On 210525 0820, Thomas Huth wrote:
> Can you still reproduce the crash with the current version of QEMU? At
> least I cannot reproduce the crash anymore, so it seems like this got
> fixed at one point in time?
>
> ** Changed in: qemu
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1878034
>
> Title:
> memcpy param-overlap through e1000e_write_to_rx_buffers
>
> Status in QEMU:
> Incomplete
>
> Bug description:
> Hello,
> While fuzzing, I found an input that triggers an overlapping memcpy (caught by AddressSanitizer).
> Overlapping memcpys are undefined behavior according to the POSIX and C standards, and can lead to bugs.
>
> ==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges
> #0 0x563c9f4823d4 in __asan_memcpy (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4)
> #1 0x563c9f4cb2b1 in flatview_write_continue /home/alxndr/Development/qemu/exec.c:3142:13
> #2 0x563c9f4c3b97 in flatview_write /home/alxndr/Development/qemu/exec.c:3177:14
> #3 0x563c9f4c3b97 in address_space_write /home/alxndr/Development/qemu/exec.c:3268:18
> #4 0x563c9fbc457b in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:87:18
> #5 0x563c9fbc457b in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:110:12
> #6 0x563c9fbc457b in pci_dma_rw /home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5
> #7 0x563c9fbc457b in pci_dma_write /home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12
> #8 0x563c9fbc457b in e1000e_write_to_rx_buffers /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9
> #9 0x563c9fbb9c98 in e1000e_write_packet_to_guest /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21
> #10 0x563c9fbb9c98 in e1000e_receive_iov /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9
> #11 0x563c9fba8080 in net_tx_pkt_sendv /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9
> #12 0x563c9fba8080 in net_tx_pkt_send /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9
> #13 0x563c9fba8827 in net_tx_pkt_send_loopback /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11
> #14 0x563c9fbd2052 in e1000e_tx_pkt_send /home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16
> #15 0x563c9fbd2052 in e1000e_process_tx_desc /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17
> #16 0x563c9fbd2052 in e1000e_start_xmit /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9
> #17 0x563c9fbcecf0 in e1000e_set_tdt /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9
> #18 0x563c9fbbf20c in e1000e_core_write /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9
> #19 0x563c9f5b68d6 in memory_region_write_accessor /home/alxndr/Development/qemu/memory.c:483:5
> #20 0x563c9f5b627f in access_with_adjusted_size /home/alxndr/Development/qemu/memory.c:544:18
> #21 0x563c9f5b627f in memory_region_dispatch_write /home/alxndr/Development/qemu/memory.c:1476:16
>
> I can reproduce it in qemu 5.0 built with --enable-sanitizers using:
> cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none
> outl 0xcf8 0x80001010
> outl 0xcfc 0xe1020000
> outl 0xcf8 0x80001014
> outl 0xcf8 0x80001004
> outw 0xcfc 0x7
> outl 0xcf8 0x800010a2
> write 0xe102003a 0x3ff 0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63
> EOF
>
> I also attached the trace to this launchpad report, in case the
> formatting is broken:
>
> qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic
> -monitor none -serial none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions
