Heap use-after-free in lduw_he_p through e1000e_write_to_rx_buffers
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Hello,
This reproducer causes a heap-use-after free. QEMU Built with --enable-
cat << EOF | ./i386-
-qtest stdio -nographic -monitor none -serial none
outl 0xcf8 0x80001010
outl 0xcfc 0xe1020000
outl 0xcf8 0x80001014
outl 0xcf8 0x80001004
outw 0xcfc 0x7
outl 0xcf8 0x800010a2
write 0xe102003b 0x1 0xff
write 0xe1020103 0x1e 0xffffff055c5e5
write 0xe1020420 0x4 0xffffffff
write 0xe1020424 0x4 0xffffffff
write 0xe102042b 0x1 0xff
write 0xe1020430 0x4 0x055c5e5c
write 0x5c041 0x1 0x04
write 0x5c042 0x1 0x02
write 0x5c043 0x1 0xe1
write 0x5c048 0x1 0x8a
write 0x5c04a 0x1 0x31
write 0x5c04b 0x1 0xff
write 0xe1020403 0x1 0xff
EOF
The Output:
==22689==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500026800e at pc 0x55b93bb18bfa bp 0x7fffdbe844f0 sp 0x7fffdbe83cb8
READ of size 2 at 0x62500026800e thread T0
#0 in __asan_memcpy (/build/
#1 in lduw_he_p /include/
#2 in ldn_he_p /include/
#3 in flatview_
#4 in flatview_write /exec.c:3186:14
#5 in address_space_write /exec.c:3280:18
#6 in address_space_rw /exec.c:3290:16
#7 in dma_memory_
#8 in dma_memory_rw /include/
#9 in pci_dma_rw /include/
#10 in pci_dma_write /include/
#11 in e1000e_
#12 in e1000e_
#13 in e1000e_receive_iov /hw/net/
#14 in e1000e_
#15 in net_tx_pkt_sendv /hw/net/
#16 in net_tx_pkt_send /hw/net/
#17 in net_tx_
#18 in e1000e_tx_pkt_send /hw/net/
#19 in e1000e_
#20 in e1000e_start_xmit /hw/net/
#21 in e1000e_set_tctl /hw/net/
#22 in e1000e_core_write /hw/net/
#23 in e1000e_mmio_write /hw/net/
#24 in memory_
#25 in access_
#26 in memory_
#27 in flatview_
#28 in flatview_write /exec.c:3186:14
#29 in address_space_write /exec.c:3280:18
#30 in qtest_process_
#31 in qtest_process_inbuf /qtest.c:710:9
#32 in qtest_read /qtest.c:722:5
#33 in qemu_chr_
#34 in qemu_chr_be_write /chardev/
#35 in fd_chr_read /chardev/
#36 in qio_channel_
#37 in g_main_
#38 in glib_pollfds_poll /util/main-
#39 in os_host_
#40 in main_loop_wait /util/main-
#41 in qemu_main_loop /softmmu/
#42 in main /softmmu/
#43 in __libc_start_main (/lib/x86_
#44 in _start (/build/
0x62500026800e is located 14 bytes inside of 138-byte region [0x625000268000
freed by thread T0 here:
#0 in free (/build/
#1 in qemu_vfree /util/oslib-
#2 in address_space_unmap /exec.c:3616:5
#3 in dma_memory_unmap /include/
#4 in pci_dma_unmap /include/
#5 in net_tx_pkt_reset /hw/net/
#6 in e1000e_
#7 in e1000e_start_xmit /hw/net/
#8 in e1000e_set_tctl /hw/net/
#9 in e1000e_core_write /hw/net/
#10 in e1000e_mmio_write /hw/net/
#11 in memory_
#12 in access_
#13 in memory_
#14 in flatview_
#15 in flatview_write /exec.c:3186:14
#16 in address_space_write /exec.c:3280:18
#17 in address_space_rw /exec.c:3290:16
#18 in dma_memory_
#19 in dma_memory_rw /include/
#20 in pci_dma_rw /include/
#21 in pci_dma_write /include/
#22 in e1000e_
#23 in e1000e_
#24 in e1000e_receive_iov /hw/net/
#25 in e1000e_
#26 in net_tx_pkt_sendv /hw/net/
#27 in net_tx_pkt_send /hw/net/
#28 in net_tx_
#29 in e1000e_tx_pkt_send /hw/net/
previously allocated by thread T0 here:
#0 in posix_memalign (/build/
#1 in qemu_try_memalign /util/oslib-
#2 in qemu_memalign /util/oslib-
#3 in address_space_map /exec.c:3558:25
#4 in dma_memory_map /include/
#5 in pci_dma_map /include/
#6 in net_tx_
#7 in e1000e_
#8 in e1000e_start_xmit /hw/net/
#9 in e1000e_set_tctl /hw/net/
#10 in e1000e_core_write /hw/net/
#11 in e1000e_mmio_write /hw/net/
#12 in memory_
#13 in access_
#14 in memory_
#15 in flatview_
