summary refs log tree commit diff stats
path: root/results/classifier/deepseek-2/output/hypervisor/1921948
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
commitd0c85e36e4de67af628d54e9ab577cc3fad7796a (patch)
treef8f784b0f04343b90516a338d6df81df3a85dfa2 /results/classifier/deepseek-2/output/hypervisor/1921948
parent7f4364274750eb8cb39a3e7493132fca1c01232e (diff)
downloadqemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.tar.gz
qemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.zip
add deepseek and gemma results
Diffstat (limited to 'results/classifier/deepseek-2/output/hypervisor/1921948')
-rw-r--r--results/classifier/deepseek-2/output/hypervisor/192194839
1 files changed, 39 insertions, 0 deletions
diff --git a/results/classifier/deepseek-2/output/hypervisor/1921948 b/results/classifier/deepseek-2/output/hypervisor/1921948
new file mode 100644
index 000000000..2746deb9e
--- /dev/null
+++ b/results/classifier/deepseek-2/output/hypervisor/1921948
@@ -0,0 +1,39 @@
+
+MTE tags not checked properly for unaligned accesses at EL1
+
+For kernel memory accesses that span across two memory granules, QEMU's MTE implementation only checks the tag of the first granule but not of the second one.
+
+To reproduce this, build the Linux kernel with CONFIG_KASAN_HW_TAGS enabled, apply the patch below, and boot the kernel:
+
+diff --git a/sound/last.c b/sound/last.c
+index f0bb98780e70..04745cb30b74 100644
+--- a/sound/last.c
++++ b/sound/last.c
+@@ -5,12 +5,18 @@
+  */
+ 
+ #include <linux/init.h>
++#include <linux/slab.h>
+ #include <sound/core.h>
+ 
+ static int __init alsa_sound_last_init(void)
+ {
+        struct snd_card *card;
+        int idx, ok = 0;
++
++       char *ptr = kmalloc(128, GFP_KERNEL);
++       pr_err("KASAN report should follow:\n");
++       *(volatile unsigned long *)(ptr + 124);
++       kfree(ptr);
+        
+        printk(KERN_INFO "ALSA device list:\n");
+        for (idx = 0; idx < SNDRV_CARDS; idx++) {
+
+KASAN tags the 128 allocated bytes with the same tag as the returned pointer. The memory granule that follows the 128 allocated bytes has a different tag (with 1/15 probability).
+
+Expected result: a tag fault is detected and a KASAN report is printed when accessing bytes [124, 130).
+Observed result: no tag fault is detected and no KASAN report is printed.
+
+Here are the flags that I use to run QEMU if they matter:
+
+qemu-system-aarch64 -s -machine virt,mte=on -cpu max -m 2G -smp 2 -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 -net nic -nographic -kernel ./Image -append "console=ttyAMA0 root=/dev/vda earlyprintk=serial" -drive file=./fs.img,format=raw,if=virtio -no-shutdown -no-reboot
\ No newline at end of file