I/O write make QXL abort in qxl_set_mode()
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Invalid
|
Undecided
|
Unassigned |
Bug Description
libFuzzer found:
qxl-0: guest bug: qxl_add_memslot: guest_start > guest_end 0xffffffffffffffff > 0x3ffffff
qemu-fuzz-i386: hw/display/
==8134== ERROR: libFuzzer: deadly signal
#0 0x55fddfcfb3f0 in __sanitizer_
#1 0x55fddfc0a3e1 in fuzzer:
#2 0x55fddfbeac6f in fuzzer:
#3 0x55fddfbeacc3 in fuzzer:
#4 0x7fd640644c6f (/lib64/
#5 0x7fd640483e34 in __GI_raise (/lib64/
#6 0x7fd64046e894 in __GI_abort (/lib64/
#7 0x7fd64046e768 in __assert_
#8 0x7fd64047c565 in __GI___assert_fail (/lib64/
#9 0x55fde08afd8b in qxl_set_mode (qemu-fuzz-
#10 0x55fde08b9602 in ioport_write (qemu-fuzz-
#11 0x55fddff170a7 in memory_
#12 0x55fddff16c13 in access_
#13 0x55fddff157b4 in memory_
Can be reproduce doing "writeb 0x06 0x23" on QXL I/O (PCI BAR #3).
Command line: 'qemu-system-i386 -display none -M pc -vga qxl'
Here's a qtest reproducer for this: softmmu/ qemu-system- i386 -M q35,accel=qtest -qtest null -nographic -vga qxl -qtest stdio -nodefaults
cat << EOF | ./i386-
outl 0xcf8 0x80000804
outb 0xcfc 0xff
outl 0xcf8 0x80000819
outl 0xcfc 0x87caff7a
outb 0x86 0x23
EOF