1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
VMM: 0.768
risc-v: 0.723
x86: 0.714
vnc: 0.699
TCG: 0.674
user-level: 0.673
performance: 0.656
ppc: 0.631
permissions: 0.621
register: 0.618
peripherals: 0.614
KVM: 0.607
virtual: 0.605
arm: 0.602
architecture: 0.597
semantic: 0.584
hypervisor: 0.580
files: 0.578
debug: 0.569
mistranslation: 0.563
assembly: 0.563
graphic: 0.556
device: 0.548
PID: 0.543
socket: 0.542
i386: 0.540
kernel: 0.540
network: 0.536
boot: 0.483
accel/tcg/translate-all.c:2511: page_check_range: Assertion `start < ((target_ulong)1 << L1_MAP_ADDR_SPACE_BITS)' failed.
qemu-riscv64 version 2.12.93 crashes when mincore() is called with invalid pointer with the following message:
qemu-riscv64: /opt/qemu/accel/tcg/translate-all.c:2511: page_check_range: Assertion `start < ((target_ulong)1 << L1_MAP_ADDR_SPACE_BITS)' failed.
qemu:handle_cpu_signal received signal outside vCPU context @ pc=0x600014ef
Testcase:
#include <sys/mman.h>
int main (void)
{
unsigned char v;
return mincore ((void *) 0x00000010000000000, 1, &v);
}
Backtrace:
#0 raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x000000006000140a in abort () at abort.c:79
#2 0x00000000600012ec in __assert_fail_base (
fmt=0x6024eae8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=0x601b9758 "start < ((target_ulong)1 << L1_MAP_ADDR_SPACE_BITS)",
file=0x601b9658 "/opt/qemu/accel/tcg/translate-all.c", line=2511,
function=0x601b9810 <__PRETTY_FUNCTION__.23867> "page_check_range") at assert.c:92
#3 0x000000006010e10e in __assert_fail (
assertion=assertion@entry=0x601b9758 "start < ((target_ulong)1 << L1_MAP_ADDR_SPACE_BITS)", file=file@entry=0x601b9658 "/opt/qemu/accel/tcg/translate-all.c", line=line@entry=2511,
function=function@entry=0x601b9810 <__PRETTY_FUNCTION__.23867> "page_check_range")
at assert.c:101
#4 0x000000006003e916 in page_check_range (start=start@entry=1099511627776, len=len@entry=1,
flags=flags@entry=1) at /opt/qemu/accel/tcg/translate-all.c:2511
#5 0x0000000060057717 in access_ok (size=1, addr=1099511627776, type=0)
at /opt/qemu/linux-user/qemu.h:567
#6 lock_user (copy=0, len=1, guest_addr=1099511627776, type=0)
at /opt/qemu/linux-user/qemu.h:567
#7 do_syscall (cpu_env=cpu_env@entry=0x622fca28, num=232, arg1=1099511627776, arg2=1,
arg3=274886298751, arg4=0, arg5=274886298808, arg6=66518, arg7=0, arg8=0)
at /opt/qemu/linux-user/syscall.c:11635
#8 0x0000000060066c5c in cpu_loop (env=env@entry=0x622fca28)
at /opt/qemu/linux-user/riscv/cpu_loop.c:55
#9 0x0000000060002156 in main (argc=<optimized out>, argv=0x7fffffffed68,
envp=<optimized out>) at /opt/qemu/linux-user/main.c:819
Fixed by 0acd4ab849827bbc20402e01c9da088207c0d236 ("linux-user: check valid address in access_ok()"), fix released in v5.0.0.
|