#16 in flatview_write /exec.c:3186:14
#17 in address_space_write /exec.c:3280:18
#18 in qtest_process_
#19 in qtest_process_inbuf /qtest.c:710:9
#20 in qtest_read /qtest.c:722:5
#21 in qemu_chr_
#22 in qemu_chr_be_write /chardev/
#23 in fd_chr_read /chardev/
#24 in qio_channel_
#25 in g_main_
-Alex
Running with '-trace e1000\*':
e1000e_ cb_pci_ realize E1000E PCI realize entry mac_set_ permanent Set permanent MAC: 52:54:00:12:34:56 cfg_support_ virtio Virtio header supported: 0 cb_qdev_ reset E1000E qdev reset entry rx_can_ recv_disabled link_up: 1, rx_enabled 0, pci_master 0 rx_can_ recv_disabled link_up: 1, rx_enabled 0, pci_master 0 vm_state_ running VM state is running rx_start_ recv c30be4511d084ff fffffffffffffff fffffffffffffff ff rx_desc_ buff_sizes buffer sizes: [2048, 0, 0, 0] rx_start_ recv wrn_regs_ write_unknown WARNING: Write to unknown register 0x104, 4 byte(s), value: 0x5c05ffff irq_rdtr_ fpd_not_ running FPD written while RDTR was not running wrn_regs_ write_unknown WARNING: Write to unknown register 0x10c, 4 byte(s), value: 0x84d01145 wrn_regs_ write_unknown WARNING: Write to unknown register 0x11c, 4 byte(s), value: 0xffffffff wrn_regs_ read_unknown WARNING: Rea...
e1000e_
e1000e_
e1000e_rx_set_cso RX CSO state set to 0
e1000e_
e1000x_mac_indicate Indicating MAC to guest: 52:54:00:12:34:56
e1000x_
e1000x_
e1000e_
[R +0.094581] outl 0xcf8 0x80001010
[S +0.094604] OK
[R +0.094632] outl 0xcfc 0xe1020000
[S +0.094654] OK
[R +0.094668] outl 0xcf8 0x80001014
[S +0.094675] OK
[R +0.094694] outl 0xcf8 0x80001004
[S +0.094702] OK
[R +0.094712] outw 0xcfc 0x7
e1000e_
[S +0.096938] OK
[R +0.096960] outl 0xcf8 0x800010a2
[S +0.096972] OK
[R +0.096986] write 0xe102003b 0x1 0xff
e1000e_core_write Write to register 0x38, 4 byte(s), value: 0xff
e1000e_vlan_vet Setting VLAN ethernet type 0xFF
[S +0.097019] OK
[R +0.097034] write 0xe1020103 0x1e 0xffffff055c5e5
e1000e_core_write Write to register 0x100, 4 byte(s), value: 0xff
e1000e_rx_set_rctl RCTL = 0xff
e1000e_
e1000e_rx_desc_len RX descriptor length: 16
e1000e_
e1000e_
e1000e_core_write Write to register 0x2820, 4 byte(s), value: 0xbe305c5e
e1000e_
e1000e_
e1000e_core_write Write to register 0x2800, 4 byte(s), value: 0xffffffff
e1000e_core_write Write to register 0x2804, 4 byte(s), value: 0xffffffff
e1000e_core_write Write to register 0x2808, 4 byte(s), value: 0xffffffff
e1000e_
e1000e_core_write Write to register 0x2810, 4 byte(s), value: 0xff
[S +0.097143] OK
[R +0.097159] write 0xe1020420 0x4 0xffffffff
e1000e_core_write Write to register 0x3800, 4 byte(s), value: 0xffffffff
[S +0.097173] OK
[R +0.097183] write 0xe1020424 0x4 0xffffffff
e1000e_core_write Write to register 0x3804, 4 byte(s), value: 0xffffffff
[S +0.097196] OK
[R +0.097208] write 0xe102042b 0x1 0xff
e1000e_core_write Write to register 0x3808, 4 byte(s), value: 0xff
[S +0.097221] OK
[R +0.097231] write 0xe1020430 0x4 0x055c5e5c
e1000e_core_write Write to register 0x3810, 4 byte(s), value: 0x5c5e5c05
[S +0.097243] OK
[R +0.097253] write 0x5c041 0x1 0x04
[S +0.097914] OK
[R +0.097942] write 0x5c042 0x1 0x02
[S +0.097953] OK
[R +0.097964] write 0x5c043 0x1 0xe1
[S +0.097972] OK
[R +0.097984] write 0x5c048 0x1 0x8a
[S +0.097992] OK
[R +0.098003] write 0x5c04a 0x1 0x31
[S +0.098011] OK
[R +0.098022] write 0x5c04b 0x1 0xff
[S +0.098029] OK
[R +0.098040] write 0xe1020403 0x1 0xff
e1000e_core_write Write to register 0x400, 4 byte(s), value: 0xff
e1000e_tx_descr 0xe1020400 : ff31008a 0
e1000e_core_read Read from register 0x400, 4 byte(s), value: 0xff
e1000e_