Seems to still be a problem. Here's the reproducer found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29586
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ 512M -M q35 -nodefaults -device e1000e,netdev=net0 -netdev user,id=net0 \ -qtest /dev/null -qtest stdio outl 0xcf8 0x80000811 outl 0xcfc 0x5ac600 outl 0xcf8 0x80000801 outl 0xcfc 0x06000000 write 0x5ac60100 0x4 0x56000302 write 0x5ac6011a 0x2 0x0106 write 0x5ac60120 0x1 0x25 write 0x5ac6042a 0x2 0x0248 write 0x5ac60431 0x1 0x04 write 0x4240 0x1 0xff write 0x4241 0x1 0x01 write 0x4249 0x1 0xf5 write 0x1ff 0x1 0x01 write 0x5ac60403 0x1 0x02 write 0x5ac6043a 0x2 0x2800 write 0x5ac60112 0x2 0xf090 write 0x5ac60430 0x1 0x00 write 0x239 0x1 0xff write 0x23b 0x1 0x01 write 0x9531 0x1 0xff write 0x9532 0x1 0xff write 0x9533 0x1 0xff write 0x9534 0x1 0xff write 0x9535 0x1 0xff write 0x9536 0x1 0xff write 0x9537 0x1 0xff write 0x5ac60403 0x1 0x02 EOF On 210525 0820, Thomas Huth wrote: > Can you still reproduce the crash with the current version of QEMU? At > least I cannot reproduce the crash anymore, so it seems like this got > fixed at one point in time? > > ** Changed in: qemu > Status: New => Incomplete > > -- > You received this bug notification because you are subscribed to the bug > report. > https://bugs.launchpad.net/bugs/1878034 > > Title: > memcpy param-overlap through e1000e_write_to_rx_buffers > > Status in QEMU: > Incomplete > > Bug description: > Hello, > While fuzzing, I found an input that triggers an overlapping memcpy (caught > by AddressSanitizer). > Overlapping memcpys are undefined behavior according to the POSIX and C > standards, and can lead to bugs. > > ==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges > #0 0x563c9f4823d4 in __asan_memcpy > (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4) > #1 0x563c9f4cb2b1 in flatview_write_continue > /home/alxndr/Development/qemu/exec.c:3142:13 > #2 0x563c9f4c3b97 in flatview_write > /home/alxndr/Development/qemu/exec.c:3177:14 > #3 0x563c9f4c3b97 in address_space_write > /home/alxndr/Development/qemu/exec.c:3268:18 > #4 0x563c9fbc457b in dma_memory_rw_relaxed > /home/alxndr/Development/qemu/include/sysemu/dma.h:87:18 > #5 0x563c9fbc457b in dma_memory_rw > /home/alxndr/Development/qemu/include/sysemu/dma.h:110:12 > #6 0x563c9fbc457b in pci_dma_rw > /home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5 > #7 0x563c9fbc457b in pci_dma_write > /home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12 > #8 0x563c9fbc457b in e1000e_write_to_rx_buffers > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9 > #9 0x563c9fbb9c98 in e1000e_write_packet_to_guest > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21 > #10 0x563c9fbb9c98 in e1000e_receive_iov > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9 > #11 0x563c9fba8080 in net_tx_pkt_sendv > /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9 > #12 0x563c9fba8080 in net_tx_pkt_send > /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9 > #13 0x563c9fba8827 in net_tx_pkt_send_loopback > /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11 > #14 0x563c9fbd2052 in e1000e_tx_pkt_send > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16 > #15 0x563c9fbd2052 in e1000e_process_tx_desc > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17 > #16 