add 18th iteration of classifier

1 files changed, 166 insertions, 0 deletions

diff --git a/results/classifier/118/unknown/1892962 b/results/classifier/118/unknown/1892962
new file mode 100644
index 000000000..1aa971313
--- /dev/null
+++ b/results/classifier/118/unknown/1892962
@@ -0,0 +1,166 @@
+risc-v: 0.964
+peripherals: 0.929
+permissions: 0.915
+user-level: 0.915
+i386: 0.902
+device: 0.892
+register: 0.889
+architecture: 0.888
+vnc: 0.882
+hypervisor: 0.882
+performance: 0.873
+TCG: 0.872
+graphic: 0.862
+KVM: 0.859
+ppc: 0.854
+socket: 0.854
+assembly: 0.852
+files: 0.852
+virtual: 0.850
+arm: 0.848
+VMM: 0.838
+mistranslation: 0.837
+debug: 0.836
+semantic: 0.831
+kernel: 0.827
+PID: 0.823
+x86: 0.811
+boot: 0.796
+network: 0.782
+
+Segfault in usb_bus_from_device
+
+Hello,
+Reproducer:
+
+cat << EOF | ./qemu-system-i386 -machine q35 \
+-device ich9-usb-ehci1,bus=pcie.0,addr=1d.7,\
+multifunction=on,id=ich9-ehci-1 \
+-device ich9-usb-uhci1,bus=pcie.0,addr=1d.0,\
+multifunction=on,masterbus=ich9-ehci-1.0,firstport=0 \
+-device usb-tablet,bus=ich9-ehci-1.0,port=1,usb_version=1 \
+-display none -nodefaults -qtest stdio -accel qtest
+outl 0xcf8 0x8000e803
+outl 0xcfc 0xff00ff00
+outl 0xcf8 0x8000e821
+outb 0xcfc 0xff
+outl 0xff10 0x8500057e
+clock_step
+clock_step
+outb 0xff00 0x49
+write 0x2 0x1 0x40
+write 0x400006 0x1 0xfb
+write 0x400008 0x1 0x2d
+write 0x40000a 0x1 0xe0
+write 0x40000c 0x1 0x16
+write 0x40000e 0x1 0xfa
+write 0xfa001c 0x1 0x04
+clock_step
+write 0x400006 0x1 0xfb
+write 0xfa001d 0x1 0xff
+clock_step
+write 0x8 0x1 0xe0
+write 0xa 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x1600e8 0x1 0xe1
+write 0x1600eb 0x1 0x30
+clock_step
+clock_step
+write 0x10 0x1 0xe0
+write 0x12 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x6 0x1 0x9c
+write 0x8 0x1 0xe1
+write 0xa 0x1 0x40
+write 0xb 0x1 0x30
+clock_step
+write 0x14 0x1 0xe0
+write 0x16 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x6 0x1 0x9c
+clock_step
+write 0x18 0x1 0xe0
+write 0x1a 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x6 0x1 0x9c
+clock_step
+write 0x1c 0x1 0xe0
+write 0x1e 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x6 0x1 0x9c
+clock_step
+write 0x20 0x1 0xe0
+write 0x22 0x1 0x16
+write 0x1600e6 0x1 0x9c
+write 0x6 0x1 0x9c
+clock_step
+EOF
+
+The trace:
+
+...
+[S +0.087589] OK
+[R +0.087596] write 0x1600e6 0x1 0x9c
+OK
+[S +0.087603] OK
+[R +0.087655] write 0x6 0x1 0x9c
+OK
+[S +0.087667] OK
+[R +0.087675] clock_step
+784168@1598406646.189133:usb_uhci_frame_start nr 8
+784168@1598406646.189141:usb_uhci_td_load qh 0x0, td 0x1600e0, ctrl 0x9c0180, token 0x300000e1
+784168@1598406646.189147:usb_uhci_packet_add token 0x0, td 0x1600e0
+784168@1598406646.189151:usb_packet_state_change bus 0, port 1, ep 0, packet 0x611000043c00, state undef -> setup
+784168@1598406646.189161:usb_packet_state_change bus 0, port 1, ep 0, packet 0x611000043c00, state setup -> complete
+784168@1598406646.189165:usb_uhci_packet_complete_success token 0x0, td 0x1600e0
+784168@1598406646.189168:usb_uhci_packet_del token 0x0, td 0x1600e0
+784168@1598406646.189174:usb_uhci_td_complete qh 0x0, td 0x1600e0
+784168@1598406646.189179:usb_uhci_td_load qh 0x0, td 0x0, ctrl 0x9c0182, token 0x304000e1
+784168@1598406646.189183:usb_uhci_packet_add token 0x0, td 0x0
+784168@1598406646.189187:usb_packet_state_change bus 0, port 1, ep 0, packet 0x611000043d40, state undef -> setup
+/home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12: runtime error: member access within null pointer of type 'USBDevice' (aka 'struct USBDevice')
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12 in 
+/home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12: runtime error: member access within null pointer of type 'DeviceState' (aka 'struct DeviceState')
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12 in 
+AddressSanitizer:DEADLYSIGNAL
+=================================================================
+==784168==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x5599c43df445 bp 0x7ffec2833e50 sp 0x7ffec2833dc0 T0)
+==784168==The signal is caused by a READ memory access.
