From nobody Sat May 4 00:05:53 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1590409451; cv=none; d=zohomail.com; s=zohoarc; b=OFCbEjzX9sFZ+dD0+p4pAngddfRYvHthNp7rDUUICKqQk+cfagRBo9DBLrdYkHwMCgPLZpE1JrfnqHWMS9g6ZFLHaxnxDkHsetnW2l6Da8thakbhAZfvEm6wzgV6acbOYgPbQNEVHVcNMM1FrQlNWYttwM6g0LmKv0X3qzQwz9U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1590409451; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=hxVdAqRBN33zJYNq1JPS0/5+xi8GLpRW0Exzc9/Ood4=; b=D/pUXpYXZx7Qfemm+lcZ6DdjIHcbzasCu7+kHUAxHBG7rnzANaMqJWr9zijLDGaPfOCNEqDncZmPP9sXYbb7HPVG3TAzbIqSbDeYw8jUjxdQ8/h9Nxqm7oc34Hw65iQnupbFYg0AlD8TDuSefSRaOO1wZ9cUCJpqlphnA0LF4fs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1590409450977314.94807235065593; Mon, 25 May 2020 05:24:10 -0700 (PDT) Received: from localhost ([::1]:34656 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jdC9J-0002Jd-NK for importer@patchew.org; Mon, 25 May 2020 08:24:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:36462) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jdC8l-0001uo-FE for qemu-devel@nongnu.org; Mon, 25 May 2020 08:23:35 -0400 Received: from mail-wm1-x341.google.com ([2a00:1450:4864:20::341]:50294) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jdC8k-0003OV-LI for qemu-devel@nongnu.org; Mon, 25 May 2020 08:23:35 -0400 Received: by mail-wm1-x341.google.com with SMTP id v19so9311330wmj.0 for ; Mon, 25 May 2020 05:23:34 -0700 (PDT) Received: from localhost.localdomain (71.red-88-21-204.staticip.rima-tde.net. [88.21.204.71]) by smtp.gmail.com with ESMTPSA id k131sm19114473wma.2.2020.05.25.05.23.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2020 05:23:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=hxVdAqRBN33zJYNq1JPS0/5+xi8GLpRW0Exzc9/Ood4=; b=P1wi9erUO4QFO/s7Xg2V9tR8OUOjzauCQ41muzeOEcoYk4T2yKDcJpNbiiCRFxtEDa jDHLIzbCaQzhPxJktcuFbCU9E1y2QxolvNiTJDB3lXpQZq7x4s99f7bpRocZMO/oms1/ x7vfDDIhmajB7y3zsyn37Afv2PAraSQxsbRYdJ2yG4oOAaIY7kaoMrqAnZUB6vHjbX+P uV/G0/SGT6iDCNgR7Vjd1I6k2zuaQDzXW6QHg+wKivKBhQ45roo0RosmiWz1t6hSFQsC qqIpzA1h+RkMX/DSveak1YvgmMr86CwXW1YnkgJnCwm9gRqXTYp0e+F5b90OOuc1JxDW H90Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :mime-version:content-transfer-encoding; bh=hxVdAqRBN33zJYNq1JPS0/5+xi8GLpRW0Exzc9/Ood4=; b=Mc9S304hN29sxrnxCTR2FbvYI+USfIUTskmQgRFl+xDa8Da+Bd5JR+EwoOib3QMYdE CtWcrqno9ROin7fhzN9Ct5xtBSFPSA83Cq9pZ9wS4oio/pgxd7fXutXWBja+Ho8d69If mycnB9X67pnlrvzS6xY27GFSQVfL0ysHOrqFOA2FmY1G495izfOVcoG+TP5T5CzR2wrp hHHKopckINMqGwM0aohgBwf9x4/BI5dxp1rBoK263/j30P788Bz4PT9aHjzP3noxcN+v iWFxh3597P68DsvDm+NGw93fd2WZehXnTvrG0Qj2S9/j1fs9GDG7O93lksH0XQVeYYQO oOaw== X-Gm-Message-State: AOAM532/B4nGWcqKEEcv2v9wrHoRoTUJCxstLvcz8w/nbcU1zDSb2Q5c J44KJrFmvu4fPc3XhDCGYI/2IfY4fBI= X-Google-Smtp-Source: ABdhPJzDwYL456y0qDdR6qkVKbhjmrB3bPAHXfm5fjwKp+UTpx5tUQxDbYv+uREfPgld2SQsjXAwgg== X-Received: by 2002:a7b:c750:: with SMTP id w16mr26777762wmk.73.1590409412511; Mon, 25 May 2020 05:23:32 -0700 (PDT) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Subject: [RFC PATCH] hw/net/e1000e: Do not abort() on invalid PSRCTL register value Date: Mon, 25 May 2020 14:23:30 +0200 Message-Id: <20200525122330.3691-1-f4bug@amsat.org> X-Mailer: git-send-email 2.21.3 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:20::341; envelope-from=philippe.mathieu.daude@gmail.com; helo=mail-wm1-x341.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -16 X-Spam_score: -1.7 X-Spam_bar: - X-Spam_report: (-1.