Seems to still be a problem. Here's the reproducer found by OSS-Fuzz: /bugs.chromium. org/p/oss- fuzz/issues/ detail? id=29586
https:/
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
512M -M q35 -nodefaults -device e1000e,netdev=net0 -netdev user,id=net0 \
-qtest /dev/null -qtest stdio
outl 0xcf8 0x80000811
outl 0xcfc 0x5ac600
outl 0xcf8 0x80000801
outl 0xcfc 0x06000000
write 0x5ac60100 0x4 0x56000302
write 0x5ac6011a 0x2 0x0106
write 0x5ac60120 0x1 0x25
write 0x5ac6042a 0x2 0x0248
write 0x5ac60431 0x1 0x04
write 0x4240 0x1 0xff
write 0x4241 0x1 0x01
write 0x4249 0x1 0xf5
write 0x1ff 0x1 0x01
write 0x5ac60403 0x1 0x02
write 0x5ac6043a 0x2 0x2800
write 0x5ac60112 0x2 0xf090
write 0x5ac60430 0x1 0x00
write 0x239 0x1 0xff
write 0x23b 0x1 0x01
write 0x9531 0x1 0xff
write 0x9532 0x1 0xff
write 0x9533 0x1 0xff
write 0x9534 0x1 0xff
write 0x9535 0x1 0xff
write 0x9536 0x1 0xff
write 0x9537 0x1 0xff
write 0x5ac60403 0x1 0x02
EOF
On 210525 0820, Thomas Huth wrote: /bugs.launchpad .net/bugs/ 1878034 write_to_ rx_buffers param-overlap: memory ranges alxndr/ Development/ qemu/build/ i386-softmmu/ qemu-system- i386+0x97a3d4) write_continue /home/alxndr/ Development/ qemu/exec. c:3142: 13 Development/ qemu/exec. c:3177: 14 Development/ qemu/exec. c:3268: 18 rw_relaxed /home/alxndr/ Development/ qemu/include/ sysemu/ dma.h:87: 18 Development/ qemu/include/ sysemu/ dma.h:110: 12 Development/ qemu/include/ hw/pci/ pci.h:787: 5 Development/ qemu/include/ hw/pci/ pci.h:800: 12 write_to_ rx_buffers /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 1412:9 write_packet_ to_guest /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 1582:21 Development/ qemu/hw/ net/e1000e_ core.c: 1709:9 Development/ qemu/hw/ net/net_ tx_pkt. c:544:9 Development/ qemu/hw/ net/net_ tx_pkt. c:620:9 pkt_send_ loopback /home/alxndr/ Development/ qemu/hw/ net/net_ tx_pkt. c:633:11 Development/ qemu/hw/ net/e1000e_ core.c: 664:16 process_ tx_desc /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 743:17 Development/ qemu/hw/ net/e1000e_ core.c: 934:9 Development/ qemu/hw/ net/e1000e_ core.c: 2451:9 Development/ qemu/hw/ net/e1000e_ core.c: 3261:9 region_ write_accessor /home/alxndr/ Development/ qemu/memory. c:483:5 with_adjusted_ size /home/alxndr/ Development/ qemu/memory. c:544:18 region_ dispatch_ write /home/alxndr/ Development/ qemu/memory. c:1476: 16 qemu/build/ i386-softmmu/ qemu-system- i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none 2e10000000001ff d3055e2d3b0002e 10000000001ffd5 055e2d3b0002e10 000000001ffd705 5e2d3b0002e1000 0000001ffd9055e 2d3b0002e100000 00001ffdb055e2d 3b0002e10000000 001ffdd055e2d3b 0002e1000000000 1ffdf055e2d3b00 02e10000000001f fe1055e2d3b0002 e10000000001ffe 3055e2d3b0002e1 0000000001ffe50 55e2d3b0002e100 00000001ffe7055 e2d3b0002e10000 000001ffe9055e2 d3b0002e1000000 0001ffeb055e2d3 b0002e100000000 01ffed055e2d3b0 002e10000000001 ffef055e2d3b000 2e10000000001ff f1055e2d3b0002e 10000000001fff3 055e2d3b0002e10 000000001fff505 5e2d3b0002e1000 0000001fff7055e 2d3b0002e100000 00001fff9055e2d 3b0002e10000000 001fffb055e2d3b 0002e1000000000 1fffd055e2d3b00 02e10000000001f fff055e2d3b0002 e10000000001ff0 1055e2d3b0002e1 0000000001ff030 55e2d3b0002e100 00000001ff05055 e2d3b0002e10000 000001ff07055e2 d3b0002e1000000 0001ff09055e2d3 b0002e100000000 01ff0b055e2d3b0 002e10000000001 ff0d055e2d3b000 2e10000000001ff 0f055e2d3b0002e 10000000001ff11 055e2d3b0002e10 