Go to file
Philippe Mathieu-Daudé 7d6a4f123e net/eth: Read ip6_ext_hdr_routing buffer before accessing it
We can't know the caller read enough data in the memory pointed
by ext_hdr to cast it as a ip6_ext_hdr_routing.
Declare rt_hdr on the stack and fill it again from the iovec.

Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
by QEMU fuzzer:

  $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5

  Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486

    This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING

Add the corresponding qtest case with the fuzzer reproducer.

FWIW GCC 11 similarly reported:

  net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Fixes: eb700029c7 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-22 17:34:31 +08:00
.github .github: point Repo Lockdown bot to GitLab repo 2021-02-09 20:53:56 +00:00
.gitlab-ci.d docker: OpenSBI build job depends on OpenSBI container 2021-03-09 06:03:53 +01:00
accel Revert "accel: kvm: Add aligment assert for kvm_log_clear_one_slot" 2021-03-16 14:30:30 -04:00
audio coreaudio: Handle output device change 2021-03-16 07:17:50 +01:00
authz authz-simple: Check that 'identity' property is set 2020-11-18 10:51:35 +00:00
backends backends/dbus-vmstate: Fix short read error handling 2021-03-09 21:41:04 +01:00
block block/export: disable VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD for now 2021-03-19 10:15:06 +01:00
bsd-user exec: Use cpu_untagged_addr in g2h; split out g2h_untagged 2021-02-16 11:04:53 +00:00
capstone@f8b1b83301 capstone: Update to upstream "next" branch 2020-10-03 04:23:14 -05:00
chardev char: Simplify chardev_name_foreach() 2021-03-19 10:18:17 +01:00
contrib plugins: Expose physical addresses instead of device offsets 2021-03-17 07:17:46 +00:00
crypto crypto: Add spaces around operator 2021-01-29 17:07:53 +00:00
default-configs m68k: add Virtual M68k Machine 2021-03-15 21:03:06 +01:00
disas tcg/tci: Implement the disassembler properly 2021-03-17 07:24:44 -06:00
docs * fixes for i386 TCG paging 2021-03-19 18:01:17 +00:00
dtc@85e5d83984 Makefile: dtc: update, build the libfdt target 2020-06-16 14:49:05 +01:00
dump qapi: More complex uses of QAPI_LIST_APPEND 2021-01-28 08:08:45 +01:00
fpu softfloat: Define misc operations for bfloat16 2020-08-28 10:48:07 -07:00
fsdev meson: Declare have_virtfs_proxy_helper in main meson.build 2021-01-23 15:55:04 -05:00
gdb-xml target/riscv: Remove built-in GDB XML files for CSRs 2021-01-16 10:57:21 -08:00
hw hw/net: virtio-net: Initialize nc->do_not_pad to true 2021-03-22 17:34:31 +08:00
include net: Add a 'do_not_pad" to NetClientState 2021-03-22 17:34:31 +08:00
io io: error_prepend() in qio_channel_readv_full_all() causes segfault 2021-02-12 07:50:59 -06:00
libdecnumber qemu/: fix some comment spelling errors 2020-09-17 20:35:43 +02:00
linux-headers Update linux headers to 5.11-rc2 2021-01-21 11:19:45 +01:00
linux-user linux-user/elfload: fix address calculation in fallback scenario 2021-03-13 10:45:11 +01:00
meson@776acd2a80 submodules: bump meson to 0.55.3 2020-10-17 10:45:42 -04:00
migration migrate: remove QMP/HMP commands for speed, downtime and cache size 2021-03-18 09:22:55 +00:00
monitor qapi: Implement deprecated-output=hide for QMP introspection 2021-03-19 16:05:11 +01:00
nbd nbd: server: Report holes for raw images 2021-03-08 13:08:45 -06:00
net net/eth: Read ip6_ext_hdr_routing buffer before accessing it 2021-03-22 17:34:31 +08:00
pc-bios Update OpenBIOS images to 4a004110 built from submodule. 2021-03-16 20:03:00 +00:00
plugins plugins: getting qemu_plugin_get_hwaddr only expose one function prototype 2021-03-17 07:17:46 +00:00
