Hello Samuel,
+-- On Wed, 23 Aug 2017, Samuel Thibault wrote --+
| The paste is not available any more. Is it really very large? It's usually
| really better to just send it by mail, so it's archived in the mailing list
| etc.
Yes, stack-trace was quite long.
===
==2704==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400001018c
at pc 0x003921ea145d bp 0x7fd49c4fc940 sp 0x7fd49c4fc930
READ of size 4 at 0x61400001018c thread T2
#0 0x3921ea145c in if_start slirp/if.c:230
#1 0x3921ea1015 in if_output slirp/if.c:141
#2 0x3921eadf1f in ip_output slirp/ip_output.c:85
#3 0x3921ed229e in tcp_respond slirp/tcp_subr.c:218
#4 0x3921ecc959 in tcp_input slirp/tcp_input.c:1392
#5 0x3921eab799 in ip_input slirp/ip_input.c:206
#6 0x3921eb6529 in slirp_input slirp/slirp.c:872
#7 0x3921e7c56f in net_slirp_receive net/slirp.c:119
#8 0x3921e60fe0 in nc_sendv_compat net/net.c:707
#9 0x3921e61170 in qemu_deliver_packet_iov net/net.c:734
#10 0x3921e67c53 in qemu_net_queue_deliver_iov net/queue.c:179
#11 0x3921e67e5b in qemu_net_queue_send_iov net/queue.c:224
#12 0x3921e61395 in qemu_sendv_packet_async net/net.c:770
#13 0x3921e613c2 in qemu_sendv_packet net/net.c:778
#14 0x3921e6961e in net_hub_receive_iov net/hub.c:72
#15 0x3921e69c12 in net_hub_port_receive_iov net/hub.c:123
#16 0x3921e61155 in qemu_deliver_packet_iov net/net.c:732
#17 0x3921e67ae7 in qemu_net_queue_deliver net/queue.c:164
#18 0x3921e67d59 in qemu_net_queue_send net/queue.c:199
#19 0x3921e60d58 in qemu_send_packet_async_with_flags net/net.c:661
#20 0x3921e60d90 in qemu_send_packet_async net/net.c:668
#21 0x3921e60dbd in qemu_send_packet net/net.c:674
#22 0x3921bef076 in ne2000_ioport_write hw/net/ne2000.c:302
#23 0x3921bf07c4 in ne2000_write hw/net/ne2000.c:688
#24 0x3921668a95 in memory_region_write_accessor
/home/test/qemu/memory.c:529
#25 0x3921668d6e in access_with_adjusted_size /home/test/qemu/memory.c:595
#26 0x392166f4ca in memory_region_dispatch_write
/home/test/qemu/memory.c:1337
#27 0x39215c633c in address_space_write_continue /home/test/qemu/exec.c:2942
#28 0x39215c65df in address_space_write /home/test/qemu/exec.c:2987
#29 0x39215c6df3 in address_space_rw /home/test/qemu/exec.c:3089
#30 0x39216a3159 in kvm_handle_io /home/test/qemu/accel/kvm/kvm-all.c:1795
#31 0x39216a4425 in kvm_cpu_exec /home/test/qemu/accel/kvm/kvm-all.c:2035
#32 0x3921636a6c in qemu_kvm_cpu_thread_fn /home/test/qemu/cpus.c:1128
#33 0x7fd4a5f4336c in start_thread (/lib64/libpthread.so.0+0x736c)
#34 0x7fd4a5c7bbbe in __GI___clone (/lib64/libc.so.6+0x110bbe)
0x61400001018c is located 332 bytes inside of 416-byte region
[0x614000010040,0x6140000101e0)
freed by thread T2 here:
#0 0x7fd4a967c4b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
#1 0x3921ebf027 in sofree slirp/socket.c:106
#2 0x3921ed2cd5 in tcp_close slirp/tcp_subr.c:334
#3 0x3921eca600 in tcp_input slirp/tcp_input.c:948
#4 0x3921eab799 in ip_input slirp/ip_input.c:206
#5 0x3921eb6529 in slirp_input slirp/slirp.c:872
#6 0x3921e7c56f in net_slirp_receive net/slirp.c:119
#7 0x3921e60fe0 in nc_sendv_compat net/net.c:707
#8 0x3921e61170 in qemu_deliver_packet_iov net/net.c:734
#9 0x3921e67c53 in qemu_net_queue_deliver_iov net/queue.c:179
#10 0x3921e67e5b in qemu_net_queue_send_iov net/queue.c:224
#11 0x3921e61395 in qemu_sendv_packet_async net/net.c:770
#12 0x3921e613c2 in qemu_sendv_packet net/net.c:778
#13 0x3921e6961e in net_hub_receive_iov net/hub.c:72
#14 0x3921e69c12 in net_hub_port_receive_iov net/hub.c:123
#15 0x3921e61155 in qemu_deliver_packet_iov net/net.c:732
#16 0x3921e67ae7 in qemu_net_queue_deliver net/queue.c:164
#17 0x3921e67d59 in qemu_net_queue_send net/queue.c:199
#18 0x3921e60d58 in qemu_send_packet_async_with_flags net/net.c:661
#19 0x3921e60d90 in qemu_send_packet_async net/net.c:668
#20 0x3921e60dbd in qemu_send_packet net/net.c:674
#21 0x3921bef076 in ne2000_ioport_write hw/net/ne2000.c:302
#22 0x3921bf07c4 in ne2000_write hw/net/ne2000.c:688
#23 0x3921668a95 in memory_region_write_accessor
/home/test/qemu/memory.c:529
#24 0x3921668d6e in access_with_adjusted_size /home/test/qemu/memory.c:595
#25 0x392166f4ca in memory_region_dispatch_write