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Dmitry Fleytman , "Michael S . Tsirkin" , Jason Wang , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) libFuzzer found using 'qemu-system-i386 -M q35': qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero CPU #0: EAX=3D00000000 EBX=3D00000000 ECX=3D00000000 EDX=3D00000663 ESI=3D00000000 EDI=3D00000000 EBP=3D00000000 ESP=3D00000000 EIP=3D0000fff0 EFL=3D00000002 [-------] CPL=3D0 II=3D0 A20=3D1 SMM=3D0 HLT= =3D0 ES =3D0000 00000000 0000ffff 00009300 CS =3Df000 ffff0000 0000ffff 00009b00 SS =3D0000 00000000 0000ffff 00009300 DS =3D0000 00000000 0000ffff 00009300 FS =3D0000 00000000 0000ffff 00009300 GS =3D0000 00000000 0000ffff 00009300 LDT=3D0000 00000000 0000ffff 00008200 TR =3D0000 00000000 0000ffff 00008b00 GDT=3D 00000000 0000ffff IDT=3D 00000000 0000ffff CR0=3D60000010 CR2=3D00000000 CR3=3D00000000 CR4=3D00000000 DR0=3D00000000 DR1=3D00000000 DR2=3D00000000 DR3=3D00000000 DR6=3Dffff0ff0 DR7=3D00000400 EFER=3D0000000000000000 FCW=3D037f FSW=3D0000 [ST=3D0] FTW=3D00 MXCSR=3D00001f80 FPR0=3D0000000000000000 0000 FPR1=3D0000000000000000 0000 FPR2=3D0000000000000000 0000 FPR3=3D0000000000000000 0000 FPR4=3D0000000000000000 0000 FPR5=3D0000000000000000 0000 FPR6=3D0000000000000000 0000 FPR7=3D0000000000000000 0000 XMM00=3D00000000000000000000000000000000 XMM01=3D00000000000000000000000000= 000000 XMM02=3D00000000000000000000000000000000 XMM03=3D00000000000000000000000000= 000000 XMM04=3D00000000000000000000000000000000 XMM05=3D00000000000000000000000000= 000000 XMM06=3D00000000000000000000000000000000 XMM07=3D00000000000000000000000000= 000000 =3D=3D1988=3D=3D ERROR: libFuzzer: deadly signal #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894) #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d) #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2) #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f) #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46) #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xec= d0a7) #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc1= 3) #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xec= b7b4) It simply sent the following 2 I/O command to the e1000e PCI BAR #2 I/O region: writew 0x0100 0x0c00 # RCTL =3D E1000_RCTL_DTYP_MASK writeb 0x2170 0x00 # PSRCTL =3D 0 2813 static void 2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val) 2815 { 2816 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) { 2817 2818 if ((val & E1000_PSRCTL_BSIZE0_MASK) =3D=3D 0) { 2819 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero"); 2820 } Instead of calling hw_error() which abort the process (it is meant for CPU fatal error condition, not for device logging), log the invalid request with qemu_log_mask(LOG_GUEST_ERROR) and return ignoring the request. Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- RFC because there might be something clever than returning... Probably worth a Cc:qemu-stable@ tag --- hw/net/e1000e_core.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c index d5676871fa..bcd186cac5 100644 --- a/hw/net/e1000e_core.c +++ b/hw/net/e1000e_core.c @@ -34,9 +34,9 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/log.h" #include "net/net.h" #include "net/tap.h" -#include "hw/hw.h" #include "hw/pci/msi.h" #include "hw/pci/msix.h" #include "sysemu/runstate.h" @@ -2816,11 +2816,15 @@ e1000e_set_psrctl(E1000ECore *core, int index, uint= 32_t val) if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) { =20 if ((val & E1000_PSRCTL_BSIZE0_MASK) =3D=3D 0) { - hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero"); + qemu_log_mask(LOG_GUEST_ERROR, + "e1000e: PSRCTL.BSIZE0 cannot be zero"); + return; } =20 if ((val & E1000_PSRCTL_BSIZE1_MASK) =3D=3D 0) { - hw_error("e1000e: PSRCTL.BSIZE1 cannot be zero"); + qemu_log_mask(LOG_GUEST_ERROR, + "e1000e: PSRCTL.BSIZE1 cannot be zero"); + return; } } =20 --=20 2.21.3