diff options
Diffstat (limited to 'gitlab/issues_toml/target_missing/host_missing/accel_missing/2428.toml')
| -rw-r--r-- | gitlab/issues_toml/target_missing/host_missing/accel_missing/2428.toml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/gitlab/issues_toml/target_missing/host_missing/accel_missing/2428.toml b/gitlab/issues_toml/target_missing/host_missing/accel_missing/2428.toml new file mode 100644 index 000000000..3d9ccb602 --- /dev/null +++ b/gitlab/issues_toml/target_missing/host_missing/accel_missing/2428.toml @@ -0,0 +1,39 @@ +id = 2428 +title = "Null-pointer-dereference in ufs" +state = "closed" +created_at = "2024-07-05T21:21:58.901Z" +closed_at = "2024-07-25T08:20:29.517Z" +labels = ["Fuzzer", "Storage", "workflow::Triaged"] +url = "https://gitlab.com/qemu-project/qemu/-/issues/2428" +host-os = "Ubuntu 22.04.4 LTS" +host-arch = "x86_64" +qemu-version = "commit 3665dd6bb9" +guest-os = "n/a" +guest-arch = "n/a" +description = """The following log reveals it: + +``` +../hw/ufs/ufs.c:740:13: runtime error: member access within null pointer of type 'UfsSq' (aka 'struct UfsSq') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/ufs/ufs.c:740:13 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==848760==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x6220e29edfce bp 0x7fffea0c6cf0 sp 0x7fffea0c6c40 T0) +==848760==The signal is caused by a READ memory access. +==848760==Hint: address points to the zero page. + #0 0x6220e29edfce in ufs_mcq_process_db hw/ufs/ufs.c:740:9 + #1 0x6220e29dc10f in ufs_write_mcq_op_reg hw/ufs/ufs.c:758:13 + #2 0x6220e29d85c6 in ufs_mmio_write hw/ufs/ufs.c:813:9 +```""" +reproduce = """``` +cat << EOF | qemu-system-x86_64 \\ +-display none -machine accel=qtest, -m 512M -M q35 -nodefaults -drive \\ +file=null-co://,if=none,id=disk0 -device ufs,id=ufs_bus -device \\ +ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio +outl 0xcf8 0x80000810 +outl 0xcfc 0xe0000000 +outl 0xcf8 0x80000804 +outw 0xcfc 0x02 +write 0xe0001004 0x1 0x01 +EOF +```""" +additional = "n/a" |