From: John Snow <jsnow@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>, qemu-devel@nongnu.org
Cc: "Alexander Bulekov" <alxndr@bu.edu>,
"John Snow" <jsnow@redhat.com>,
"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
qemu-block@nongnu.org, qemu-stable@nongnu.org
Subject: [PULL 2/9] hw/ide/ahci: Do not dma_memory_unmap(NULL)
Date: Thu, 1 Oct 2020 13:46:42 -0400 [thread overview]
Message-ID: <20201001174649.1911016-3-jsnow@redhat.com> (raw)
In-Reply-To: <20201001174649.1911016-1-jsnow@redhat.com>
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
libFuzzer triggered the following assertion:
cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
-nographic -monitor none -serial none -qtest stdio
outl 0xcf8 0x8000fa24
outl 0xcfc 0xe1068000
outl 0xcf8 0x8000fa04
outw 0xcfc 0x7
outl 0xcf8 0x8000fb20
write 0xe1068304 0x1 0x21
write 0xe1068318 0x1 0x21
write 0xe1068384 0x1 0x21
write 0xe1068398 0x2 0x21
EOF
qemu-system-i386: exec.c:3621: address_space_unmap: Assertion `mr != NULL' failed.
Aborted (core dumped)
This is because we don't check the return value from dma_memory_map()
which can return NULL, then we call dma_memory_unmap(NULL) which is
illegal. Fix by only unmap if the value is not NULL (and the size is
not the expected one).
Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200718072854.7001-1-f4bug@amsat.org
Fixes: f6ad2e32f8 ("ahci: add ahci emulation")
BugLink: https://bugs.launchpad.net/qemu/+bug/1884693
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
---
hw/ide/ahci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index ee1d47ff756..680304a24c3 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -250,7 +250,7 @@ static void map_page(AddressSpace *as, uint8_t **ptr, uint64_t addr,
}
*ptr = dma_memory_map(as, addr, &len, DMA_DIRECTION_FROM_DEVICE);
- if (len < wanted) {
+ if (len < wanted && *ptr) {
dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
*ptr = NULL;
}
--
2.26.2
next prev parent reply other threads:[~2020-10-01 18:00 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 17:46 [PULL 0/9] Ide patches John Snow
2020-10-01 17:46 ` [PULL 1/9] MAINTAINERS: Update my git address John Snow
2020-10-01 17:46 ` John Snow [this message]
2020-10-01 17:46 ` [PULL 3/9] ide: rename cmd_write to ctrl_write John Snow
2020-10-01 17:46 ` [PULL 4/9] ide: don't tamper with the device register John Snow
2020-10-01 17:46 ` [PULL 5/9] ide: model HOB correctly John Snow
2020-10-01 17:46 ` [PULL 6/9] ide: reorder set/get sector functions John Snow
2020-10-01 17:46 ` [PULL 7/9] ide: remove magic constants from the device register John Snow
2020-10-01 17:46 ` [PULL 8/9] ide: clear interrupt on command write John Snow
2020-10-01 17:46 ` [PULL 9/9] ide: cancel pending callbacks on SRST John Snow
2020-10-01 20:43 ` [PULL 0/9] Ide patches Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201001174649.1911016-3-jsnow@redhat.com \
--to=jsnow@redhat.com \
--cc=alxndr@bu.edu \
--cc=f4bug@amsat.org \
--cc=peter.maydell@linaro.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).