+==784168==Hint: address points to the zero page.
+    #0 0x5599c43df445 in usb_bus_from_device /home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12
+    #1 0x5599c43ea95c in usb_packet_set_state /home/alxndr/Development/qemu/general-fuzz/build/../hw/usb/core.c:549:23
+    #2 0x5599c43e8abd in usb_handle_packet /home/alxndr/Development/qemu/general-fuzz/build/../hw/usb/core.c:438:17
+    #3 0x5599c4b02497 in uhci_handle_td /home/alxndr/Development/qemu/general-fuzz/build/../hw/usb/hcd-uhci.c:892:9
+    #4 0x5599c4afbd26 in uhci_process_frame /home/alxndr/Development/qemu/general-fuzz/build/../hw/usb/hcd-uhci.c:1075:15
+    #5 0x5599c4aed2e3 in uhci_frame_timer /home/alxndr/Development/qemu/general-fuzz/build/../hw/usb/hcd-uhci.c:1174:9
+    #6 0x5599c7620917 in timerlist_run_timers /home/alxndr/Development/qemu/general-fuzz/build/../util/qemu-timer.c:572:9
+    #7 0x5599c7620e51 in qemu_clock_run_timers /home/alxndr/Development/qemu/general-fuzz/build/../util/qemu-timer.c:586:12
+    #8 0x5599c5f35a13 in qtest_clock_warp /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/cpus.c:507:9
+    #9 0x5599c61225d8 in qtest_process_command /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:665:9
+    #10 0x5599c611063e in qtest_process_inbuf /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:710:9
+    #11 0x5599c610f3e3 in qtest_read /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/qtest.c:722:5
+    #12 0x5599c7215762 in qemu_chr_be_write_impl /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:188:9
+    #13 0x5599c72158aa in qemu_chr_be_write /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char.c:200:9
+    #14 0x5599c723b514 in fd_chr_read /home/alxndr/Development/qemu/general-fuzz/build/../chardev/char-fd.c:68:9
+    #15 0x5599c7127736 in qio_channel_fd_source_dispatch /home/alxndr/Development/qemu/general-fuzz/build/../io/channel-watch.c:84:12
+    #16 0x7f62623914cd in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x504cd)
+    #17 0x5599c76b2c67 in glib_pollfds_poll /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:217:9
+    #18 0x5599c76b0567 in os_host_main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:240:5
+    #19 0x5599c76aff47 in main_loop_wait /home/alxndr/Development/qemu/general-fuzz/build/../util/main-loop.c:516:11
+    #20 0x5599c5e8e08d in qemu_main_loop /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/vl.c:1676:9
+    #21 0x5599c382051c in main /home/alxndr/Development/qemu/general-fuzz/build/../softmmu/main.c:50:5
+    #22 0x7f6261b9acc9 in __libc_start_main csu/../csu/libc-start.c:308:16
+    #23 0x5599c3775cf9 in _start (/home/alxndr/Development/qemu/general-fuzz/build/qemu-system-i386+0x2cb0cf9)
+
+AddressSanitizer can not provide additional info.
+SUMMARY: AddressSanitizer: SEGV /home/alxndr/Development/qemu/general-fuzz/include/hw/usb.h:526:12 in usb_bus_from_device
+==784168==ABORTING
+
+-Alex
+
+This does not crash for me anymore, so I guess it has been fixed already. Could you still reproduce the crash with the latest version of QEMU?
+
+OSS-Fuzz never came across this one. Probably fixed
+
+Ok, let's assume it's fixed - so I'm closing this now.
+