diff options
Diffstat (limited to 'gitlab/issues/target_missing/host_missing/accel_missing/1510.toml')
| -rw-r--r-- | gitlab/issues/target_missing/host_missing/accel_missing/1510.toml | 100 |
1 files changed, 0 insertions, 100 deletions
diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/1510.toml b/gitlab/issues/target_missing/host_missing/accel_missing/1510.toml deleted file mode 100644 index 1bdd43f2..00000000 --- a/gitlab/issues/target_missing/host_missing/accel_missing/1510.toml +++ /dev/null @@ -1,100 +0,0 @@ -id = 1510 -title = "LibFuzzer: Deadly Signals" -state = "closed" -created_at = "2023-02-27T09:29:01.070Z" -closed_at = "2024-05-31T20:01:28.045Z" -labels = ["Fuzzer", "USB"] -url = "https://gitlab.com/qemu-project/qemu/-/issues/1510" -host-os = "Ubuntu 20.04" -host-arch = "AMD64" -qemu-version = "BuildId: 49539853a6c034db6a511d608192f681fdffa439" -guest-os = "n/a" -guest-arch = "n/a" -description = """``` -INFO: libFuzzer ignores flags that start with '--' -INFO: Running with entropic power schedule (0xFF, 100). -INFO: Seed: 1075449567 -INFO: Loaded 1 modules (323687 inline 8-bit counters): 323687 [0x558e9ece6000, 0x558e9ed35067), -INFO: Loaded 1 PC tables (323687 PCs): 323687 [0x558e9e7f5680,0x558e9ece5cf0), -./qemu-fuzz-i386: Running 1 inputs 1 time(s) each. -Running: crash-11075f8b34e355e114f92367a5e8b9bbb36a352d -Matching objects by name *usb* -Matching objects by name *ohci* -This process will try to fuzz the following MemoryRegions: - * bus master container[0] (size 0xffffffffffffffff) - * ohci[0] (size 0x100) - * bus master[0] (size 0xffffffffffffffff) -qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. -==1763255== ERROR: libFuzzer: deadly signal - #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) - #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 - #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 - #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 - #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 - #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 - #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 - #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 - #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 - #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 - #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 - #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 - #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 - #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 - #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 - #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 - #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 - #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 - #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 - #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 - #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 - #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #25 0x558e9ac8a2cf in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb52cf) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #26 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #27 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #28 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 - #29 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 - #30 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - -NOTE: libFuzzer has rudimentary signal handlers. - Combine libFuzzer with AddressSanitizer or similar for better crash reports. -SUMMARY: libFuzzer: deadly signal -qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. -==1763258== ERROR: libFuzzer: deadly signal - #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) - #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 - #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 - #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 - #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 - #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 - #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 - #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 - #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 - #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 - #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 - #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 - #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 - #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 - #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 - #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 - #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 - #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 - #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 - #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 - #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 - #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #25 0x558e9aca1175 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecc175) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #26 0x558e9ac8a317 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb5317) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #27 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #28 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) - #29 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 - #30 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 - #31 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) -```""" -reproduce = """1. ./qemu-fuzz-i386 --fuzz-target=generic-fuzz-ohci""" -additional = """""" |