po configure: move gettext detection to meson.build 2021-01-02 21:03:09 +01:00
python Python: close the log file kept by QEMUMachine before reading it 2021-02-15 21:40:16 -05:00
qapi qapi: New -compat deprecated-input=crash 2021-03-19 16:05:11 +01:00
qga qga: return a more explicit error on why a command is disabled 2021-03-16 20:21:47 -05:00
qobject qobject: braces {} are necessary for all arms of this statement 2021-02-04 13:20:29 +01:00
qom * fixes for i386 TCG paging 2021-03-19 18:01:17 +00:00
replay replay: fix icount request when replaying clock access 2021-02-16 17:15:39 +01:00
roms Update OpenBIOS images to 4a004110 built from submodule. 2021-03-16 20:03:00 +00:00
scripts qapi: Implement deprecated-input=reject for QMP command arguments 2021-03-19 16:05:11 +01:00
scsi scsi: fix sense code for EREMOTEIO 2021-03-16 14:30:30 -04:00
semihosting semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00
slirp@8f43a99191 slirp: update to fix CVE-2020-29129 CVE-2020-29130 2020-11-27 20:57:11 +04:00
softmmu QAPI patches patches for 2021-03-16 2021-03-19 16:40:00 +00:00
storage-daemon monitor: Drop query-qmp-schema 'gen': false hack 2021-03-19 16:05:09 +01:00
stubs qemuutil: remove qemu_set_fd_handler duplicate symbol 2021-03-19 15:43:33 +01:00
subprojects/libvhost-user build-sys: add libvhost-user missing dependencies 2021-01-23 09:26:41 -05:00
target i386: Make migration fail when Hyper-V reenlightenment was enabled but 'user_tsc_khz' is unset 2021-03-19 08:48:18 -04:00
tcg tcg: Fix prototypes for tcg_out_vec_op and tcg_out_op 2021-03-17 09:04:45 -06:00
tests net/eth: Read ip6_ext_hdr_routing buffer before accessing it 2021-03-22 17:34:31 +08:00
tools virtiofsd: Convert some functions to return bool 2021-03-15 20:01:55 +00:00
trace trace: fix "-trace file=..." 2021-03-06 11:42:57 +01:00
ui ui, monitor: remove deprecated VNC ACL option and HMP commands 2021-03-18 09:22:55 +00:00
util utils: Use fixed-point arithmetic in qemu_strtosz 2021-03-17 07:16:59 +00:00
.cirrus.yml cirrus/msys2: Cache msys2 mingw in a better way. 2021-01-12 12:38:03 +01:00
.dir-locals.el Add .dir-locals.el file to configure emacs coding style 2015-10-08 19:46:01 +03:00
.editorconfig .editorconfig: update the automatic mode setting for Emacs 2021-03-10 15:34:11 +00:00
.exrc qemu: add .exrc 2012-09-07 09:02:44 +03:00
.gdbinit .gdbinit: load QEMU sub-commands when gdb starts 2017-06-07 14:38:45 +01:00
.gitattributes maint: Tell git that *.py files should use python diff hunks 2021-02-15 22:13:34 -05:00
.gitignore Makefile: add GNU global tags support 2021-01-18 10:04:31 +00:00
.gitlab-ci.yml * Move unit and bench tests into separate directories 2021-03-14 15:13:53 +00:00
.gitmodules gitmodules: use GitLab repos instead of qemu.org 2021-02-09 20:53:56 +00:00
.gitpublish Add a git-publish configuration file 2018-03-05 09:03:17 +00:00
.mailmap MAINTAINERS: chenhc@lemote.com -> chenhuacai@kernel.org 2020-12-13 16:00:58 +01:00
.patchew.yml ci: store Patchew configuration in the tree 2019-06-03 14:03:02 +02:00
.readthedocs.yml readthedocs: build with Python 3.6 2020-10-05 16:30:45 +01:00
.travis.yml travis.yml: Limit simultaneous jobs to 3 2021-02-19 06:31:40 +01:00
COPYING
COPYING.LIB COPYING.LIB: Synchronize the LGPL 2.1 with the version from gnu.org 2019-01-30 11:01:22 +01:00
Kconfig semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00
Kconfig.host multi-process: Add config option for multi-process QEMU 2021-02-09 20:53:56 +00:00
LICENSE tcg/LICENSE: Remove out of date claim about TCG subdirectory licensing 2019-11-11 15:11:21 +01:00
MAINTAINERS net/eth: Read ip6_ext_hdr_routing buffer before accessing it 2021-03-22 17:34:31 +08:00
