Cc'ing Dmitry
On 5/11/20 8:04 PM, Alexander Bulekov wrote: > Public bug reported: > > Hello, > While fuzzing, I found an input that triggers an assertion failure in > eth_get_gso_type through the e1000e: > > #1 0x00007ffff685755b in __GI_abort () at abort.c:79 > #2 0x00007ffff7c75dc3 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 > #3 0x00007ffff7cd0b0a in g_assertion_message_expr () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 > #4 0x0000555556875f33 in eth_get_gso_type (l3_proto=<optimized out>, l3_hdr=<optimized out>, l4proto=<optimized out>) at /home/alxndr/Development/qemu/net/eth.c:76 > #5 0x00005555565e09ac in net_tx_pkt_get_gso_type (pkt=0x631000014800, tso_enable=0x1) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:300 > #6 0x00005555565e09ac in net_tx_pkt_build_vheader (pkt=0x631000014800, tso_enable=<optimized out>, csum_enable=<optimized out>, gso_size=<optimized out>) at /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:316 > #7 0x000055555660bdb1 in e1000e_setup_tx_offloads (core=0x7fffeeb754e0, tx=0x7fffeeb95748) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:637 > #8 0x000055555660bdb1 in e1000e_tx_pkt_send (core=0x7fffeeb754e0, tx=0x7fffeeb95748, queue_index=<optimized out>) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:658 > #9 0x000055555660bdb1 in e1000e_process_tx_desc (core=0x7fffeeb754e0, tx=0x7fffeeb95748, dp=<optimized out>, queue_index=<optimized out>) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743 > #10 0x000055555660bdb1 in e1000e_start_xmit (core=core@entry=0x7fffeeb754e0, txr=<optimized out>, txr@entry=0x7fffffffbe60) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934 > #11 0x0000555556607e2e in e1000e_set_tctl (core=0x7fffeeb754e0, index=<optimized out>, val=<optimized out>) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2431 > #12 0x00005555565f90fd in e1000e_core_write (core=<optimized out>, addr=<optimized out>, val=<optimized out>, size=<optimized out>) at /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261 > #13 0x0000555555ff4337 in memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) at /home/alxndr/Development/qemu/memory.c:483 > #14 0x0000555555ff3ce0 in access_with_adjusted_size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=<optimized out>, mr=0x7fffeeb75110, attrs=...) at /home/alxndr/Development/qemu/memory.c:544 > #15 0x0000555555ff3ce0 in memory_region_dispatch_write (mr=<optimized out>, addr=<optimized out>, data=0x2b, op=<optimized out>, attrs=...) at /home/alxndr/Development/qemu/memory.c:1476 > > I can reproduce it in qemu 5.0 built with using: > cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device e1000e,netdev=qtest-bn0 -display none -nodefaults -nographic -qtest stdio -monitor none -serial none > outl 0xcf8 0x80000810 > outl 0xcfc 0xe0000000 > outl 0xcf8 0x80000814 > outl 0xcf8 0x80000804 > outw 0xcfc 0x7 > outl 0xcf8 0x800008a2 > write 0xe0000420 0x1fc 0x3ff9ffdf00000000002467ff272d2f3ff9ffdf0000000000246fff272d2f3ff9ffdf00000000002477ff272d2f3ff9ffdf0000000000247fff272d2f3ff9ffdf00000000002487ff272d2f3ff9ffdf0000000000248fff272d2f3ff9ffdf00000000002497ff272d2f3ff9ffdf0000000000249fff272d2f3ff9ffdf000000000024a7ff272d2f3ff9ffdf000000000024afff272d2f3ff9ffdf000000000024b7ff272d2f3ff9ffdf000000000024bfff272d2f3ff9ffdf000000000024c7ff272d2f3ff9ffdf000000000024cfff272d2f3ff9ffdf000000000024d7ff272d2f3ff9ffdf000000000024dfff272d2f3ff9ffdf000000000024e7ff272d2f3ff9ffdf000000000024efff272d2f3ff9ffdf000000000024f7ff272d2f3ff9ffdf000000000024ffff272d2f3ff9ffdf00000000002407ff272d2f3ff9ffdf0000000000240fff272d2f3ff9ffdf00000000002417ff272d2f3ff9ffdf0000000000241fff272d2f3ff9ffdf00000000002427ff272d2f3ff9ffdf0000000000242fff272d2f3ff9ffdf00000000002437ff272d2f3ff9ffdf0000000000243fff272d2f3ff9ffdf00000000002447ff272d2f3ff9ffdf0000000000244fff272d2f3ff9ffdf00000000002457ff272d2f3ff9ffdf0000000000245fff272d2f3ff9ffdf00000000002467ff272d2f3ff9ffdf0000000000246fff27 > write 0xe00000b8 0x349 0xa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52bff003100ffa300f52b > EOF > > I also attached the trace to this launchpad report, in case the > formatting is broken: > > qemu-system-i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device > e1000e,netdev=qtest-bn0 -display none -nodefaults -nographic -qtest > stdio -monitor none -serial none < attachment > > Please let me know if I can provide any further info. > -Alex > > ** Affects: qemu > Importance: Undecided > Status: New > > ** Attachment added: "attachment" > https://bugs.launchpad.net/bugs/1878067/+attachment/5369990/+files/attachment >
Cc'ing Dmitry
