null-ptr dereference in megasas_command_complete
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Hello,
While fuzzing, I found an input that triggers a null-pointer dereference in
megasas_
==14959==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x55b1d11b4df1 bp 0x7ffeb55ca450 sp 0x7ffeb55ca1e0 T0)
==14959==The signal is caused by a WRITE memory access.
==14959==Hint: address points to the zero page.
#0 0x55b1d11b4df1 in megasas_
#1 0x55b1d11759ec in scsi_req_complete /home/alxndr/
#2 0x55b1d115c98f in scsi_aio_complete /home/alxndr/
#3 0x55b1d151c638 in blk_aio_complete /home/alxndr/
#4 0x55b1d151c638 in blk_aio_complete_bh /home/alxndr/
#5 0x55b1d16f3a5b in aio_bh_call /home/alxndr/
#6 0x55b1d16f3a5b in aio_bh_poll /home/alxndr/
#7 0x55b1d16fe43e in aio_dispatch /home/alxndr/
#8 0x55b1d16f54fa in aio_ctx_dispatch /home/alxndr/
#9 0x7f47937c89ed in g_main_
#10 0x55b1d16fbef4 in glib_pollfds_poll /home/alxndr/
#11 0x55b1d16fbef4 in os_host_
#12 0x55b1d16fbef4 in main_loop_wait /home/alxndr/
#13 0x55b1d0cd16a6 in qemu_main_loop /home/alxndr/
#14 0x55b1d1608dca in main /home/alxndr/
#15 0x7f4792378e0a in __libc_start_main /build/
#16 0x55b1d091d7b9 in _start (/home/
I can reproduce it in qemu 5.0 built with using:
cat << EOF | ~/Development/
outl 0xcf8 0x80001814
outl 0xcfc 0xc021
outl 0xcf8 0x80001818
outl 0xcf8 0x80001804
outw 0xcfc 0x7
outl 0xcf8 0x80001810
outl 0xcfc 0xe10c0000
outl 0xcf8 0x8000f810
write 0x44b20 0x1 0x35
write 0x44b00 0x1 0x03
write 0xc021e10c0040 0x81 0x014b040001310
EOF
I also attached the trace to this launchpad report, in case the formatting is broken:
qemu-system-i386 -qtest stdio -monitor none -serial none -M pc-q35-5.0 -no-shutdown -M q35 -device megasas -device scsi-cd,drive=null0 -blockdev driver=
Please let me know if I can provide any further info.
-Alex
Changed in qemu: | |
status: | Incomplete → Confirmed |
Might be relevant:
commit 6df5718bd3ec562 25c44cf96440c72 3c1b611b87
Author: Hannes Reinecke <email address hidden>
Date: Wed Oct 29 13:00:15 2014 +0100
megasas: Rework frame queueing algorithm
Windows requires the frames to be unmapped, otherwise we run
into a race condition where the updated frame data is not
visible to the guest.
With that we can simplify the queue algorithm and use a bitmap
for tracking free frames.
/* enqueue_ frame(MegasasSt ate *s,
* This absolutely needs to be locked if
* qemu ever goes multithreaded.
*/
static MegasasCmd *megasas_
hwaddr frame, uint64_t context, int count)
Using -trace scsi\* -trace megasas\*:
megasas_qf_enqueue frame 0x0 count 0 context 0x0 head 0x0 tail 0x0 busy 1 new_request Command: lun=0 tag=0x0 data= 0x35 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 mmio_invalid_ writel addr 0x44: 0x3101 mmio_invalid_ writel addr 0x48: 0x44b0100 mmio_invalid_ writel addr 0x4c: 0x380100 mmio_invalid_ writel addr 0x50: 0x4b010000 mmio_invalid_ writel addr 0x54: 0x3f010004 mmio_invalid_ writel addr 0x58: 0x1000000 mmio_invalid_ writel addr 0x5c: 0x100044b mmio_invalid_ writel addr 0x60: 0x46 mmio_invalid_ writel addr 0x64: 0x44b01 mmio_invalid_ writel addr 0x68: 0x4d01 mmio_invalid_ writel addr 0x6c: 0x44b0100 mmio_invalid_ writel addr 0x70: 0x540100 mmio_invalid_ writel addr 0x74: 0x4b010000 mmio_invalid_ writel addr 0x78: 0x5b010004 mmio_invalid_ writel addr 0x7c: 0x1000000 mmio_invalid_ writel addr 0x80: 0x100044b mmio_invalid_ writel addr 0x84: 0x62 mmio_invalid_ writel addr 0x88: 0x44b01 mmio_invalid_ writel addr 0x8c: 0x6901 mmio_invalid_ writel addr 0x90: 0x44b0100 mmio_invalid_ writel addr 0x94: 0x700100 mmio_invalid_ writel addr 0x98: 0x4b010000 mmio_invalid_ writel addr 0x9c: 0x77010004 mmio_invalid_ writel addr 0xa4: 0x100044b mmio_invalid_ writel addr 0xa8: 0x7e mmio_invalid_ writel addr 0xac: 0x44b01 mmio_invalid_ writel addr 0xb0: 0x8501 mmio_invalid_ writel addr 0xb4: 0x44b0100 mmio_invalid_ writel addr 0xb8: 0x8c0100 mmio_invalid_ writel addr 0xbc: 0x4b010000 enqueue_ frame fr: 0x7fffa1e00000 init_firmware pa 0x0 qf_complete_ noirq context 0x0 command_ complete scmd 0: status 0x0, residual 0 scsi_complete scmd 0: status 0x0, len 0/0
megasas_handle_scsi LD SCSI dev 1/0/0 sdev 0x5555573f5560 xfer 0
scsi_req_parsed target 0 lun 0 tag 0 command 53 dir 0 length 0
scsi_req_parsed_lba target 0 lun 0 tag 0 command 53 lba 0
scsi_req_alloc target 0 lun 0 tag 0
scsi_disk_
megasas_scsi_nodata scmd 0: no data to be transferred
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_mmio_writel reg MFI_ODCR0: 0x1000000
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_
megasas_mmio_writel reg MFI_IQPL: 0x4
megasas_qf_new frame 0x1 addr 0x0
megasas_
megasas_qf_enqueue frame 0x1 count 2 context 0x0 head 0x0 tail 0x0 busy 2
megasas_
megasas_init_queue queue at 0x0 len 0 head 0x0 tail 0x0 flags 0x0
megasas_unmap_frame fr: 0x7fffa1e44b00
megasas_unmap_frame fr: 0x7fffa1e00000
megasas_
scsi_req_dequeue target 0 lun 0 tag 0
scsi_aio_complete
megasas_
megasas_
The frame is unmapped...