Makefile build-sys: invoke ninja with -d keepdepfile 2021-03-06 11:42:57 +01:00
README.rst README: Add Documentation blurb 2021-03-12 15:46:30 +01:00
VERSION Open 6.0 development tree 2020-12-08 21:04:57 +00:00
block.c block: remove format defaults from QemuOpts in bdrv_create_file() 2021-03-19 10:15:06 +01:00
blockdev-nbd.c qemu-nbd: Use SOMAXCONN for socket listen() backlog 2021-02-12 07:42:08 -06:00
blockdev.c blockdev: Drop deprecated bogus -drive interface type 2021-03-19 15:18:43 +01:00
blockjob.c nbd patches for 2021-03-09 2021-03-11 13:57:08 +00:00
configure configure: add option to explicitly enable/disable libgio 2021-03-16 14:30:30 -04:00
cpu.c accel/tcg: split TCG-only code from cpu_exec_realizefn 2021-02-05 10:24:14 -10:00
cpus-common.c overall/alpha tcg cpus|hppa: Fix Lesser GPL version number 2020-11-15 16:43:54 +01:00
disas.c disas: Push const down through host disassembly 2021-01-07 05:09:42 -10:00
exec-vary.c nomaintainer: Fix Lesser GPL version number 2020-11-15 17:04:40 +01:00
gdbstub.c Pull request 2021-03-11 18:55:27 +00:00
gitdm.config contrib: gitdm: add a mapping for Janus Technologies 2019-03-12 19:31:29 +00:00
hmp-commands-info.hx migrate: remove QMP/HMP commands for speed, downtime and cache size 2021-03-18 09:22:55 +00:00
hmp-commands.hx hmp: QAPIfy object_add 2021-03-19 10:17:14 +01:00
iothread.c multi-process: define MPQemuMsg format and transmission functions 2021-02-10 09:23:28 +00:00
job-qmp.c qapi: Use QAPI_LIST_APPEND in trivial cases 2021-01-28 08:08:45 +01:00
job.c job: add .cancel handler for the driver 2021-02-12 11:23:19 -06:00
memory_ldst.c.inc fuzz: ignore address_space_map is_write flag 2021-02-08 14:43:54 +01:00
meson.build tcg/tci: Implement the disassembler properly 2021-03-17 07:24:44 -06:00
meson_options.txt multiprocess: move feature to meson_options.txt 2021-02-25 14:14:32 +01:00
module-common.c all: Clean up includes 2016-02-04 17:41:30 +00:00
os-posix.c os: deprecate the -enable-fips option and QEMU's FIPS enforcement 2021-01-29 17:07:53 +00:00
os-win32.c vl: relocate paths to data directories 2020-09-30 19:11:36 +02:00
qemu-bridge-helper.c qemu-bridge-helper: relocate path to default ACL 2020-09-30 19:11:36 +02:00
qemu-edid.c qemu-edid: drop cast 2020-10-14 06:05:56 +02:00
qemu-img-cmds.hx qemu-img: add support for rate limit in qemu-img convert 2020-10-27 15:26:20 +01:00
qemu-img.c qemu-img: Use user_creatable_process_cmdline() for --object 2021-03-19 10:17:14 +01:00
qemu-io-cmds.c qemu-io: add preallocate mode parameter for truncate command 2020-12-18 12:35:55 +01:00
qemu-io.c qemu-io: Use user_creatable_process_cmdline() for --object 2021-03-19 10:17:14 +01:00
qemu-keymap.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
qemu-nbd.c qemu-nbd: Use user_creatable_process_cmdline() for --object 2021-03-19 10:17:14 +01:00
qemu-options-wrapper.h qemu-img: remove references to GEN_DOCS 2018-05-20 08:35:54 +03:00
qemu-options.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
qemu-options.hx qapi: New -compat deprecated-input=crash 2021-03-19 16:05:11 +01:00
qemu.nsi nsis: adjust for new MinGW paths 2021-01-23 15:55:05 -05:00
qemu.sasl Default to GSSAPI (Kerberos) instead of DIGEST-MD5 for SASL 2017-05-09 14:41:47 +01:00
replication.c replication: Introduce new APIs to do replication operation 2016-09-13 11:00:56 +01:00
replication.h Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
thunk.c overall usermode...: Fix Lesser GPL version number 2020-11-15 16:43:40 +01:00
trace-events trace-events: Fix attribution of trace points to source 2020-09-09 17:17:58 +01:00
version.rc configure: remove CONFIG_FILEVERSION and CONFIG_PRODUCTVERSION 2021-01-02 21:03:37 +01:00

