From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1KbdQB-0004gS-8R for qemu-devel@nongnu.org; Fri, 05 Sep 2008 11:40:27 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1KbdQ7-0004eZ-Dr for qemu-devel@nongnu.org; Fri, 05 Sep 2008 11:40:26 -0400 Received: from [199.232.76.173] (port=50904 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1KbdQ7-0004eW-41 for qemu-devel@nongnu.org; Fri, 05 Sep 2008 11:40:23 -0400 Received: from ipmail01.adl6.internode.on.net ([203.16.214.146]:12279) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1KbdQ6-000097-Cc for qemu-devel@nongnu.org; Fri, 05 Sep 2008 11:40:22 -0400 Date: Sat, 6 Sep 2008 01:40:13 +1000 From: Emil Mikulic Message-ID: <20080905154013.GA41045@dmr.ath.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] Stack smash in hw/eepro100.c Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Hi there, I've got qemu and kvm crashing when I try to scp data from a VM with -net nic,model=i82551. I believe the problem is here: (hw/eepro100.c, SVN r4892) 658 static void eepro100_cu_command(EEPRO100State * s, uint8_t val) [...] 723 uint8_t buf[MAX_ETH_FRAME_SIZE + 4]; [...] 745 /* Extended TCB. */ 746 assert(tcb_bytes == 0); 747 for (; tbd_count < 2; tbd_count++) { 748 uint32_t tx_buffer_address = ldl_phys(tbd_address); 749 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4); 750 uint16_t tx_buffer_el = lduw_phys(tbd_address + 6); 751 tbd_address += 8; 752 logout 753 ("TBD (extended mode): buffer address 0x%08x[...] 754 tx_buffer_address, tx_buffer_size); 755 cpu_physical_memory_read(tx_buffer_address, &buf[size], 756 tx_buffer_size); ^ KABOOM What happens is: - tbd_count=0, size=0, tx_buffer_size=130 - tbd_count=1, size=130, tx_buffer_size=1448 130 + 1448 = 1578 sizeof(buf) = 1518 I believe cpu_physical_memory_read() is writing past the end of buf[] and clobbering the call stack. I don't know what the right solution is here. For testing, I made buf[] larger and scp completed without incident instead of crashing qemu after a few KB. e.g.: - uint8_t buf[MAX_ETH_FRAME_SIZE + 4]; + uint8_t buf[MAX_ETH_FRAME_SIZE + 1000]; --Emil