[Bug 1907909] Re: assertion failure in am53c974

[Peter Maydell]

** Tags added: fuzzer

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1907909

Title:
  assertion failure in am53c974

Status in QEMU:
  New

Bug description:
  Hello,

  Using hypervisor fuzzer, hyfuzz, I found an assertion failure through
  am53c974 emulator.

  A malicious guest user/process could use this flaw to abort the QEMU
  process on the host, resulting in a denial of service.

  This was found in version 5.2.0 (master)

  
  qemu-system-i386: ../hw/scsi/esp.c:402: void esp_do_dma(ESPState *): 
Assertion `s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - 
s->cmdlen' failed.

  #0  __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51
  51      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
  [Current thread is 1 (Thread 0x7fdd25dc4700 (LWP 28983))]
  gdb-peda$ bt
  #0  0x00007fdd3f8b5f47 in __GI_raise (sig=sig@entry=0x6) at 
../sysdeps/unix/sysv/linux/raise.c:51
  #1  0x00007fdd3f8b78b1 in __GI_abort () at abort.c:79
  #2  0x00007fdd3f8a742a in __assert_fail_base (fmt=0x7fdd3fa2ea38 "%s%s%s:%u: 
%s%sAssertion `%s' failed.\\n%n", assertion=assertion@entry=0x55b3e11a51c6 
"s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - s->cmdlen", 
file=file@entry=0x55b3e11a4f73 "../hw/scsi/esp.c", line=line@entry=0x192, 
function=function@entry=0x55b3e11a520d "void esp_do_dma(ESPState *)") at 
assert.c:92
  #3  0x00007fdd3f8a74a2 in __GI___assert_fail (assertion=0x55b3e11a51c6 
"s->cmdlen <= sizeof(s->cmdbuf) && len <= sizeof(s->cmdbuf) - s->cmdlen", 
file=0x55b3e11a4f73 "../hw/scsi/esp.c", line=0x192, function=0x55b3e11a520d 
"void esp_do_dma(ESPState *)") at assert.c:101
  #4  0x000055b3e0941441 in esp_do_dma (s=0x55b3e49d1c88) at 
../hw/scsi/esp.c:401
  #5  0x000055b3e0944261 in handle_ti (s=0x55b3e49d1c88) at ../hw/scsi/esp.c:549
  #6  0x000055b3e093fdf9 in esp_dma_enable (s=0x55b3e49d1c88, irq=<optimized 
out>, level=<optimized out>)
      at ../hw/scsi/esp.c:79
  #7  0x000055b3e0897930 in esp_pci_dma_write (pci=<optimized out>, 
saddr=<optimized out>, val=<optimized
  out>) at ../hw/scsi/esp-pci.c:83
  #8  0x000055b3e0897930 in esp_pci_io_write (opaque=<optimized out>, 
addr=<optimized out>, val=0xcf, size=0x4) at ../hw/scsi/esp-pci.c:209
  #9  0x000055b3e0e8f798 in memory_region_write_accessor (mr=<optimized out>, 
addr=<optimized out>, value=<optimized out>, size=<optimized out>, 
shift=<optimized out>, mask=<optimized out>, attrs=...)
      at ../softmmu/memory.c:491
  #10 0x000055b3e0e8f58e in access_with_adjusted_size (addr=<optimized out>, 
value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, 
access_size_max=<optimized out>, access_fn=<optimized out>, mr=<optimized out>, 
attrs=...) at ../softmmu/memory.c:552
  #11 0x000055b3e0e8f58e in memory_region_dispatch_write (mr=0x55b3e49d1b70, 
addr=<optimized out>, data=<optimized out>, op=<optimized out>, attrs=...) at 
../softmmu/memory.c:1501
  #12 0x000055b3e0e21541 in address_space_stb (as=<optimized out>, 
addr=<optimized out>, val=0xffffffcf, attrs=..., result=0x0) at 
../memory_ldst.c.inc:382
  #13 0x00007fdcd84a4a7f in code_gen_buffer ()
  #14 0x000055b3e0e57da0 in cpu_tb_exec (cpu=0x55b3e3c33650, itb=<optimized 
out>)
      at ../accel/tcg/cpu-exec.c:178
  #15 0x000055b3e0e589eb in cpu_loop_exec_tb (tb=<optimized out>, 
cpu=<optimized out>, last_tb=<optimized
  out>, tb_exit=<optimized out>) at ../accel/tcg/cpu-exec.c:658
  #16 0x000055b3e0e589eb in cpu_exec (cpu=0x55b3e3c33650) at 
../accel/tcg/cpu-exec.c:771
  #17 0x000055b3e0e87b9f in tcg_cpu_exec (cpu=<optimized out>) at 
../accel/tcg/tcg-cpus.c:243
  #18 0x000055b3e0e87b9f in tcg_cpu_thread_fn (arg=0x55b3e3c33650) at 
../accel/tcg/tcg-cpus.c:427
  #19 0x000055b3e115f775 in qemu_thread_start (args=<optimized out>) at 
../util/qemu-thread-posix.c:521
  #20 0x00007fdd3fc6f6db in start_thread (arg=0x7fdd25dc4700) at 
pthread_create.c:463
  #21 0x00007fdd3f998a3f in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:95

  To reproduce the assertion failure, please run the QEMU with the
  following command line.

  
  $ ./qemu-system-i386 -m 512 -drive 
file=./hyfuzz.img,index=0,media=disk,format=raw -device am53c974,id=scsi 
-device scsi-hd,drive=SysDisk -drive id=SysDisk,if=none,file=./disk.img

  Please let me know if I can provide any further info.

  Thank you.

  - Cheolwoo, Myung (Seoul National University)

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1907909/+subscriptions