QEMU

Heap-buffer-overflow in sdhci_write_dataport

Bug #1913919 reported by Alexander Bulekov on 2021-01-31

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	QEMU	Fix Released	Undecided	Unassigned

Bug Description

Reproducer:
cat << EOF | ./qemu-system-aarch64 -qtest stdio \
-machine raspi3b,accel=qtest -m 1G
write 0x3f30002c 0x1 0x25
write 0x3f300004 0x1 0x01
write 0x3f300006 0x1 0xc0
write 0x3f30000c 0x1 0x22
write 0x3f30000e 0x1 0x20
write 0x3f30000f 0x1 0x0
write 0x3f300000 0x1 0x48
write 0x3f300003 0x1 0x0
write 0x3f300005 0x1 0x14
write 0x3f300007 0x1 0x10
write 0x3f30000c 0x1 0x32
write 0x3f30000f 0x1 0x0
write 0x3f300001 0x1 0x00
write 0x3f300002 0x1 0x30
write 0x3f300003 0x1 0x3f
EOF

Stacktrace:
==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8
WRITE of size 1 at 0x619000017b80 thread T0
    #0 0x562988348718 in sdhci_write_dataport /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39
    #1 0x562988348718 in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13
    #2 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
    #3 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
    #4 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c
    #5 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
    #6 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
    #7 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
    #8 0x562988334d9c in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12
    #9 0x562988334d9c in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12
    #10 0x562988334d9c in dma_memory_write /home/alxndr/Development/qemu/include/sysemu/dma.h:163:12
    #11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13
    #12 0x56298834427f in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17
    #13 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
    #14 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
    #15 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c
    #16 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
    #17 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
    #18 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
    #19 0x56298904ad35 in qtest_process_command /home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9
    #20 0x562989043b97 in qtest_process_inbuf /home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9
    #21 0x562989894286 in fd_chr_read /home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9
    #22 0x7f535645baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
    #23 0x562989eef363 in glib_pollfds_poll /home/alxndr/Development/qemu/build/../util/main-loop.c:232:9
    #24 0x562989eef363 in os_host_main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:255:5
    #25 0x562989eef363 in main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:531:11
    #26 0x562988faa599 in qemu_main_loop /home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9
    #27 0x5629872371fd in main /home/alxndr/Development/qemu/build/../softmmu/main.c:50:5
    #28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
    #29 0x56298718abc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)

0x619000017b80 is located 0 bytes to the right of 1024-byte region [0x619000017780,0x619000017b80)
allocated by thread T0 here:
    #0 0x562987204db2 in calloc (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2)
    #1 0x7f5356461ae0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0)
    #2 0x56298834a187 in sdhci_sysbus_realize /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5
    #3 0x56298987fe77 in device_set_realized /home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13
    #4 0x5629898153b5 in property_set_bool /home/alxndr/Development/qemu/build/../qom/object.c:2255:5

Tags:

Revision history for this message

Thomas Huth (th-huth) wrote on 2021-06-10:

Can you still reproduce this issue with the latest git version of QEMU? ... for me, it does not crash anymore.

Changed in qemu:
status:	New → Incomplete

Revision history for this message

Alexander Bulekov (a1xndr) wrote on 2021-06-10: Re: [Bug 1913919] Re: Heap-buffer-overflow in sdhci_write_dataport

Download full text (5.4 KiB)

There were a few patches some months ago that fixed the sdhci issues,
and OSS-Fuzz said that all of the heap-overflows that it has seen in
sdhci have been fixed.
-Alex

There were a few patches some months ago that fixed the sdhci issues,
and OSS-Fuzz said that all of the heap-overflows that it has seen in
sdhci have been fixed.
-Alex

