Alexander Bulekov <[email protected]> 于2020年8月12日周三 下午10:56写道： > > Public bug reported: > > Hello, > Reproducer: >
I have sent out a patch to fix this: --> https://lists.gnu.org/archive/html/qemu-devel/2020-08/msg02283.html > cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ > -trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ > -drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ > -nodefaults -nographic -qtest stdio > outl 0xcf8 0x80001016 > outl 0xcfc 0x3c009f0d > outl 0xcf8 0x80001004 > outl 0xcfc 0xc77695e > writel 0x9f0d000000000040 0xffff3655 > writeq 0x9f0d000000002000 0xff2f9e0000000000 > write 0x1d 0x1 0x27 > write 0x2d 0x1 0x2e > write 0x17232 0x1 0x03 > write 0x17254 0x1 0x06 > write 0x17278 0x1 0x34 > write 0x3d 0x1 0x27 > write 0x40 0x1 0x2e > write 0x41 0x1 0x72 > write 0x42 0x1 0x01 > write 0x4d 0x1 0x2e > write 0x4f 0x1 0x01 > writeq 0x9f0d000000002000 0x5c051a0100000000 > write 0x34001d 0x1 0x13 > write 0x340026 0x1 0x30 > write 0x340028 0x1 0x08 > write 0x34002c 0x1 0xfe > write 0x34002d 0x1 0x08 > write 0x340037 0x1 0x5e > write 0x34003a 0x1 0x05 > write 0x34003d 0x1 0x05 > write 0x34004d 0x1 0x13 > writeq 0x9f0d000000002000 0xff00010100400009 > EOF > > > Abridged trace: > ... > [R +0.032356] writel 0x9f0d000000000040 0xffff3655 > [email protected]:usb_xhci_oper_write off 0x0000, val 0xffff3655 > [email protected]:usb_xhci_run > [email protected]:usb_xhci_irq_intx level 0 > OK > [S +0.032371] OK > [R +0.032376] writeq 0x9f0d000000002000 0xff2f9e0000000000 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00000000 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000000, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0xff2f9e00 > OK > [S +0.032400] OK > ... > > [R +0.032495] writeq 0x9f0d000000002000 0x5c051a0100000000 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00000000 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000010, > CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 > [email protected]:usb_xhci_slot_enable slotid 1 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000020, > CR_ADDRESS_DEVICE, p 0x0000000000000000, s 0x00000000, c 0x00002e00 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000030, > CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 > [email protected]:usb_xhci_slot_enable slotid 2 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000040, > CR_ADDRESS_DEVICE, p 0x000000000001722e, s 0x00000000, c 0x01002e00 > [email protected]:usb_xhci_slot_address slotid 1, port 2 > [email protected]:usb_xhci_ep_enable slotid 1, epid 1 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000050, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0x5c051a01 > [email protected]:usb_xhci_ep_kick slotid 1, epid 1, streamid 23557 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340000, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > OK > [S +0.032563] OK > ... > > OK > [S +0.032643] OK > [R +0.032648] writeq 0x9f0d000000002000 0xff00010100400009 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00400009 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0xff000101 > [email protected]:usb_xhci_ep_kick slotid 1, epid 1, streamid 65280 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340010, TR_STATUS, > p 0x0000000000000000, s 0x00000000, c 0x00001300 > [email protected]:usb_xhci_xfer_start 0x611000045140: slotid 1, epid 1, > streamid 0 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340020, TR_SETUP, > p 0x0030000000000000, s 0x00000008, c 0x000008fe > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340030, TR_NORMAL, > p 0x5e00000000000000, s 0x00050000, c 0x00000500 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340040, TR_STATUS, > p 0x0000000000000000, s 0x00000000, c 0x00001300 > [email protected]:usb_xhci_xfer_start 0x611000045280: slotid 1, epid 1, > streamid 0 > [email protected]:usb_packet_state_change bus 0, port 2, ep 0, packet > 0x611000045288, state undef -> setup > ================================================================= > ==4760==ERROR: AddressSanitizer: heap-use-after-free on address > 0x625000341000 at pc 0x562d20cd6847 bp 0x7ffccc326780 sp 0x7ffccc325f48 > READ of size 48 at 0x625000341000 thread T0 > #0 0x562d20cd6846 in __asan_memcpy > (build/i386-softmmu/qemu-system-i386+0x250d846) > #1 0x562d22a6b374 in iov_to_buf_full util/iov.c:52:13 > #2 0x562d21ee5139 in iov_to_buf include/qemu/iov.h:62:16 > #3 0x562d21ee5139 in usb_packet_copy hw/usb/core.c:595:9 > #4 0x562d21ee96b4 in do_parameter hw/usb/core.c:284:9 > #5 0x562d21ee96b4 in usb_process_one hw/usb/core.c:369:13 > #6 0x562d21ee6ad8 in usb_handle_packet hw/usb/core.c:419:9 > #7 0x562d21f927b6 in xhci_kick_epctx hw/usb/hcd-xhci.c > #8 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #9 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 > #10 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #11 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #12 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #13 0x562d20d29e6b in flatview_write exec.c:3216:14 > #14 0x562d20d29e6b in address_space_write exec.c:3308:18 > #15 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #16 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #17 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #18 0x7f6b5673b897 in g_main_context_dispatch > (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) > #19 0x562d22a821b3 in glib_pollfds_poll util/main-loop.c:217:9 > #20 0x562d22a821b3 in os_host_main_loop_wait util/main-loop.c:240:5 > #21 0x562d22a821b3 in main_loop_wait util/main-loop.c:516:11 > #22 0x562d21340008 in qemu_main_loop softmmu/vl.c:1676:9 > #23 0x562d228b10fd in main softmmu/main.c:49:5 > > 0x625000341000 is located 0 bytes inside of 4096-byte region > [0x625000341000,0x625000342000) > freed by thread T0 here: > #0 0x562d20cd716d in free (build/i386-softmmu/qemu-system-i386+0x250e16d) > #1 0x562d22a02242 in qemu_vfree util/oslib-posix.c:247:5 > #2 0x562d20d2d019 in address_space_unmap exec.c:3637:5 > #3 0x562d21f09bbb in dma_memory_unmap include/sysemu/dma.h:145:5 > #4 0x562d21f09bbb in usb_packet_unmap hw/usb/libhw.c:65:9 > #5 0x562d21f0966f in usb_packet_map hw/usb/libhw.c:54:5 > #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 > #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 > #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 > #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #10 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 > #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #14 0x562d20d29e6b in flatview_write exec.c:3216:14 > #15 0x562d20d29e6b in address_space_write exec.c:3308:18 > #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #19 0x7f6b5673b897 in g_main_context_dispatch > > previously allocated by thread T0 here: > #0 0x562d20cd7ea7 in posix_memalign > (build/i386-softmmu/qemu-system-i386+0x250eea7) > #1 0x562d22a01995 in qemu_try_memalign util/oslib-posix.c:207:11 > #2 0x562d22a01d48 in qemu_memalign util/oslib-posix.c:223:27 > #3 0x562d20d2c8f0 in address_space_map exec.c:3586:25 > #4 0x562d21f093cb in dma_memory_map include/sysemu/dma.h:135:9 > #5 0x562d21f093cb in usb_packet_map hw/usb/libhw.c:39:19 > #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 > #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 > #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 > #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #10 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 > #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #14 0x562d20d29e6b in flatview_write exec.c:3216:14 > #15 0x562d20d29e6b in address_space_write exec.c:3308:18 > #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #19 0x7f6b5673b897 in g_main_context_dispatch > > -Alex > > ** Affects: qemu > Importance: Undecided > Status: New > > -- > You received this bug notification because you are a member of qemu- > devel-ml, which is subscribed to QEMU. > https://bugs.launchpad.net/bugs/1891341 > > Title: > Heap-use-after-free in usb_packet_copy through iov_to_buf > > Status in QEMU: > New > > Bug description: > Hello, > Reproducer: > > cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \ > -trace usb\* -device usb-audio -device usb-storage,drive=mydrive \ > -drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \ > -nodefaults -nographic -qtest stdio > outl 0xcf8 0x80001016 > outl 0xcfc 0x3c009f0d > outl 0xcf8 0x80001004 > outl 0xcfc 0xc77695e > writel 0x9f0d000000000040 0xffff3655 > writeq 0x9f0d000000002000 0xff2f9e0000000000 > write 0x1d 0x1 0x27 > write 0x2d 0x1 0x2e > write 0x17232 0x1 0x03 > write 0x17254 0x1 0x06 > write 0x17278 0x1 0x34 > write 0x3d 0x1 0x27 > write 0x40 0x1 0x2e > write 0x41 0x1 0x72 > write 0x42 0x1 0x01 > write 0x4d 0x1 0x2e > write 0x4f 0x1 0x01 > writeq 0x9f0d000000002000 0x5c051a0100000000 > write 0x34001d 0x1 0x13 > write 0x340026 0x1 0x30 > write 0x340028 0x1 0x08 > write 0x34002c 0x1 0xfe > write 0x34002d 0x1 0x08 > write 0x340037 0x1 0x5e > write 0x34003a 0x1 0x05 > write 0x34003d 0x1 0x05 > write 0x34004d 0x1 0x13 > writeq 0x9f0d000000002000 0xff00010100400009 > EOF > > > Abridged trace: > ... > [R +0.032356] writel 0x9f0d000000000040 0xffff3655 > [email protected]:usb_xhci_oper_write off 0x0000, val 0xffff3655 > [email protected]:usb_xhci_run > [email protected]:usb_xhci_irq_intx level 0 > OK > [S +0.032371] OK > [R +0.032376] writeq 0x9f0d000000002000 0xff2f9e0000000000 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00000000 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000000, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0xff2f9e00 > OK > [S +0.032400] OK > ... > > [R +0.032495] writeq 0x9f0d000000002000 0x5c051a0100000000 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00000000 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000010, > CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 > [email protected]:usb_xhci_slot_enable slotid 1 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000020, > CR_ADDRESS_DEVICE, p 0x0000000000000000, s 0x00000000, c 0x00002e00 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000030, > CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 > [email protected]:usb_xhci_slot_enable slotid 2 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000040, > CR_ADDRESS_DEVICE, p 0x000000000001722e, s 0x00000000, c 0x01002e00 > [email protected]:usb_xhci_slot_address slotid 1, port 2 > [email protected]:usb_xhci_ep_enable slotid 1, epid 1 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000000050, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0x5c051a01 > [email protected]:usb_xhci_ep_kick slotid 1, epid 1, streamid 23557 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340000, > TRB_RESERVED, p 0x0000000000000000, s 0x00000000, c 0x00000000 > OK > [S +0.032563] OK > ... > > OK > [S +0.032643] OK > [R +0.032648] writeq 0x9f0d000000002000 0xff00010100400009 > [email protected]:usb_xhci_doorbell_write off 0x0000, val 0x00400009 > [email protected]:usb_xhci_doorbell_write off 0x0004, val 0xff000101 > [email protected]:usb_xhci_ep_kick slotid 1, epid 1, streamid 65280 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340010, > TR_STATUS, p 0x0000000000000000, s 0x00000000, c 0x00001300 > [email protected]:usb_xhci_xfer_start 0x611000045140: slotid 1, epid > 1, streamid 0 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340020, > TR_SETUP, p 0x0030000000000000, s 0x00000008, c 0x000008fe > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340030, > TR_NORMAL, p 0x5e00000000000000, s 0x00050000, c 0x00000500 > [email protected]:usb_xhci_fetch_trb addr 0x0000000000340040, > TR_STATUS, p 0x0000000000000000, s 0x00000000, c 0x00001300 > [email protected]:usb_xhci_xfer_start 0x611000045280: slotid 1, epid > 1, streamid 0 > [email protected]:usb_packet_state_change bus 0, port 2, ep 0, packet > 0x611000045288, state undef -> setup > ================================================================= > ==4760==ERROR: AddressSanitizer: heap-use-after-free on address > 0x625000341000 at pc 0x562d20cd6847 bp 0x7ffccc326780 sp 0x7ffccc325f48 > READ of size 48 at 0x625000341000 thread