[Bug 1910723] Re: NULL pointer dereference issues in am53c974 SCSI host bus adapter

[Mark Cave-Ayland]

Thank you both for the reproducers. Please see the proposed patchset
here:

https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg06063.html

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1910723

Title:
  NULL pointer dereference issues in am53c974 SCSI host bus adapter

Status in QEMU:
  New

Bug description:
  Two NULL pointer dereference issues were found in the am53c974 SCSI
  host bus adapter emulation of QEMU. They could occur while handling
  the 'Information Transfer' command (CMD_TI) in function handle_ti() in
  hw/scsi/esp.c, and could be abused by a malicious guest to crash the
  QEMU process on the host resulting in a denial of service.

  Both issues were reported by Cheolwoo Myung (Seoul National
  University). To reproduce them, configure and run QEMU as follows.
  Please find attached the required disk images.

  $ ./configure --target-list=x86_64-softmmu --enable-kvm --enable-sanitizers
  $ make
  $ ./qemu-system-x86_64 -m 512 -drive 
file=./hyfuzz.img,index=0,media=disk,format=raw \
  -device am53c974,id=scsi -device scsi-hd,drive=SysDisk \
  -drive id=SysDisk,if=none,file=./disk.img

  Additional info:
  RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1909766
  RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1909769

  ASAN logs:
  ==672133==         
  hw/scsi/scsi-bus.c:1385:12: runtime error: member access within null pointer 
of type 'struct SCSIRequest'
  AddressSanitizer:DEADLYSIGNAL                                                 
                           
  =================================================================             
  ==672133==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000171 (pc 
0x55bd63e20b85 bp 0x7f4b6fffdfa0 sp 0x7f4b6fffdf70 T7)
  ==672133==The signal is caused by a READ memory access.         
  ==672133==Hint: address points to the zero page.                              
                           
      #0 0x55bd63e20b85 in scsi_req_continue hw/scsi/scsi-bus.c:1385
      #1 0x55bd63ab34fb in esp_do_dma hw/scsi/esp.c:453       
      #2 0x55bd63ab4b3c in handle_ti hw/scsi/esp.c:549          
      #3 0x55bd63ab72a9 in esp_reg_write hw/scsi/esp.c:691                 
      #4 0x55bd63d7b5dd in esp_pci_io_write hw/scsi/esp-pci.c:206    
      #5 0x55bd645d55a3 in memory_region_write_accessor softmmu/memory.c:491
      #6 0x55bd645d5a24 in access_with_adjusted_size softmmu/memory.c:552
      #7 0x55bd645e2baa in memory_region_dispatch_write softmmu/memory.c:1501
      #8 0x55bd646b75ff in flatview_write_continue softmmu/physmem.c:2759
      #9 0x55bd646b79d1 in flatview_write softmmu/physmem.c:2799
      #10 0x55bd646b8341 in address_space_write softmmu/physmem.c:2891   
      #11 0x55bd646b83f9 in address_space_rw softmmu/physmem.c:2901
      #12 0x55bd648c4736 in kvm_handle_io accel/kvm/kvm-all.c:2285
      #13 0x55bd648c69c8 in kvm_cpu_exec accel/kvm/kvm-all.c:2531
      #14 0x55bd647b2413 in kvm_vcpu_thread_fn accel/kvm/kvm-cpus.c:49
      #15 0x55bd64f560de in qemu_thread_start util/qemu-thread-posix.c:521
      #16 0x7f4b981763f8 in start_thread (/lib64/libpthread.so.0+0x93f8)
      #17 0x7f4b980a3902 in __GI___clone (/lib64/libc.so.6+0x101902)

  ---

  ==672020==
  hw/scsi/esp.c:196:62: runtime error: member access within null pointer of 
type 'struct SCSIDevice'
  AddressSanitizer:DEADLYSIGNAL                                                 
                           
  =================================================================             
  ==672020==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000098 (pc 
0x559bc99946fd bp 0x7f08bd737fb0 sp 0x7f08bd737f70 T7)
  ==672020==The signal is caused by a READ memory access.         
  ==672020==Hint: address points to the zero page.                              
                           
      #0 0x559bc99946fd in do_busid_cmd hw/scsi/esp.c:196        
      #1 0x559bc9994e71 in do_cmd hw/scsi/esp.c:220           
      #2 0x559bc999ae81 in handle_ti hw/scsi/esp.c:555          
      #3 0x559bc999d2a9 in esp_reg_write hw/scsi/esp.c:691                 
      #4 0x559bc9c615dd in esp_pci_io_write hw/scsi/esp-pci.c:206    
      #5 0x559bca4bb5a3 in memory_region_write_accessor softmmu/memory.c:491
      #6 0x559bca4bba24 in access_with_adjusted_size softmmu/memory.c:552
      #7 0x559bca4c8baa in memory_region_dispatch_write softmmu/memory.c:1501
      #8 0x559bca59d5ff in flatview_write_continue softmmu/physmem.c:2759
      #9 0x559bca59d9d1 in flatview_write softmmu/physmem.c:2799
      #10 0x559bca59e341 in address_space_write softmmu/physmem.c:2891   
      #11 0x559bca59e3f9 in address_space_rw softmmu/physmem.c:2901
      #12 0x559bca7aa736 in kvm_handle_io accel/kvm/kvm-all.c:2285
      #13 0x559bca7ac9c8 in kvm_cpu_exec accel/kvm/kvm-all.c:2531
      #14 0x559bca698413 in kvm_vcpu_thread_fn accel/kvm/kvm-cpus.c:49
      #15 0x559bcae3c0de in qemu_thread_start util/qemu-thread-posix.c:521
      #16 0x7f08e57ba3f8 in start_thread (/lib64/libpthread.so.0+0x93f8)
      #17 0x7f08e56e7902 in __GI___clone (/lib64/libc.so.6+0x101902)

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1910723/+subscriptions