summary refs log tree commit diff stats
path: root/gitlab/issues/target_missing/host_missing/accel_missing/2777.toml
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-05-21 21:21:26 +0200
committerChristian Krinitsin <mail@krinitsin.com>2025-05-21 21:21:26 +0200
commit4b927bc37359dec23f67d3427fc982945f24f404 (patch)
tree245449ef9146942dc7fffd0235b48b7e70a00bf2 /gitlab/issues/target_missing/host_missing/accel_missing/2777.toml
parentaa8bd79cec7bf6790ddb01d156c2ef2201abbaab (diff)
downloademulator-bug-study-4b927bc37359dec23f67d3427fc982945f24f404.tar.gz
emulator-bug-study-4b927bc37359dec23f67d3427fc982945f24f404.zip
add gitlab issues in toml format
Diffstat (limited to 'gitlab/issues/target_missing/host_missing/accel_missing/2777.toml')
-rw-r--r--gitlab/issues/target_missing/host_missing/accel_missing/2777.toml67
1 files changed, 67 insertions, 0 deletions
diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/2777.toml b/gitlab/issues/target_missing/host_missing/accel_missing/2777.toml
new file mode 100644
index 00000000..29bd7d30
--- /dev/null
+++ b/gitlab/issues/target_missing/host_missing/accel_missing/2777.toml
@@ -0,0 +1,67 @@
+id = 2777
+title = "Assert failure in ahci-hd device"
+state = "opened"
+created_at = "2025-01-15T11:46:40.526Z"
+closed_at = "n/a"
+labels = ["Fuzzer"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/2777"
+host-os = "Debian 12"
+host-arch = "x86_64"
+qemu-version = "QEMU emulator version 9.2.50 (v9.2.0-1001-g7433709a14)"
+guest-os = "n/a"
+guest-arch = "n/a"
+description = """Assert 
+
+```
+qemu-system-x86_64: ../hw/ide/core.c:934: void ide_dma_cb(void *, int): Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
+```
+can be triggered with some qtest commands. This was found by fuzzing."""
+reproduce = """Command:
+
+```
+cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -machine q35 -nodefaults -drive file=null-co://,if=none,format=raw,id=disk0 -device ide-hd,drive=disk0  -qtest stdio
+outl 0xcf8 0x8000fa24
+outl 0xcfc 0xe0000000
+outl 0xcf8 0x8000fa04
+outw 0xcfc 0x06
+write 0x0 0x1 0x27
+write 0x1 0x1 0x80
+write 0x2 0x1 0x25
+write 0xe00003b8 0x1 0x02
+write 0xe0000398 0x1 0x01
+EOF
+```
+
+Results in 
+
+```
+[I 0.000001] OPENED
+[R +0.076075] outl 0xcf8 0x8000fa24
+[S +0.076165] OK
+OK
+[R +0.076198] outl 0xcfc 0xe0000000
+[S +0.076242] OK
+OK
+[R +0.076320] outl 0xcf8 0x8000fa04
+[S +0.076344] OK
+OK
+[R +0.076379] outw 0xcfc 0x06
+[S +0.077676] OK
+OK
+[R +0.077760] write 0x0 0x1 0x27
+[S +0.079429] OK
+OK
+[R +0.079552] write 0x1 0x1 0x80
+[S +0.079592] OK
+OK
+[R +0.079618] write 0x2 0x1 0x25
+[S +0.079645] OK
+OK
+[R +0.079669] write 0xe00003b8 0x1 0x02
+[S +0.079709] OK
+OK
+[R +0.079733] write 0xe0000398 0x1 0x01
+qemu-system-x86_64: ../hw/ide/core.c:934: void ide_dma_cb(void *, int): Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
+Aborted
+```"""
+additional = """Maybe we can just `goto eot;` instead of assert?"""