0x563c9fbd2052 in e1000e_start_xmit > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9 > #17 0x563c9fbcecf0 in e1000e_set_tdt > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9 > #18 0x563c9fbbf20c in e1000e_core_write > /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9 > #19 0x563c9f5b68d6 in memory_region_write_accessor > /home/alxndr/Development/qemu/memory.c:483:5 > #20 0x563c9f5b627f in access_with_adjusted_size > /home/alxndr/Development/qemu/memory.c:544:18 > #21 0x563c9f5b627f in memory_region_dispatch_write > /home/alxndr/Development/qemu/memory.c:1476:16 > > I can reproduce it in qemu 5.0 built with --enable-sanitizers using: > cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M > pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none > outl 0xcf8 0x80001010 > outl 0xcfc 0xe1020000 > outl 0xcf8 0x80001014 > outl 0xcf8 0x80001004 > outw 0xcfc 0x7 > outl 0xcf8 0x800010a2 > write 0xe102003a 0x3ff > 0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63 > EOF > > I also attached the trace to this launchpad report, in case the > formatting is broken: > > qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic > -monitor none -serial none < attachment > > Please let me know if I can provide any further info. > -Alex > > To manage notifications about this bug go to: > https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1878034 Title: memcpy param-overlap through e1000e_write_to_rx_buffers Status in QEMU: Incomplete Bug description: Hello, While fuzzing, I found an input that triggers an overlapping memcpy (caught by AddressSanitizer). Overlapping memcpys are undefined behavior according to the POSIX and C standards, and can lead to bugs. ==22287==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges #0 0x563c9f4823d4 in __asan_memcpy (/home/alxndr/Development/qemu/build/i386-softmmu/qemu-system-i386+0x97a3d4) #1 0x563c9f4cb2b1 in flatview_write_continue /home/alxndr/Development/qemu/exec.c:3142:13 #2 0x563c9f4c3b97 in flatview_write /home/alxndr/Development/qemu/exec.c:3177:14 #3 0x563c9f4c3b97 in address_space_write /home/alxndr/Development/qemu/exec.c:3268:18 #4 0x563c9fbc457b in dma_memory_rw_relaxed /home/alxndr/Development/qemu/include/sysemu/dma.h:87:18 #5 0x563c9fbc457b in dma_memory_rw /home/alxndr/Development/qemu/include/sysemu/dma.h:110:12 #6 0x563c9fbc457b in pci_dma_rw /home/alxndr/Development/qemu/include/hw/pci/pci.h:787:5 #7 0x563c9fbc457b in pci_dma_write /home/alxndr/Development/qemu/include/hw/pci/pci.h:800:12 #8 0x563c9fbc457b in e1000e_write_to_rx_buffers /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1412:9 #9 0x563c9fbb9c98 in e1000e_write_packet_to_guest /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1582:21 #10 0x563c9fbb9c98 in e1000e_receive_iov /home/alxndr/Development/qemu/hw/net/e1000e_core.c:1709:9 #11 0x563c9fba8080 in net_tx_pkt_sendv /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:544:9 #12 0x563c9fba8080 in net_tx_pkt_send /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:620:9 #13 0x563c9fba8827 in net_tx_pkt_send_loopback /home/alxndr/Development/qemu/hw/net/net_tx_pkt.c:633:11 #14 0x563c9fbd2052 in e1000e_tx_pkt_send /home/alxndr/Development/qemu/hw/net/e1000e_core.c:664:16 #15 0x563c9fbd2052 in e1000e_process_tx_desc /home/alxndr/Development/qemu/hw/net/e1000e_core.c:743:17 #16 0x563c9fbd2052 in e1000e_start_xmit /home/alxndr/Development/qemu/hw/net/e1000e_core.c:934:9 #17 0x563c9fbcecf0 in e1000e_set_tdt /home/alxndr/Development/qemu/hw/net/e1000e_core.c:2451:9 #18 0x563c9fbbf20c in e1000e_core_write /home/alxndr/Development/qemu/hw/net/e1000e_core.c:3261:9 #19 0x563c9f5b68d6 in memory_region_write_accessor /home/alxndr/Development/qemu/memory.c:483:5 #20 0x563c9f5b627f in access_with_adjusted_size /home/alxndr/Development/qemu/memory.c:544:18 #21 0x563c9f5b627f in memory_region_dispatch_write /home/alxndr/Development/qemu/memory.c:1476:16 I can reproduce it in qemu 5.0 built with --enable-sanitizers using: cat << EOF | ~/Development/qemu/build/i386-softmmu/qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none outl 0xcf8 0x80001010 outl 0xcfc 0xe1020000 outl 0xcf8 0x80001014 outl 0xcf8 0x80001004 outw 0xcfc 0x7 outl 0xcf8 0x800010a2 write 0xe102003a 0x3ff 0xd1055e2d3b0002e10000000001ffd3055e2d3b0002e10000000001ffd5055e2d3b0002e10000000001ffd7055e2d3b0002e10000000001ffd9055e2d3b0002e10000000001ffdb055e2d3b0002e10000000001ffdd055e2d3b0002e10000000001ffdf055e2d3b0002e10000000001ffe1055e2d3b0002e10000000001ffe3055e2d3b0002e10000000001ffe5055e2d3b0002e10000000001ffe7055e2d3b0002e10000000001ffe9055e2d3b0002e10000000001ffeb055e2d3b0002e10000000001ffed055e2d3b0002e10000000001ffef055e2d3b0002e10000000001fff1055e2d3b0002e10000000001fff3055e2d3b0002e10000000001fff5055e2d3b0002e10000000001fff7055e2d3b0002e10000000001fff9055e2d3b0002e10000000001fffb055e2d3b0002e10000000001fffd055e2d3b0002e10000000001ffff055e2d3b0002e10000000001ff01055e2d3b0002e10000000001ff03055e2d3b0002e10000000001ff05055e2d3b0002e10000000001ff07055e2d3b0002e10000000001ff09055e2d3b0002e10000000001ff0b055e2d3b0002e10000000001ff0d055e2d3b0002e10000000001ff0f055e2d3b0002e10000000001ff11055e2d3b0002e10000000001ff13055e2d3b0002e10000000001ff15055e2d3b0002e10000000001ff17055e2d3b0002e10000000001ff19055e2d3b0002e10000000001ff1b055e2d3b0002e10000000001ff1d055e2d3b0002e10000000001ff1f055e2d3b0002e10000000001ff21055e2d3b0002e10000000001ff23055e2d3b0002e10000000001ff25055e2d3b0002e10000000001ff27055e2d3b0002e10000000001ff29055e2d3b0002e10000000001ff2b055e2d3b0002e10000000001ff2d055e2d3b0002e10000000001ff2f055e2d3b0002e10000000001ff31055e2d3b0002e10000000001ff33055e2d3b0002e10000000001ff35055e2d3b0002e10000000001ff37055e2d3b0002e10000000001ff39055e2d3b0002e10000000001ff3b055e2d3b0002e10000000001ff3d055e2d3b0002e10000000001ff3f055e2d3b0002e10000000001ff41055e2d3b0002e10000000001ff43055e2d3b0002e10000000001ff45055e2d3b0002e10000000001ff47055e2d3b0002e10000000001ff49055e2d3b0002e10000000001ff4b055e2d3b0002e10000000001ff4d055e2d3b0002e10000000001ff4f055e2d3b0002e10000000001ff51055e2d3b0002e10000000001ff53055e2d3b0002e10000000001ff55055e2d3b0002e10000000001ff57055e2d3b0002e10000000001ff59055e2d3b0002e10000000001ff5b055e2d3b0002e10000000001ff5d055e2d3b0002e10000000001ff5f055e2d3b0002e10000000001ff61055e2d3b0002e10000000001ff63 EOF I also attached the trace to this launchpad report, in case the formatting is broken: qemu-system-i386 -M pc-q35-5.0 -accel qtest -qtest stdio -nographic -monitor none -serial none < attachment Please let me know if I can provide any further info. -Alex To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1878034/+subscriptions