000000001ff1305 5e2d3b0002e1000 0000001ff15055e 2d3b0002e100000 00001ff17055e2d 3b0002e10000000 001ff19055e2d3b 0002e1000000000 1ff1b055e2d3b00 02e10000000001f f1d055e2d3b0002 e10000000001ff1 f055e2d3b0002e1 0000000001ff210 55e2d3b0002e100 00000001ff23055 e2d3b0002e10000 000001ff25055e2 d3b0002e1000000 0001ff27055e2d3 b0002e100000000 01ff29055e2d3b0 002e10000000001 ff2b055e2d3b000 2e10000000001ff 2d055e2d3b0002e 10000000001ff2f 055e2d3b0002e10 000000001ff3105 5e2d3b0002e1000 0000001ff33055e 2d3b0002e100000 00001ff35055e2d 3b0002e10000000 001ff37055e2d3b 0002e1000000000 1ff39055e2d3b00 02e10000000001f f3b055e2d3b0002 e10000000001ff3 d055e2d3b0002e1 0000000001ff3f0 55e2d3b0002e100 00000001ff41055 e2d3b0002e10000 000001ff43055e2 d3b0002e1000000 0001ff45055e2d3 b0002e100000000 01ff47055e2d3b0 002e10000000001 ff49055e2d3b000 2e10000000001ff 4b055e2d3b0002e 10000000001ff4d 055e2d3b0002e10 000000001ff4f05 5e2d3b0002e1000 0000001ff51055e 2d3b0002e100000 00001ff53055e2d 3b0002e10000000 001ff55055e2d3b 0002e1000000000 1ff57055e2d3b00 02e10000000001f f59055e2d3b0002 e10000000001ff5 b055e2d3b0002e1 0000000001ff5d0 55e2d3b0002e100 00000001ff5f055 e2d3b0002e10000 000001ff61055e2 d3b0002e1000000 0001ff63 /bugs.launchpad .net/qemu/ +bug/1878034/ +subscriptions
> Can you still reproduce the crash with the current version of QEMU? At
> least I cannot reproduce the crash anymore, so it seems like this got
> fixed at one point in time?
>
> ** Changed in: qemu
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> memcpy param-overlap through e1000e_
>
> Status in QEMU:
> Incomplete
>
> Bug description:
> Hello,
> While fuzzing, I found an input that triggers an overlapping memcpy (caught by AddressSanitizer).
> Overlapping memcpys are undefined behavior according to the POSIX and C standards, and can lead to bugs.
>
> ==22287==ERROR: AddressSanitizer: memcpy-
> #0 0x563c9f4823d4 in __asan_memcpy (/home/
> #1 0x563c9f4cb2b1 in flatview_
> #2 0x563c9f4c3b97 in flatview_write /home/alxndr/
> #3 0x563c9f4c3b97 in address_space_write /home/alxndr/
> #4 0x563c9fbc457b in dma_memory_
> #5 0x563c9fbc457b in dma_memory_rw /home/alxndr/
> #6 0x563c9fbc457b in pci_dma_rw /home/alxndr/
> #7 0x563c9fbc457b in pci_dma_write /home/alxndr/
> #8 0x563c9fbc457b in e1000e_
> #9 0x563c9fbb9c98 in e1000e_
> #10 0x563c9fbb9c98 in e1000e_receive_iov /home/alxndr/
> #11 0x563c9fba8080 in net_tx_pkt_sendv /home/alxndr/
> #12 0x563c9fba8080 in net_tx_pkt_send /home/alxndr/
> #13 0x563c9fba8827 in net_tx_
> #14 0x563c9fbd2052 in e1000e_tx_pkt_send /home/alxndr/
> #15 0x563c9fbd2052 in e1000e_
> #16 0x563c9fbd2052 in e1000e_start_xmit /home/alxndr/
> #17 0x563c9fbcecf0 in e1000e_set_tdt /home/alxndr/
> #18 0x563c9fbbf20c in e1000e_core_write /home/alxndr/
> #19 0x563c9f5b68d6 in memory_
> #20 0x563c9f5b627f in access_
> #21 0x563c9f5b627f in memory_
>
> I can reproduce it in qemu 5.0 built with --enable-sanitizers using:
> cat << EOF | ~/Development/
> outl 0xcf8 0x80001010
> outl 0xcfc 0xe1020000
> outl 0xcf8 0x80001014
> outl 0xcf8 0x80001004
> outw 0xcfc 0x7
> outl 0xcf8 0x800010a2
> write 0xe102003a 0x3ff 0xd1055e2d3b000
> EOF
>
> I also attached the trace to this launchpad report, in case the
> formatting is broken:
>
> qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic
> -monitor none -serial none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> To manage notifications about this bug go to:
> https:/