T0 > #0 0x562d20cd6846 in __asan_memcpy > (build/i386-softmmu/qemu-system-i386+0x250d846) > #1 0x562d22a6b374 in iov_to_buf_full util/iov.c:52:13 > #2 0x562d21ee5139 in iov_to_buf include/qemu/iov.h:62:16 > #3 0x562d21ee5139 in usb_packet_copy hw/usb/core.c:595:9 > #4 0x562d21ee96b4 in do_parameter hw/usb/core.c:284:9 > #5 0x562d21ee96b4 in usb_process_one hw/usb/core.c:369:13 > #6 0x562d21ee6ad8 in usb_handle_packet hw/usb/core.c:419:9 > #7 0x562d21f927b6 in xhci_kick_epctx hw/usb/hcd-xhci.c > #8 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #9 0x562d212f1b8e in memory_region_write_accessor softmmu/memory.c:483:5 > #10 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #11 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #12 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #13 0x562d20d29e6b in flatview_write exec.c:3216:14 > #14 0x562d20d29e6b in address_space_write exec.c:3308:18 > #15 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #16 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #17 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #18 0x7f6b5673b897 in g_main_context_dispatch > (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4e897) > #19 0x562d22a821b3 in glib_pollfds_poll util/main-loop.c:217:9 > #20 0x562d22a821b3 in os_host_main_loop_wait util/main-loop.c:240:5 > #21 0x562d22a821b3 in main_loop_wait util/main-loop.c:516:11 > #22 0x562d21340008 in qemu_main_loop softmmu/vl.c:1676:9 > #23 0x562d228b10fd in main softmmu/main.c:49:5 > > 0x625000341000 is located 0 bytes inside of 4096-byte region > [0x625000341000,0x625000342000) > freed by thread T0 here: > #0 0x562d20cd716d in free > (build/i386-softmmu/qemu-system-i386+0x250e16d) > #1 0x562d22a02242 in qemu_vfree util/oslib-posix.c:247:5 > #2 0x562d20d2d019 in address_space_unmap exec.c:3637:5 > #3 0x562d21f09bbb in dma_memory_unmap include/sysemu/dma.h:145:5 > #4 0x562d21f09bbb in usb_packet_unmap hw/usb/libhw.c:65:9 > #5 0x562d21f0966f in usb_packet_map hw/usb/libhw.c:54:5 > #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 > #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 > #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 > #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #10 0x562d212f1b8e in memory_region_write_accessor > softmmu/memory.c:483:5 > #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #14 0x562d20d29e6b in flatview_write exec.c:3216:14 > #15 0x562d20d29e6b in address_space_write exec.c:3308:18 > #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #19 0x7f6b5673b897 in g_main_context_dispatch > > previously allocated by thread T0 here: > #0 0x562d20cd7ea7 in posix_memalign > (build/i386-softmmu/qemu-system-i386+0x250eea7) > #1 0x562d22a01995 in qemu_try_memalign util/oslib-posix.c:207:11 > #2 0x562d22a01d48 in qemu_memalign util/oslib-posix.c:223:27 > #3 0x562d20d2c8f0 in address_space_map exec.c:3586:25 > #4 0x562d21f093cb in dma_memory_map include/sysemu/dma.h:135:9 > #5 0x562d21f093cb in usb_packet_map hw/usb/libhw.c:39:19 > #6 0x562d21f985f1 in xhci_setup_packet hw/usb/hcd-xhci.c:1618:5 > #7 0x562d21f92143 in xhci_fire_ctl_transfer hw/usb/hcd-xhci.c:1722:9 > #8 0x562d21f92143 in xhci_kick_epctx hw/usb/hcd-xhci.c:1991:13 > #9 0x562d21fb337d in xhci_doorbell_write hw/usb/hcd-xhci.c:3162:13 > #10 0x562d212f1b8e in memory_region_write_accessor > softmmu/memory.c:483:5 > #11 0x562d212f158b in access_with_adjusted_size softmmu/memory.c:544:18 > #12 0x562d212f0d9b in memory_region_dispatch_write softmmu/memory.c > #13 0x562d20d344d2 in flatview_write_continue exec.c:3176:23 > #14 0x562d20d29e6b in flatview_write exec.c:3216:14 > #15 0x562d20d29e6b in address_space_write exec.c:3308:18 > #16 0x562d213322a9 in qtest_process_command softmmu/qtest.c:452:13 > #17 0x562d2132f087 in qtest_process_inbuf softmmu/qtest.c:710:9 > #18 0x562d22802293 in fd_chr_read chardev/char-fd.c:68:9 > #19 0x7f6b5673b897 in g_main_context_dispatch > > -Alex > > To manage notifications about this bug go to: > https://bugs.launchpad.net/qemu/+bug/1891341/+subscriptions >
