1 files changed, 60 insertions, 0 deletions

diff --git a/gitlab/issues/target_arm/host_missing/accel_missing/2358.toml b/gitlab/issues/target_arm/host_missing/accel_missing/2358.toml
new file mode 100644
index 00000000..61178844
--- /dev/null
+++ b/gitlab/issues/target_arm/host_missing/accel_missing/2358.toml
@@ -0,0 +1,60 @@
+id = 2358
+title = "null-pointer-dereference in a9gtimer"
+state = "closed"
+created_at = "2024-05-23T20:26:54.381Z"
+closed_at = "2024-07-18T12:51:23.709Z"
+labels = ["Bite Sized", "Fuzzer", "Tests", "target: arm", "workflow::Patch available"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/2358"
+host-os = "Ubuntu 22.04.4 LTS"
+host-arch = "aarch64"
+qemu-version = "commit 7e1c004701"
+guest-os = "n/a"
+guest-arch = "n/a"
+description = """The following log reveals it:
+
+```
+../hw/timer/a9gtimer.c:51:22: runtime error: member access within null pointer of type 'CPUState' (aka 'struct CPUState')
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/timer/a9gtimer.c:51:22 in
+AddressSanitizer:DEADLYSIGNAL
+=================================================================
+==2624453==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000002d0 (pc 0x55df9673422f bp 0x7fff7310e930 sp 0x7fff7310e8a0 T0)
+==2624453==The signal is caused by a READ memory access.
+==2624453==Hint: address points to the zero page.
+    #0 0x55df9673422f in a9_gtimer_get_current_cpu /home/joey/repo/qemu/build/../hw/timer/a9gtimer.c:51:22
+    #1 0x55df9673408c in a9_gtimer_this_write /home/joey/repo/qemu/build/../hw/timer/a9gtimer.c:246:14
+    #2 0x55df97e00353 in memory_region_write_accessor /home/joey/repo/qemu/build/../system/memory.c:497:5
+    #3 0x55df97dffa40 in access_with_adjusted_size /home/joey/repo/qemu/build/../system/memory.c:573:18
+    #4 0x55df97dfd986 in memory_region_dispatch_write /home/joey/repo/qemu/build/../system/memory.c:1521:16
+    #5 0x55df97ea8973 in flatview_write_continue_step /home/joey/repo/qemu/build/../system/physmem.c:2755:18
+    #6 0x55df97ea81df in flatview_write_continue /home/joey/repo/qemu/build/../system/physmem.c:2785:19
+    #7 0x55df97e7be4b in flatview_write /home/joey/repo/qemu/build/../system/physmem.c:2816:12
+    #8 0x55df97e7b908 in address_space_write /home/joey/repo/qemu/build/../system/physmem.c:2936:18
+    #9 0x55df96c8b041 in qtest_process_command /home/joey/repo/qemu/build/../system/qtest.c:559:13
+    #10 0x55df96c8631d in qtest_process_inbuf /home/joey/repo/qemu/build/../system/qtest.c:811:9
+    #11 0x55df96c955ae in qtest_read /home/joey/repo/qemu/build/../system/qtest.c:823:5
+    #12 0x55df986c515d in qemu_chr_be_write_impl /home/joey/repo/qemu/build/../chardev/char.c:214:9
+    #13 0x55df986c5219 in qemu_chr_be_write /home/joey/repo/qemu/build/../chardev/char.c:226:9
+    #14 0x55df986d0d25 in fd_chr_read /home/joey/repo/qemu/build/../chardev/char-fd.c:72:9
+    #15 0x55df980dd58c in qio_channel_fd_source_dispatch /home/joey/repo/qemu/build/../io/channel-watch.c:84:12
+    #16 0x7f76346edc43 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55c43)
+    #17 0x55df98a66319 in glib_pollfds_poll /home/joey/repo/qemu/build/../util/main-loop.c:287:9
+    #18 0x55df98a64c53 in os_host_main_loop_wait /home/joey/repo/qemu/build/../util/main-loop.c:310:5
+    #19 0x55df98a6481c in main_loop_wait /home/joey/repo/qemu/build/../util/main-loop.c:589:11
+    #20 0x55df96c9c807 in qemu_main_loop /home/joey/repo/qemu/build/../system/runstate.c:796:9
+    #21 0x55df98048c6c in qemu_default_main /home/joey/repo/qemu/build/../system/main.c:37:14
+    #22 0x55df98048cb7 in main /home/joey/repo/qemu/build/../system/main.c:48:12
+    #23 0x7f7633e29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
+    #24 0x7f7633e29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
+    #25 0x55df95222d34 in _start (/home/joey/repo/qemu/build/qemu-system-aarch64+0x2773d34)
+
+AddressSanitizer can not provide additional info.
+SUMMARY: AddressSanitizer: SEGV /home/joey/repo/qemu/build/../hw/timer/a9gtimer.c:51:22 in a9_gtimer_get_current_cpu
+==2624453==ABORTING
+```"""
+reproduce = """```
+cat << EOF | /home/joey/repo/qemu/build/qemu-system-aarch64 -display \\
+none -machine accel=qtest, -m 512M -machine npcm750-evb -qtest stdio
+writel 0xf03fe20c 0x26d7468c
+EOF
+```"""
+additional = "n/a"