diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-06-16 16:59:00 +0000 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-06-16 16:59:33 +0000 |
| commit | 9aba81d8eb048db908c94a3c40c25a5fde0caee6 (patch) | |
| tree | b765e7fb5e9a3c2143c68b0414e0055adb70e785 /results/classifier/118/graphic/2407 | |
| parent | b89a938452613061c0f1f23e710281cf5c83cb29 (diff) | |
| download | qemu-analysis-9aba81d8eb048db908c94a3c40c25a5fde0caee6.tar.gz qemu-analysis-9aba81d8eb048db908c94a3c40c25a5fde0caee6.zip | |
add 18th iteration of classifier
Diffstat (limited to 'results/classifier/118/graphic/2407')
| -rw-r--r-- | results/classifier/118/graphic/2407 | 83 |
1 files changed, 83 insertions, 0 deletions
diff --git a/results/classifier/118/graphic/2407 b/results/classifier/118/graphic/2407 new file mode 100644 index 000000000..86ba87d03 --- /dev/null +++ b/results/classifier/118/graphic/2407 @@ -0,0 +1,83 @@ +graphic: 0.911 +user-level: 0.887 +virtual: 0.885 +register: 0.869 +semantic: 0.853 +permissions: 0.848 +architecture: 0.846 +risc-v: 0.846 +arm: 0.844 +performance: 0.842 +device: 0.828 +assembly: 0.814 +boot: 0.796 +mistranslation: 0.790 +debug: 0.790 +PID: 0.765 +files: 0.761 +KVM: 0.756 +x86: 0.755 +kernel: 0.747 +TCG: 0.740 +ppc: 0.722 +peripherals: 0.709 +VMM: 0.707 +socket: 0.696 +network: 0.674 +vnc: 0.659 +hypervisor: 0.628 +i386: 0.624 + +"code should not be reached" in ati_2d_blt() +Description of problem: +My fuzzer detected a "code should not be reached" bug in ati_2d_blt() + +The stack trace is: + +``` +ERROR:include/qemu/bswap.h:418:stn_he_p: code should not be reached +Bail out! ERROR:include/qemu/bswap.h:418:stn_he_p: code should not be reached +==69534== ERROR: libFuzzer: deadly signal + #0 0x559e65667f5e in __sanitizer_print_stack_trace llvm-project-15.0.0.src/compiler-rt/lib/asan/asan_stack.cpp:87:3 + #1 0x559e655a73bc in fuzzer::PrintStackTrace() llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:38 + #2 0x559e65585a66 in fuzzer::Fuzzer::CrashCallback() (.part.0) llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:236:18 + #3 0x559e65585b2b in fuzzer::Fuzzer::CrashCallback() llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:208:1 + #4 0x559e65585b2b in fuzzer::Fuzzer::StaticCrashSignalCallback() llvm-project-15.0.0.src/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:207:19 + #5 0x7fa8835e351f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e) + #6 0x7fa8836379fb in __pthread_kill_implementation nptl/pthread_kill.c:43:17 + #7 0x7fa8836379fb in __pthread_kill_internal nptl/pthread_kill.c:78:10 + #8 0x7fa8836379fb in pthread_kill nptl/pthread_kill.c:89:10 + #9 0x7fa8835e3475 in gsignal signal/../sysdeps/posix/raise.c:26:13 + #10 0x7fa8835c97f2 in abort stdlib/abort.c:79:7 + #11 0x7fa8848e5b56 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x1eb56) (BuildId: c74e800dfd5f72649d673b44292f4a817e45150b) + #12 0x7fa88493f70e in g_assertion_message_expr (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7870e) (BuildId: c74e800dfd5f72649d673b44292f4a817e45150b) + #13 0x559e65fc7d70 in stn_he_p include/qemu/bswap.h:418:1 + #14 0x559e65fc55dc in ati_2d_blt hw/display/ati_2d.c:224:21 + #15 0x559e65faccff in ati_mm_write hw/display/ati.c:857:9 + #16 0x559e685b8363 in memory_region_write_accessor system/memory.c:497:5 + #17 0x559e685b7a45 in access_with_adjusted_size system/memory.c:573:18 + #18 0x559e685b59a9 in memory_region_dispatch_write system/memory.c:1521:16 + #19 0x559e6865938e in flatview_write_continue_step system/physmem.c:2757:18 + #20 0x559e68658c24 in flatview_write_continue system/physmem.c:2787:19 + #21 0x559e6863024b in flatview_write system/physmem.c:2818:12 + #22 0x559e6862fd18 in address_space_write system/physmem.c:2938:18 +... +``` +Steps to reproduce: +Arguments: `export QEMU_ARGS="-machine q35 -nodefaults -device ati-vga,romfile=\"\" -display vnc=localhost:99 -L ../pc-bios/"` + +The base addresses of memory regions: + +ati.mmregs: 0xe1000000 + +Reproducer: + +``` +writew 0xe100146c 0x44e4c5c1 +writeb 0xe10016c0 0x773b93cf +writeb 0xe10016e4 0x2beb6e13 +writel 0xe100143c 0x118b71f6 +EOF +``` +Additional information: +Ack: Chuhong Yuan (hslester96@gmail.com) |