggers a null-pointer dereference in megasas_
==1595==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55e3e83e6e08 bp 0x7ffdb04c63b0 sp 0x7ffd
==1595==The signal is caused by a READ memory access.
==1595==Hint: address points to the zero page.
#0 0x55e3e83e6e08 in megasas_
#1 0x55e3e83e6e08 in megasas_mmio_write /home/alxndr/
#2 0x55e3e7d088d6 in memory_
#3 0x55e3e7d0827f in access_
#4 0x55e3e7d0827f in memory_
#5 0x55e3e7c1d1d3 in flatview_
#6 0x55e3e7c15b97 in flatview_write /home/alxndr/
#7 0x55e3e7c15b97 in address_space_write /home/alxndr/
#8 0x55e3e7d03bc4 in qtest_process_
#9 0x55e3e7cfe74d in qtest_process_inbuf /home/alxndr/
#10 0x55e3e8804cad in fd_chr_read /home/alxndr/
#11 0x7f602ef2a897 in g_main_
#12 0x55e3e8948384 in glib_pollfds_poll /home/alxndr/
#13 0x55e3e8948384 in os_host_
#14 0x55e3e8948384 in main_loop_wait /home/alxndr/
#15 0x55e3e7f27676 in qemu_main_loop /home/alxndr/
#16 0x55e3e8851c6a in main /home/alxndr/
#17 0x7f602dadae0a in __libc_start_main /build/
#18 0x55e3e7b5c7b9 in _start (/home/
I can reproduce it in qemu 5.0 using:
cat << EOF | ~/Development/
outl 0xcf8 0x80001814
outl 0xcfc 0xc021
outl 0xcf8 0x80001818
outl 0xcf8 0x80001804
outw 0xcfc 0x7
outl 0xcf8 0x80001810
outl 0xcfc 0xe10c0000
outl 0xcf8 0x8000f810
outl 0xcf8 0x8000fa24
outl 0xcfc 0xe10c4000
outl 0xcf8 0x8000fa04
outw 0xcfc 0x7
outl 0xcf8 0x8000fb20
write 0xe10c4384 0x15 0x8383838383838
write 0xc021e10c00c0 0x4 0x082c04dd
EOF
I also attached the commands to this launchpad report, in case the formatting is broken:
qemu-system-i386 -qtest stdio -nographic -monitor none -serial none -M q35 -device megasas < attachment
Please let me know if I can provide any further info.
-Alex
Changed in qemu: | |
status: | Fix Committed → Fix Released |
Upstream patch /lists. gnu.org/ archive/ html/qemu- devel/2020- 05/msg07313. html
-> https:/