assertion failure in mptsas1068 emulator
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Expired
|
Undecided
|
Unassigned |
Bug Description
Using hypervisor fuzzer, hyfuzz, I found an assertion failure through mptsas1068 emulator.
A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service.
This was found in version 5.2.0 (master)
qemu-system-i386: ../hw/scsi/
`s->intr_status & MPI_HIS_
[1] 16951 abort (core dumped) /home/cwmyung/
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=0x6) at ../sysdeps/
51 ../sysdeps/
[Current thread is 1 (Thread 0x7fc7d6023700 (LWP 23475))]
gdb-peda$ bt
#0 0x00007fc7efa13f47 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/
#1 0x00007fc7efa158b1 in __GI_abort () at abort.c:79
#2 0x00007fc7efa0542a in __assert_fail_base (fmt=0x7fc7efb8ca38 "%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n", assertion=
#3 0x00007fc7efa054a2 in __GI___assert_fail (assertion=
#4 0x0000564391a43963 in mptsas_
#5 0x0000564391a43963 in mptsas_mmio_write (opaque=
#6 0x0000564391e08798 in memory_
at ../softmmu/
#7 0x0000564391e0858e in access_
#8 0x0000564391e0858e in memory_
#9 0x0000564391eff228 in io_writex (iotlbentry=
at ../accel/
#10 0x0000564391eff228 in store_helper (env=<optimized out>, addr=<optimized out>, val=<optimized out>, oi=<optimized out>, retaddr=<optimized out>, op=MO_32) at ../accel/
#11 0x0000564391eff228 in helper_le_stl_mmu (env=<optimized out>, addr=<optimized out>, val=0x2, oi=<optimized out>, retaddr=
#12 0x00007fc78841b401 in code_gen_buffer ()
#13 0x0000564391dd0da0 in cpu_tb_exec (cpu=0x56439363
#14 0x0000564391dd19eb in cpu_loop_exec_tb (tb=<optimized out>, cpu=<optimized out>, last_tb=<optimized out>, tb_exit=<optimized out>) at ../accel/
#15 0x0000564391dd19eb in cpu_exec (cpu=0x56439363
#16 0x0000564391e00b9f in tcg_cpu_exec (cpu=<optimized out>) at ../accel/
#17 0x0000564391e00b9f in tcg_cpu_thread_fn (arg=0x56439363
#18 0x00005643920d8775 in qemu_thread_start (args=<optimized out>) at ../util/
#19 0x00007fc7efdcd6db in start_thread (arg=0x7fc7d602
To reproduce this issue, please run the QEMU with the following command line.
# To enable ASan option, please set configuration with the following command
$ ./configure --target-
$ make
# To reproduce this issue, please run the QEMU process with the following command line.
$ ./qemu-system-i386 -m 512 -drive file=./
Please let me know if I can provide any further info.
Thank you.
- Cheolwoo, Myung (Seoul National University)
tags: | added: fuzzer |
This still triggers with the current version from git master, marking as Confirmed