summary refs log tree commit diff stats
path: root/results/classifier/user-mode-bugs/1768
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-07-05 20:00:38 +0200
committerChristian Krinitsin <mail@krinitsin.com>2025-07-05 20:00:38 +0200
commit96049c939b1916d80532630d63c14e04d5244f1d (patch)
tree7fb9df428f074078e714f1e038210cdff887185a /results/classifier/user-mode-bugs/1768
parent40bbb77d4dfebff4f99c2f90b2c0db737b0ecc5a (diff)
downloadqemu-analysis-96049c939b1916d80532630d63c14e04d5244f1d.tar.gz
qemu-analysis-96049c939b1916d80532630d63c14e04d5244f1d.zip
lock user-mode and semantic-bugs
Diffstat (limited to 'results/classifier/user-mode-bugs/1768')
-rw-r--r--results/classifier/user-mode-bugs/176834
1 files changed, 34 insertions, 0 deletions
diff --git a/results/classifier/user-mode-bugs/1768 b/results/classifier/user-mode-bugs/1768
new file mode 100644
index 000000000..24cce069b
--- /dev/null
+++ b/results/classifier/user-mode-bugs/1768
@@ -0,0 +1,34 @@
+
+
+Could not allocate more than ~2GB with qemu-user
+Description of problem:
+On qemu-user, failed to allocate more than about 2GB on 32bit platform supporting up to 4GB (arm, ppc, etc.)
+Steps to reproduce:
+1. Try to allocate more than 2GB [e.g. for(i=0;i<64;i++) if(malloc(64*1024*1024)==NULL) perror("Failed to allocate 64MB");]
+2. Only 1 64MB chunck is allocated in the upper 2GB memory space
+3. Failed to allocate after about 2GB.
+Additional information:
+The problem is in **pageflags_find** and **pageflags_next** functions (found in _accel/tcg/user-exec.c_) 3rd parameters, that should be **target_ulong** instead of incorrect _target_long_ (the parameter will be converted signed extended to uint64_t).
+The testing program is the following:
+```
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc,char *argv[]) {
+  unsigned int a;
+  unsigned int i;
+  char *al;
+  unsigned int sss=1U*1024*1024*64;
+  for(a=0;a<128;a++) {
+    al=malloc(sss);
+    if(al!=NULL) {
+      printf("ALLOC OK %u (%08lX)!\n",sss*(a+1),al);
+    }
+    else {
+      printf("Cannot alloc %d\n",(a+1)*sss);
+      perror("Cannot alloc");
+      exit(1);
+    }
+  }
+}
+```