diff options
Diffstat (limited to 'results/classifier/105/other/1510')
| -rw-r--r-- | results/classifier/105/other/1510 | 105 |
1 files changed, 105 insertions, 0 deletions
diff --git a/results/classifier/105/other/1510 b/results/classifier/105/other/1510 new file mode 100644 index 000000000..24fde6ba7 --- /dev/null +++ b/results/classifier/105/other/1510 @@ -0,0 +1,105 @@ +other: 0.827 +instruction: 0.695 +graphic: 0.662 +assembly: 0.654 +semantic: 0.617 +mistranslation: 0.606 +device: 0.602 +socket: 0.533 +network: 0.482 +boot: 0.476 +vnc: 0.447 +KVM: 0.446 + +LibFuzzer: Deadly Signals +Description of problem: +``` +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1075449567 +INFO: Loaded 1 modules (323687 inline 8-bit counters): 323687 [0x558e9ece6000, 0x558e9ed35067), +INFO: Loaded 1 PC tables (323687 PCs): 323687 [0x558e9e7f5680,0x558e9ece5cf0), +./qemu-fuzz-i386: Running 1 inputs 1 time(s) each. +Running: crash-11075f8b34e355e114f92367a5e8b9bbb36a352d +Matching objects by name *usb* +Matching objects by name *ohci* +This process will try to fuzz the following MemoryRegions: + * bus master container[0] (size 0xffffffffffffffff) + * ohci[0] (size 0x100) + * bus master[0] (size 0xffffffffffffffff) +qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. +==1763255== ERROR: libFuzzer: deadly signal + #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) + #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 + #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 + #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 + #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 + #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 + #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 + #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 + #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 + #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 + #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 + #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 + #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 + #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 + #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 + #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 + #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 + #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 + #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 + #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 + #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 + #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #25 0x558e9ac8a2cf in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb52cf) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #26 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #27 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #28 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #29 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #30 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal +qemu-fuzz-i386: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. +==1763258== ERROR: libFuzzer: deadly signal + #0 0x558e9ad46cb1 in __sanitizer_print_stack_trace (/home/hyper/qemu/build/qemu-fuzz-i386+0x1f71cb1) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #1 0x558e9acb9548 in fuzzer::PrintStackTrace() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4548) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #2 0x558e9ac9efc3 in fuzzer::Fuzzer::CrashCallback() (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ec9fc3) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #3 0x7faa5444251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d) + #4 0x7faa54496a7b in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:43:17 + #5 0x7faa54496a7b in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10 + #6 0x7faa54496a7b in pthread_kill nptl/./nptl/pthread_kill.c:89:10 + #7 0x7faa54442475 in gsignal signal/../sysdeps/posix/raise.c:26:13 + #8 0x7faa544287f2 in abort stdlib/./stdlib/abort.c:79:7 + #9 0x7faa5442871a in __assert_fail_base assert/./assert/assert.c:92:3 + #10 0x7faa54439e95 in __assert_fail assert/./assert/assert.c:101:3 + #11 0x558e9b6c89d9 in usb_ep_get /home/hyper/qemu/build/../hw/usb/core.c:744:5 + #12 0x558e9b701fa4 in ohci_service_td /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:957:14 + #13 0x558e9b701fa4 in ohci_service_ed_list /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1122:21 + #14 0x558e9b6fa47b in ohci_frame_boundary /home/hyper/qemu/build/../hw/usb/hcd-ohci.c:1192:9 + #15 0x558e9cbe8b9c in timerlist_run_timers /home/hyper/qemu/build/../util/qemu-timer.c:576:9 + #16 0x558e9c2a9c7d in qtest_clock_warp /home/hyper/qemu/build/../softmmu/qtest.c:358:9 + #17 0x558e9c2a6411 in qtest_process_command /home/hyper/qemu/build/../softmmu/qtest.c:751:9 + #18 0x558e9c2a1f98 in qtest_process_inbuf /home/hyper/qemu/build/../softmmu/qtest.c:802:9 + #19 0x558e9c2a1db3 in qtest_server_inproc_recv /home/hyper/qemu/build/../softmmu/qtest.c:933:9 + #20 0x558e9c932980 in qtest_sendf /home/hyper/qemu/build/../tests/qtest/libqtest.c:600:5 + #21 0x558e9c932a84 in qtest_clock_step_next /home/hyper/qemu/build/../tests/qtest/libqtest.c:955:5 + #22 0x558e9ad86fed in generic_fuzz /home/hyper/qemu/build/../tests/qtest/fuzz/generic_fuzz.c:715:17 + #23 0x558e9ad7aae3 in LLVMFuzzerTestOneInput /home/hyper/qemu/build/../tests/qtest/fuzz/fuzz.c:152:5 + #24 0x558e9aca0553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecb553) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #25 0x558e9aca1175 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ecc175) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #26 0x558e9ac8a317 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eb5317) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #27 0x558e9ac90026 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ebb026) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #28 0x558e9acb9e42 in main (/home/hyper/qemu/build/qemu-fuzz-i386+0x1ee4e42) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) + #29 0x7faa54429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 + #30 0x7faa54429e3f in __libc_start_main csu/../csu/libc-start.c:392:3 + #31 0x558e9ac84b94 in _start (/home/hyper/qemu/build/qemu-fuzz-i386+0x1eafb94) (BuildId: 49539853a6c034db6a511d608192f681fdffa439) +``` +Steps to reproduce: +1. ./qemu-fuzz-i386 --fuzz-target=generic-fuzz-ohci +Additional information: + |