/home/test/qemu/memory.c:1337
#26 0x39215c633c in address_space_write_continue /home/test/qemu/exec.c:2942
#27 0x39215c65df in address_space_write /home/test/qemu/exec.c:2987
#28 0x39215c6df3 in address_space_rw /home/test/qemu/exec.c:3089
#29 0x39216a3159 in kvm_handle_io /home/test/qemu/accel/kvm/kvm-all.c:1795
previously allocated by thread T2 here:
#0 0x7fd4a967c850 in malloc (/lib64/libasan.so.4+0xde850)
#1 0x3921ebeaa5 in socreate slirp/socket.c:51
#2 0x3921ec7184 in tcp_input slirp/tcp_input.c:432
#3 0x3921eab799 in ip_input slirp/ip_input.c:206
#4 0x3921eb6529 in slirp_input slirp/slirp.c:872
#5 0x3921e7c56f in net_slirp_receive net/slirp.c:119
#6 0x3921e60fe0 in nc_sendv_compat net/net.c:707
#7 0x3921e61170 in qemu_deliver_packet_iov net/net.c:734
#8 0x3921e67c53 in qemu_net_queue_deliver_iov net/queue.c:179
#9 0x3921e67e5b in qemu_net_queue_send_iov net/queue.c:224
#10 0x3921e61395 in qemu_sendv_packet_async net/net.c:770
#11 0x3921e613c2 in qemu_sendv_packet net/net.c:778
#12 0x3921e6961e in net_hub_receive_iov net/hub.c:72
#13 0x3921e69c12 in net_hub_port_receive_iov net/hub.c:123
#14 0x3921e61155 in qemu_deliver_packet_iov net/net.c:732
#15 0x3921e67ae7 in qemu_net_queue_deliver net/queue.c:164
#16 0x3921e67d59 in qemu_net_queue_send net/queue.c:199
#17 0x3921e60d58 in qemu_send_packet_async_with_flags net/net.c:661
#18 0x3921e60d90 in qemu_send_packet_async net/net.c:668
#19 0x3921e60dbd in qemu_send_packet net/net.c:674
#20 0x3921bef076 in ne2000_ioport_write hw/net/ne2000.c:302
#21 0x3921bf07c4 in ne2000_write hw/net/ne2000.c:688
#22 0x3921668a95 in memory_region_write_accessor
/home/test/qemu/memory.c:529
#23 0x3921668d6e in access_with_adjusted_size /home/test/qemu/memory.c:595
#24 0x392166f4ca in memory_region_dispatch_write
/home/test/qemu/memory.c:1337
#25 0x39215c633c in address_space_write_continue /home/test/qemu/exec.c:2942
#26 0x39215c65df in address_space_write /home/test/qemu/exec.c:2987
#27 0x39215c6df3 in address_space_rw /home/test/qemu/exec.c:3089
#28 0x39216a3159 in kvm_handle_io /home/test/qemu/accel/kvm/kvm-all.c:1795
#29 0x39216a4425 in kvm_cpu_exec /home/test/qemu/accel/kvm/kvm-all.c:2035
Thread T2 created by T0 here:
#0 0x7fd4a95d5a2f in pthread_create (/lib64/libasan.so.4+0x37a2f)
#1 0x39221e317e in qemu_thread_create util/qemu-thread-posix.c:508
#2 0x39216392a7 in qemu_kvm_start_vcpu /home/test/qemu/cpus.c:1734
#3 0x3921639868 in qemu_init_vcpu /home/test/qemu/cpus.c:1774
#4 0x392182ae7a in x86_cpu_realizefn /home/test/qemu/target/i386/cpu.c:3735
#5 0x3921ae4b71 in device_set_realized hw/core/qdev.c:914
#6 0x3921f66be3 in property_set_bool qom/object.c:1886
#7 0x3921f629f5 in object_property_set qom/object.c:1093
#8 0x3921f6987c in object_property_set_qobject qom/qom-qobject.c:27
#9 0x3921f62cc2 in object_property_set_bool qom/object.c:1162
#10 0x39217abf1f in pc_new_cpu /home/test/qemu/hw/i386/pc.c:1102
#11 0x39217ac727 in pc_cpus_init /home/test/qemu/hw/i386/pc.c:1182
#12 0x39217b5c34 in pc_init1 /home/test/qemu/hw/i386/pc_piix.c:151
#13 0x39217b79c5 in pc_init_v2_10 /home/test/qemu/hw/i386/pc_piix.c:446
#14 0x3921af5157 in machine_run_board_init hw/core/machine.c:760
#15 0x392196b37c in main /home/test/qemu/vl.c:4633
#16 0x7fd4a5b8b509 in __libc_start_main (/lib64/libc.so.6+0x20509)
SUMMARY: AddressSanitizer: heap-use-after-free slirp/if.c:230 in if_start
Shadow bytes around the buggy address:
0x0c287fff9fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fff9ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fffa000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c287fffa010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c287fffa020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c287fffa030: fd[fd]fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0c287fffa040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fffa050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fffa060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fffa070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c287fffa080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2704==ABORTING
===
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