On 5/11/20 8:04 PM, Alexander Bulekov wrote: x86_64- linux-gnu/ libglib- 2.0.so. 0 message_ expr () at /usr/lib/ x86_64- linux-gnu/ libglib- 2.0.so. 0 <optimized out>, l3_hdr=<optimized out>, l4proto=<optimized out>) at /home/alxndr/ Development/ qemu/net/ eth.c:76 pkt_get_ gso_type (pkt=0x63100001 4800, tso_enable=0x1) at /home/alxndr/ Development/ qemu/hw/ net/net_ tx_pkt. c:300 pkt_build_ vheader (pkt=0x63100001 4800, tso_enable= <optimized out>, csum_enable= <optimized out>, gso_size=<optimized out>) at /home/alxndr/ Development/ qemu/hw/ net/net_ tx_pkt. c:316 setup_tx_ offloads (core=0x7fffeeb 754e0, tx=0x7fffeeb95748) at /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 637 754e0, tx=0x7fffeeb95748, queue_index= <optimized out>) at /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 658 process_ tx_desc (core=0x7fffeeb 754e0, tx=0x7fffeeb95748, dp=<optimized out>, queue_index= <optimized out>) at /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 743 entry=0x7fffeeb 754e0, txr=<optimized out>, txr@entry= 0x7fffffffbe60) at /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 934 754e0, index=<optimized out>, val=<optimized out>) at /home/alxndr/ Development/ qemu/hw/ net/e1000e_ core.c: 2431 Development/ qemu/hw/ net/e1000e_ core.c: 3261 region_ write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:483 with_adjusted_ size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_ size_min= <optimized out>, access_ size_max= <optimized out>, access_ fn=<optimized out>, mr=0x7fffeeb75110, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:544 region_ dispatch_ write (mr=<optimized out>, addr=<optimized out>, data=0x2b, op=<optimized out>, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:1476 qemu/build/ i386-softmmu/ qemu-system- i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device e1000e, netdev= qtest-bn0 -display none -nodefaults -nographic -qtest stdio -monitor none -serial none 000002467ff272d 2f3ff9ffdf00000 00000246fff272d 2f3ff9ffdf00000 000002477ff272d 2f3ff9ffdf00000 00000247fff272d 2f3ff9ffdf00000 000002487ff272d 2f3ff9ffdf00000 00000248fff272d 2f3ff9ffdf00000 000002497ff272d 2f3ff9ffdf00000 00000249fff272d 2f3ff9ffdf00000 0000024a7ff272d 2f3ff9ffdf00000 0000024afff272d 2f3ff9ffdf00000 0000024b7ff272d 2f3ff9ffdf00000 0000024bfff272d 2f3ff9ffdf00000 0000024c7ff272d 2f3ff9ffdf00000 0000024cfff272d 2f3ff9ffdf00000 0000024d7ff272d 2f3ff9ffdf00000 0000024dfff272d 2f3ff9ffdf00000 0000024e7ff272d 2f3ff9ffdf00000 0000024efff272d 2f3ff9ffdf00000 0000024f7ff272d 2f3ff9ffdf00000 0000024ffff272d 2f3ff9ffdf00000 000002407ff272d 2f3ff9ffdf00000 00000240fff272d 2f3ff9ffdf00000 000002417ff272d 2f3ff9ffdf00000 00000241fff272d 2f3ff9ffdf00000 000002427ff272d 2f3ff9ffdf00000 00000242fff272d 2f3ff9ffdf00000 000002437ff272d 2f3ff9ffdf00000 00000243fff272d 2f3ff9ffdf00000 000002447ff272d 2f3ff9ffdf00000 00000244fff272d 2f3ff9ffdf00000 000002457ff272d 2f3ff9ffdf00000 00000245fff272d 2f3ff9ffdf00000 000002467ff272d 2f3ff9ffdf00000 00000246fff27 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52bff003100ffa 300f52bff003100 ffa300f52bff003 100ffa300f52bff 003100ffa300f52 bff003100ffa300 f52b netdev= qtest-bn0 -display none -nodefaults -nographic -qtest /bugs.launchpad .net/bugs/ 1878067/ +attachment/ 5369990/ +files/ attachment
> Public bug reported:
>
> Hello,
> While fuzzing, I found an input that triggers an assertion failure in
> eth_get_gso_type through the e1000e:
>
> #1 0x00007ffff685755b in __GI_abort () at abort.c:79
> #2 0x00007ffff7c75dc3 in () at /usr/lib/
> #3 0x00007ffff7cd0b0a in g_assertion_
> #4 0x0000555556875f33 in eth_get_gso_type (l3_proto=
> #5 0x00005555565e09ac in net_tx_
> #6 0x00005555565e09ac in net_tx_
> #7 0x000055555660bdb1 in e1000e_
> #8 0x000055555660bdb1 in e1000e_tx_pkt_send (core=0x7fffeeb
> #9 0x000055555660bdb1 in e1000e_
> #10 0x000055555660bdb1 in e1000e_start_xmit (core=core@
> #11 0x0000555556607e2e in e1000e_set_tctl (core=0x7fffeeb
> #12 0x00005555565f90fd in e1000e_core_write (core=<optimized out>, addr=<optimized out>, val=<optimized out>, size=<optimized out>) at /home/alxndr/
> #13 0x0000555555ff4337 in memory_
> #14 0x0000555555ff3ce0 in access_
> #15 0x0000555555ff3ce0 in memory_
>
> I can reproduce it in qemu 5.0 built with using:
> cat << EOF | ~/Development/
> outl 0xcf8 0x80000810
> outl 0xcfc 0xe0000000
> outl 0xcf8 0x80000814
> outl 0xcf8 0x80000804
> outw 0xcfc 0x7
> outl 0xcf8 0x800008a2
> write 0xe0000420 0x1fc 0x3ff9ffdf00000
> write 0xe00000b8 0x349 0xa300f52bff003
> EOF
>
> I also attached the trace to this launchpad report, in case the
> formatting is broken:
>
> qemu-system-i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device
> e1000e,
> stdio -monitor none -serial none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> ** Affects: qemu
> Importance: Undecided
> Status: New
>
> ** Attachment added: "attachment"
> https:/
>