[OSS-Fuzz] Issue 31875 megasas: Null-ptr dereference in megasas_finish_dcmd
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Hello,
== QTest Reproducer ==
/*
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
* 512M -machine q35 -nodefaults -device megasas -device \
* scsi-cd,drive=null0 -blockdev \
* driver=
* outl 0xcf8 0x80000801
* outl 0xcfc 0x05000000
* outl 0xcf8 0x80000816
* outl 0xcfc 0x19000000
* write 0x1e1ed300 0x1 0x01
* write 0x1e1ed307 0x1 0x01
* write 0x1e1ed316 0x1 0x01
* write 0x1e1ed328 0x1 0x01
* write 0x1e1ed32f 0x1 0x01
* outl 0x1940 0x1e1ed300
* outl 0x19c0 0x00
* EOF
*/
static void null_deref_
{
QTestState *s = qtest_init(
"-display none , -m 512M -machine q35 -nodefaults -device megasas -device "
qtest_outl(s, 0xcf8, 0x80000801);
qtest_outl(s, 0xcfc, 0x05000000);
qtest_outl(s, 0xcf8, 0x80000816);
qtest_outl(s, 0xcfc, 0x19000000);
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_outl(s, 0x19c0, 0x00);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_
if (strcmp(arch, "i386") == 0) {
}
return g_test_run();
}
== Stack Trace ==
../hw/scsi/
SUMMARY: UndefinedBehavi
../hw/scsi/
SUMMARY: UndefinedBehavi
AddressSanitize
=======
==314546==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x55b1b4f4de73 bp 0x7ffcfc5a8bb0 sp 0x7ffcfc5a8900 T0)
==314546==The signal is caused by a WRITE memory access.
==314546==Hint: address points to the zero page.
#0 0x55b1b4f4de73 in megasas_
#1 0x55b1b5613914 in scsi_req_complete build/.
#2 0x55b1b5448aeb in scsi_dma_
#3 0x55b1b5446fc7 in scsi_dma_complete build/.
#4 0x55b1b4fffc56 in dma_complete build/.
#5 0x55b1b4fffc56 in dma_blk_cb build/.
#6 0x55b1b6856016 in blk_aio_complete build/.
#7 0x55b1b6f48b06 in aio_bh_poll build/.
#8 0x55b1b6f08cec in aio_dispatch build/.
#9 0x55b1b6f4d59c in aio_ctx_dispatch build/.
#10 0x7fd88c098baa in g_main_
#11 0x55b1b6f59a3c in glib_pollfds_poll build/.
#12 0x55b1b6f59a3c in os_host_
#13 0x55b1b6f59a3c in main_loop_wait build/.
#14 0x55b1b61a78a9 in qemu_main_loop build/.
#15 0x55b1b4c751e5 in main build/.
#16 0x7fd88aec6d09 in __libc_start_main csu/../
#17 0x55b1b4bc8bb9 in _start (system-
I posted a reproducer for a different bug. Here are the correct
reproducer and stacktrace:
/*
* Autogenerated Fuzzer Test Case
*/
#include "qemu/osdep.h"
#include "libqos/libqtest.h"
/* null-co, read-zeroes= on,node- name=null0 -qtest stdio megasas_ finish_ dcmd(void)
"driver= null-co, read-zeroes= on,node- name=null0 "); bufwrite( s, 0x1e1ed300, "\x01", 0x1); bufwrite( s, 0x1e1ed307, "\x01", 0x1); bufwrite( s, 0x1e1ed316, "\x01", 0x1); bufwrite( s, 0x1e1ed328, "\x01", 0x1); bufwrite( s, 0x1e1ed32f, "\x01", 0x1); clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ next(s) ; clock_step_ nex...
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest \
* -m 512M -machine q35 -nodefaults -device megasas -device \
* scsi-cd,drive=null0 -blockdev \
* driver=
* outl 0xcf8 0x80000801
* outl 0xcfc 0x05000000
* outl 0xcf8 0x80000816
* outl 0xcfc 0x19000000
* write 0x1e1ed300 0x1 0x01
* write 0x1e1ed307 0x1 0x01
* write 0x1e1ed316 0x1 0x01
* write 0x1e1ed328 0x1 0x01
* write 0x1e1ed32f 0x1 0x01
* outl 0x1940 0x1e1ed300
* outl 0x1940 0x1e1ed300
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* clock_step
* outb 0x1940 0x0
* write 0x0 0x1 0x01
* write 0x7 0x1 0x01
* write 0x16 0x1 0x01
* write 0x28 0x1 0x01
* write 0x2f 0x1 0x01
* outb 0x1940 0x0
* write 0x0 0x1 0x05
* write 0x7 0x1 0x01
* write 0x19 0x1 0x02
* write 0x1a 0x1 0x01
* write 0x1b 0x1 0x08
* write 0x2f 0x1 0x01
* outb 0x1940 0x0
* EOF
*/
static void
null_deref_
{
QTestState *s = qtest_init(
"-display none , -m 512M -machine q35 -nodefaults -device "
"megasas -device scsi-cd,drive=null0 -blockdev "
qtest_outl(s, 0xcf8, 0x80000801);
qtest_outl(s, 0xcfc, 0x05000000);
qtest_outl(s, 0xcf8, 0x80000816);
qtest_outl(s, 0xcfc, 0x19000000);
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_outl(s, 0x1940, 0x1e1ed300);
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_
qtest_