Memcpy param-overlap through e1000e_write_to_rx_buffers
This was originally reported at: https://bugs.launchpad.net/qemu/+bug/1878034
Hello,
Reproducer
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
512M -M q35 -nodefaults -device e1000e,netdev=net0 -netdev user,id=net0 \
-qtest /dev/null -qtest stdio
outl 0xcf8 0x80000811
outl 0xcfc 0x5ac600
outl 0xcf8 0x80000801
outl 0xcfc 0x06000000
write 0x5ac60100 0x4 0x56000302
write 0x5ac6011a 0x2 0x0106
write 0x5ac60120 0x1 0x25
write 0x5ac6042a 0x2 0x0248
write 0x5ac60431 0x1 0x04
write 0x4240 0x1 0xff
write 0x4241 0x1 0x01
write 0x4249 0x1 0xf5
write 0x1ff 0x1 0x01
write 0x5ac60403 0x1 0x02
write 0x5ac6043a 0x2 0x2800
write 0x5ac60112 0x2 0xf090
write 0x5ac60430 0x1 0x00
write 0x239 0x1 0xff
write 0x23b 0x1 0x01
write 0x9531 0x1 0xff
write 0x9532 0x1 0xff
write 0x9533 0x1 0xff
write 0x9534 0x1 0xff
write 0x9535 0x1 0xff
write 0x9536 0x1 0xff
write 0x9537 0x1 0xff
write 0x5ac60403 0x1 0x02
EOF
Stack-Trace
==206034==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7fa00a400000,0x7fa00a400300) and [0x7fa00a4002ff, 0x7fa00a4005ff) overlap
#0 0x55761f410624 in __asan_memcpy (system-i386+0x227d624)
#1 0x557620b35c37 in flatview_write_continue ../softmmu/physmem.c:2782:13
#2 0x557620b2d995 in flatview_write ../softmmu/physmem.c:2817:14
#3 0x557620b2d995 in address_space_write ../softmmu/physmem.c:2909:18
#4 0x55761fc56170 in dma_memory_rw_relaxed include/sysemu/dma.h:88:12
#5 0x55761fc56170 in dma_memory_rw include/sysemu/dma.h:127:12
#6 0x55761fc56170 in pci_dma_rw include/hw/pci/pci.h:806:12
#7 0x55761fc56170 in pci_dma_write include/hw/pci/pci.h:842:12
#8 0x55761fc56170 in e1000e_write_to_rx_buffers ../hw/net/e1000e_core.c:1404:9
#9 0x55761fc42650 in e1000e_write_packet_to_guest ../hw/net/e1000e_core.c:1574:21
#10 0x55761fc42650 in e1000e_receive_iov ../hw/net/e1000e_core.c:1701:9
#11 0x55761ff801be in qemu_deliver_packet_iov ../net/net.c:762:15
#12 0x55761fcbf245 in qemu_net_queue_deliver_iov ../net/queue.c:179:11
#13 0x5576200092bf in net_tx_pkt_sendv ../hw/net/net_tx_pkt.c:558:9
#14 0x5576200092bf in net_tx_pkt_send ../hw/net/net_tx_pkt.c:635:9
#15 0x55762000a374 in net_tx_pkt_send_loopback ../hw/net/net_tx_pkt.c:648:11
#16 0x55761fc726ec in e1000e_tx_pkt_send ../hw/net/e1000e_core.c:657:16
#17 0x55761fc726ec in e1000e_process_tx_desc ../hw/net/e1000e_core.c:736:17
#18 0x55761fc726ec in e1000e_start_xmit ../hw/net/e1000e_core.c:927:9
#19 0x55761fc699f3 in e1000e_set_tctl ../hw/net/e1000e_core.c:2422:9
#20 0x55761fc4b03e in e1000e_core_write ../hw/net/e1000e_core.c:3254:9
#21 0x5576209cff75 in memory_region_write_accessor ../softmmu/memory.c:492:5
#22 0x5576209cfa9a in access_with_adjusted_size ../softmmu/memory.c:554:18
#23 0x5576209cf55f in memory_region_dispatch_write ../softmmu/memory.c
#24 0x557620b35e26 in flatview_write_continue ../softmmu/physmem.c:2777:23
#25 0x557620b2d995 in flatview_write ../softmmu/physmem.c:2817:14
#26 0x557620b2d995 in address_space_write ../softmmu/physmem.c:2909:18
#27 0x557620a680cf in qtest_process_command ../softmmu/qtest.c:670:9
#28 0x557620a63b58 in qtest_process_inbuf ../softmmu/qtest.c:813:9
#29 0x557620c0ae14 in fd_chr_read ../chardev/char-fd.c:73:9
#30 0x7fa03257dd6e in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51d6e)
#31 0x55762126a053 in glib_pollfds_poll ../util/main-loop.c:232:9
#32 0x55762126a053 in os_host_main_loop_wait ../util/main-loop.c:255:5
#33 0x55762126a053 in main_loop_wait ../util/main-loop.c:531:11
#34 0x5576208d50c6 in qemu_main_loop ../softmmu/runstate.c:726:9
#35 0x55761f44385a in main ../softmmu/main.c:50:5
#36 0x7fa030cdcd09 in __libc_start_main csu/../csu/libc-start.c:308:16
#37 0x55761f397259 in _start (system-i386+0x2204259)
OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29586
libqtest Reproducer: 1878034.c
Thank you
Edited by Alexander Bulekov