Public bug reported:
Reproducer:
cat << EOF | ./qemu-system-aarch64 -qtest stdio \
-machine raspi3b,accel=qtest -m 1G
write 0x3f30002c 0x1 0x25
write 0x3f300004 0x1 0x01
write 0x3f300006 0x1 0xc0
write 0x3f30000c 0x1 0x22
write 0x3f30000e 0x1 0x20
write 0x3f30000f 0x1 0x0
write 0x3f300000 0x1 0x48
write 0x3f300003 0x1 0x0
write 0x3f300005 0x1 0x14
write 0x3f300007 0x1 0x10
write 0x3f30000c 0x1 0x32
write 0x3f30000f 0x1 0x0
write 0x3f300001 0x1 0x00
write 0x3f300002 0x1 0x30
write 0x3f300003 0x1 0x3f
EOF
Stacktrace:
==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8
WRITE of size 1 at 0x619000017b80 thread T0
#0 0x562988348718 in sdhci_write_dataport
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39
#1 0x562988348718 in sdhci_write
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13
#2 0x5629890591fe in memory_region_write_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
#3 0x562989058bfb in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#4 0x562989058467 in memory_region_dispatch_write
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#5 0x5629893e8ffb in flatview_write_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
#6 0x5629893de71b in flatview_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
#7 0x5629893de71b in address_space_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
#8 0x562988334d9c in dma_memory_rw_relaxed
/home/alxndr/Development/qemu/include/sysemu/dma.h:88:12
#9 0x562988334d9c in dma_memory_rw
/home/alxndr/Development/qemu/include/sysemu/dma.h:127:12
#10 0x562988334d9c in dma_memory_write
/home/alxndr/Development/qemu/include/sysemu/dma.h:163:12
#11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13
#12 0x56298834427f in sdhci_write
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17
#13 0x5629890591fe in memory_region_write_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
#14 0x562989058bfb in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#15 0x562989058467 in memory_region_dispatch_write
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#16 0x5629893e8ffb in flatview_write_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
#17 0x5629893de71b in flatview_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
#18 0x5629893de71b in address_space_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
#19 0x56298904ad35 in qtest_process_command
/home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9
#20 0x562989043b97 in qtest_process_inbuf
/home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9
#21 0x562989894286 in fd_chr_read
/home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9
#22 0x7f535645baae in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
#23 0x562989eef363 in glib_pollfds_poll
/home/alxndr/Development/qemu/build/../util/main-loop.c:232:9
#24 0x562989eef363 in os_host_main_loop_wait
/home/alxndr/Development/qemu/build/../util/main-loop.c:255:5
#25 0x562989eef363 in main_loop_wait
/home/alxndr/Development/qemu/build/../util/main-loop.c:531:11
#26 0x562988faa599 in qemu_main_loop
/home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9
#27 0x5629872371fd in main
/home/alxndr/Development/qemu/build/../softmmu/main.c:50:5
#28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
#29 0x56298718abc9 in _start
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)
0x619000017b80 is located 0 bytes to the right of 1024-byte region
[0x619000017780,0x619000017b80)
allocated by thread T0 here:
#0 0x562987204db2 in calloc
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2)
#1 0x7f5356461ae0 in g_malloc0
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0)
#2 0x56298834a187 in sdhci_sysbus_realize
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5
#3 0x56298987fe77 in device_set_realized
/home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13
#4 0x5629898153b5 in property_set_bool
/home/alxndr/Development/qemu/build/../qom/object.c:2255:5
** Affects: qemu
Importance: Undecided
Status: New
** Tags: arm fuzzer
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1913919
Title:
Heap-buffer-overflow in sdhci_write_dataport
Status in QEMU:
New
Bug description:
Reproducer:
cat << EOF | ./qemu-system-aarch64 -qtest stdio \