README.rst

===========
QEMU README
===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Documentation
=============

Documentation can be found hosted online at
`<https://www.qemu.org/documentation/>`_. The documentation for the
current development version that is available at
`<https://www.qemu.org/docs/master/>`_ is generated from the ``docs/``
folder in the source tree, and is built by `Sphinx
<https://www.sphinx-doc.org/en/master/>_`.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:


.. code-block:: shell

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

* `<https://qemu.org/Hosts/Linux>`_
* `<https://qemu.org/Hosts/Mac>`_
* `<https://qemu.org/Hosts/W32>`_


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

.. code-block:: shell

   git clone https://gitlab.com/qemu-project/qemu.git

When submitting patches, one common approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the `style section
<https://www.qemu.org/docs/master/devel/style.html>` of
the Developers Guide.

Additional information on submitting patches can be found online via
the QEMU website

* `<https://qemu.org/Contribute/SubmitAPatch>`_
* `<https://qemu.org/Contribute/TrivialPatches>`_

The QEMU website is also maintained under source control.

.. code-block:: shell

  git clone https://gitlab.com/qemu-project/qemu-web.git

* `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_

A 'git-publish' utility was created to make above process less
cumbersome, and is highly recommended for making regular contributions,
or even just for sending consecutive patch series revisions. It also
requires a working 'git send-email' setup, and by default doesn't
automate everything, so you may want to go through the above steps
manually for once.

For installation instructions, please go to

*  `<https://github.com/stefanha/git-publish>`_

The workflow with 'git-publish' is:

.. code-block:: shell

  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish

Your patch series will be sent and tagged as my-feature-v1 if you need to refer
back to it in the future.

Sending v2:

.. code-block:: shell

  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish

Your patch series will be sent with 'v2' tag in the subject and the git tip
will be tagged as my-feature-v2.

Bug reporting
=============

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

* `<https://bugs.launchpad.net/qemu/>`_

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via launchpad.

For additional information on bug reporting consult:

* `<https://qemu.org/Contribute/ReportABug>`_


ChangeLog
=========

For version history and release notes, please visit
`<https://wiki.qemu.org/ChangeLog/>`_ or look at the git history for
more detailed information.


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

* `<mailto:qemu-devel@nongnu.org>`_
* `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
* #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

* `<https://qemu.org/Contribute/StartHere>`_