mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
fda43b1204
qemu/hw
History
Philippe Mathieu-Daudé fda43b1204 hw/net/e1000e: Do not abort() on invalid PSRCTL register value 
libFuzzer found using 'qemu-system-i386 -M q35':

qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
CPU #0:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
==1988== ERROR: libFuzzer: deadly signal
    #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
    #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
    #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
    #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
    #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
    #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
    #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
    #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)

It simply sent the following 2 I/O command to the e1000e
PCI BAR #2 I/O region:

  writew 0x0100 0x0c00 # RCTL =   E1000_RCTL_DTYP_MASK
  writeb 0x2170 0x00   # PSRCTL = 0

2813 static void
2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
2815 {
2816     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
2817
2818         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
2819             hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
2820         }

Instead of calling hw_error() which abort the process (it is
meant for CPU fatal error condition, not for device logging),
log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
and return, ignoring the request.

Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-06-18 21:05:52 +08:00
..
9pfs xen/9pfs: increase max ring order to 9 2020-05-25 11:45:40 +02:00
acpi pci: Convert uses of pci_create() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
adc hw/adc/stm32f2xx_adc: Correct memory region size and access size 2020-06-05 17:23:09 +01:00
alpha sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
arm * hw: arm: Set vendor property for IMX SDHCI emulations 2020-06-16 13:36:31 +01:00
audio qdev: Convert uses of qdev_create() with Coccinelle 2020-06-15 22:00:10 +02:00
block qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
char qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
core Testing and plugin updates 2020-06-16 14:57:15 +01:00
cpu sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 3 2020-06-15 22:06:04 +02:00
cris sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
display sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 3 2020-06-15 22:06:04 +02:00
dma sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
gpio hw/unicore32/puv3: Use qemu_log_mask(ERROR) instead of debug printf() 2020-06-09 19:01:56 +02:00
hppa sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
hyperv qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
i2c qdev: Convert uses of qdev_create() with Coccinelle 2020-06-15 22:00:10 +02:00
i386 x86: move max-ram-below-4g to pc 2020-06-17 14:24:22 +02:00
ide qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
input hw/input/pxa2xx_keypad: Replace hw_error() by qemu_log_mask() 2020-06-05 17:23:08 +01:00
intc qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
ipack qdev: Unrealize must not fail 2020-05-15 07:08:14 +02:00
ipmi various: Remove unnecessary OBJECT() cast 2020-05-15 07:08:14 +02:00
isa sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
lm32 sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
m68k sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
mem nvdimm: Plug memory leak in uuid property setter 2020-05-27 07:44:59 +02:00
microblaze qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
mips sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 1 2020-06-15 22:06:04 +02:00
misc * hw: arm: Set vendor property for IMX SDHCI emulations 2020-06-16 13:36:31 +01:00
moxie hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
net hw/net/e1000e: Do not abort() on invalid PSRCTL register value 2020-06-18 21:05:52 +08:00
nios2 sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
nubus hw: Remove unnecessary DEVICE() cast 2020-05-15 07:08:52 +02:00
nvram sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
openrisc sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
pci pci: pci_create(), pci_create_multifunction() are now unused, drop 2020-06-15 22:05:28 +02:00
pci-bridge sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
pci-host qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
pcmcia sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
ppc qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
rdma lockable: Replace locks with lock guard macros 2020-05-04 16:07:43 +01:00
riscv qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
rtc sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
s390x qdev: Convert bus-less devices to qdev_realize() with Coccinelle 2020-06-15 22:06:04 +02:00
scsi qdev: Convert uses of qdev_create() with Coccinelle 2020-06-15 22:00:10 +02:00
sd * hw: arm: Set vendor property for IMX SDHCI emulations 2020-06-16 13:36:31 +01:00
semihosting semihosting: remove the pthread include which seems unused 2020-06-10 11:29:44 +02:00
sh4 sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
smbios hw/smbios/smbios: Remove unused include 2020-02-06 10:38:57 +01:00
sparc sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
sparc64 sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
ssi ssi: ssi_create_slave_no_init() is now unused, drop 2020-06-15 22:05:28 +02:00
timer Trivial branch pull request 20200610 2020-06-11 19:22:52 +01:00
tpm hw/tpm: fix usage of bool in tpm-tis.c 2020-05-12 11:47:24 -04:00
tricore hw: Do not initialize MachineClass::is_default to 0 2020-02-28 14:57:19 -05:00
unicore32 hw/unicore32/puv3: Use qemu_log_mask(ERROR) instead of debug printf() 2020-06-09 19:01:56 +02:00
usb usb-host: workaround libusb bug 2020-06-17 09:12:33 +02:00
vfio * Miscellaneous fixes and feature enablement (many) 2020-06-12 23:06:22 +01:00
virtio qom: Less verbose object_initialize_child() 2020-06-15 22:05:28 +02:00
watchdog hw/watchdog: Implement full i.MX watchdog support 2020-05-21 20:00:18 +01:00
xen sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
xenpv trivial: Remove xenfb_enabled from sysemu.h 2020-02-04 09:00:57 +01:00
xtensa sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
Kconfig
Makefile.objs xen: fix build without pci passthrough 2020-06-12 11:20:12 -04:00