On 210610 1544, Thomas Huth wrote:
> Can you still reproduce this issue with the latest git version of QEMU?
> ... for me, it does not crash anymore.
> 
> ** Changed in: qemu
>        Status: New => Incomplete
> 
> -- 
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1913919
> 
> Title:
>   Heap-buffer-overflow in sdhci_write_dataport
> 
> Status in QEMU:
>   Incomplete
> 
> Bug description:
>   Reproducer:
>   cat << EOF | ./qemu-system-aarch64 -qtest stdio \
>   -machine raspi3b,accel=qtest -m 1G 
>   write 0x3f30002c 0x1 0x25
>   write 0x3f300004 0x1 0x01
>   write 0x3f300006 0x1 0xc0
>   write 0x3f30000c 0x1 0x22
>   write 0x3f30000e 0x1 0x20
>   write 0x3f30000f 0x1 0x0
>   write 0x3f300000 0x1 0x48
>   write 0x3f300003 0x1 0x0
>   write 0x3f300005 0x1 0x14
>   write 0x3f300007 0x1 0x10
>   write 0x3f30000c 0x1 0x32
>   write 0x3f30000f 0x1 0x0
>   write 0x3f300001 0x1 0x00
>   write 0x3f300002 0x1 0x30
>   write 0x3f300003 0x1 0x3f
>   EOF
> 
>   Stacktrace:
>   ==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8
>   WRITE of size 1 at 0x619000017b80 thread T0
>       #0 0x562988348718 in sdhci_write_dataport /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39
>       #1 0x562988348718 in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13
>       #2 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
>       #3 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
>       #4 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c
>       #5 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
>       #6 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
>       #7 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
>       #8 0x562988334d9c in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:88:12
>       #9 0x562988334d9c in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:127:12
>       #10 0x562988334d9c in dma_memory_write /home/alxndr/Development/qemu/include/sysemu/dma.h:163:12
>       #11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13
>       #12 0x56298834427f in sdhci_write /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17
>       #13 0x5629890591fe in memory_region_write_accessor /home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
>       #14 0x562989058bfb in access_with_adjusted_size /home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
>       #15 0x562989058467 in memory_region_dispatch_write /home/alxndr/Development/qemu/build/../softmmu/memory.c
>       #16 0x5629893e8ffb in flatview_write_continue /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
>       #17 0x5629893de71b in flatview_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
>       #18 0x5629893de71b in address_space_write /home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
>       #19 0x56298904ad35 in qtest_process_command /home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9
>       #20 0x562989043b97 in qtest_process_inbuf /home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9
>       #21 0x562989894286 in fd_chr_read /home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9
>       #22 0x7f535645baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
>       #23 0x562989eef363 in glib_pollfds_poll /home/alxndr/Development/qemu/build/../util/main-loop.c:232:9
>       #24 0x562989eef363 in os_host_main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:255:5
>       #25 0x562989eef363 in main_loop_wait /home/alxndr/Development/qemu/build/../util/main-loop.c:531:11
>       #26 0x562988faa599 in qemu_main_loop /home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9
>       #27 0x5629872371fd in main /home/alxndr/Development/qemu/build/../softmmu/main.c:50:5
>       #28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
>       #29 0x56298718abc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)
> 
>   0x619000017b80 is located 0 bytes to the right of 1024-byte region [0x619000017780,0x619000017b80)
>   allocated by thread T0 here:
>       #0 0x562987204db2 in calloc (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2)
>       #1 0x7f5356461ae0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0)
>       #2 0x56298834a187 in sdhci_sysbus_realize /home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5
>       #3 0x56298987fe77 in device_set_realized /home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13
>       #4 0x5629898153b5 in property_set_bool /home/alxndr/Development/qemu/build/../qom/object.c:2255:5
> 
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/qemu/+bug/1913919/+subscriptions

Revision history for this message

Thomas Huth (th-huth) wrote on 2021-06-10:

Ok, thanks for confirmation, then let's close this ticket here. If you encounter such a problem again, please open a new ticket in the new gitlab issue tracker.

Changed in qemu:
status:	Incomplete → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.