-machine raspi3b,accel=qtest -m 1G
write 0x3f30002c 0x1 0x25
write 0x3f300004 0x1 0x01
write 0x3f300006 0x1 0xc0
write 0x3f30000c 0x1 0x22
write 0x3f30000e 0x1 0x20
write 0x3f30000f 0x1 0x0
write 0x3f300000 0x1 0x48
write 0x3f300003 0x1 0x0
write 0x3f300005 0x1 0x14
write 0x3f300007 0x1 0x10
write 0x3f30000c 0x1 0x32
write 0x3f30000f 0x1 0x0
write 0x3f300001 0x1 0x00
write 0x3f300002 0x1 0x30
write 0x3f300003 0x1 0x3f
EOF
Stacktrace:
==654080==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x619000017b80 at pc 0x562988348719 bp 0x7fffd26552d0 sp 0x7fffd26552c8
WRITE of size 1 at 0x619000017b80 thread T0
#0 0x562988348718 in sdhci_write_dataport
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:560:39
#1 0x562988348718 in sdhci_write
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1172:13
#2 0x5629890591fe in memory_region_write_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
#3 0x562989058bfb in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#4 0x562989058467 in memory_region_dispatch_write
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#5 0x5629893e8ffb in flatview_write_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
#6 0x5629893de71b in flatview_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
#7 0x5629893de71b in address_space_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
#8 0x562988334d9c in dma_memory_rw_relaxed
/home/alxndr/Development/qemu/include/sysemu/dma.h:88:12
#9 0x562988334d9c in dma_memory_rw
/home/alxndr/Development/qemu/include/sysemu/dma.h:127:12
#10 0x562988334d9c in dma_memory_write
/home/alxndr/Development/qemu/include/sysemu/dma.h:163:12
#11 0x562988334d9c in sdhci_sdma_transfer_multi_blocks
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:617:13
#12 0x56298834427f in sdhci_write
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1129:17
#13 0x5629890591fe in memory_region_write_accessor
/home/alxndr/Development/qemu/build/../softmmu/memory.c:491:5
#14 0x562989058bfb in access_with_adjusted_size
/home/alxndr/Development/qemu/build/../softmmu/memory.c:552:18
#15 0x562989058467 in memory_region_dispatch_write
/home/alxndr/Development/qemu/build/../softmmu/memory.c
#16 0x5629893e8ffb in flatview_write_continue
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2759:23
#17 0x5629893de71b in flatview_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2799:14
#18 0x5629893de71b in address_space_write
/home/alxndr/Development/qemu/build/../softmmu/physmem.c:2891:18
#19 0x56298904ad35 in qtest_process_command
/home/alxndr/Development/qemu/build/../softmmu/qtest.c:654:9
#20 0x562989043b97 in qtest_process_inbuf
/home/alxndr/Development/qemu/build/../softmmu/qtest.c:797:9
#21 0x562989894286 in fd_chr_read
/home/alxndr/Development/qemu/build/../chardev/char-fd.c:68:9
#22 0x7f535645baae in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
#23 0x562989eef363 in glib_pollfds_poll
/home/alxndr/Development/qemu/build/../util/main-loop.c:232:9
#24 0x562989eef363 in os_host_main_loop_wait
/home/alxndr/Development/qemu/build/../util/main-loop.c:255:5
#25 0x562989eef363 in main_loop_wait
/home/alxndr/Development/qemu/build/../util/main-loop.c:531:11
#26 0x562988faa599 in qemu_main_loop
/home/alxndr/Development/qemu/build/../softmmu/runstate.c:721:9
#27 0x5629872371fd in main
/home/alxndr/Development/qemu/build/../softmmu/main.c:50:5
#28 0x7f5355f00cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
#29 0x56298718abc9 in _start
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)
0x619000017b80 is located 0 bytes to the right of 1024-byte region
[0x619000017780,0x619000017b80)
allocated by thread T0 here:
#0 0x562987204db2 in calloc
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x33cadb2)
#1 0x7f5356461ae0 in g_malloc0
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ae0)
#2 0x56298834a187 in sdhci_sysbus_realize
/home/alxndr/Development/qemu/build/../hw/sd/sdhci.c:1469:5
#3 0x56298987fe77 in device_set_realized
/home/alxndr/Development/qemu/build/../hw/core/qdev.c:761:13
#4 0x5629898153b5 in property_set_bool
/home/alxndr/Development/qemu/build/../qom/object.c:2255:5
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1913919/+subscriptions
