1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
|
Assert failure in `usb_ep_get` : Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT` failed.
Description of problem:
Assert failure in `usb_ep_get` : Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT` failed.
The TD PID needs to be either `USB_TOKEN_IN` or `USB_TOKEN_OUT` in `usb_ep_get`, but in the caller `uhci_handle_td` it may be `USB_TOKEN_SETUP`.
An unprivileged guest user may be able to reach the assertion, I think this bug is quite akin to CVE-2024-3567 (https://gitlab.com/qemu-project/qemu/-/issues/2273) :
Users are not directly able to craft URBs, however as a user, one might be able to find a kernel path that would send a TD with PID `USB_TOKEN_SETUP` to QEMU (which is called `USB_PID_SETUP` in Linux).
For instance in the Linux Kernel, `uhci_submit_control` in `drivers/usb/host/uhci-q.c:789` does link a `USB_PID_SETUP` TD to the URB.
Steps to reproduce:
Minimized reproducer:
```
cat << EOF | ./qemu/build2/qemu-system-x86_64 -machine q35 -nodefaults \
-device \
ich9-usb-ehci1,bus=pcie.0,addr=1d.7,multifunction=on,id=ich9-ehci-1 \
-device ich9-usb-uhci1,bus=pcie.0,addr=1d.0,multifunction=on,masterbus=i\
ch9-ehci-1.0,firstport=0 -device ich9-usb-uhci2,bus=pcie.0,addr=1d.1,mul\
tifunction=on,masterbus=ich9-ehci-1.0,firstport=2 -device ich9-usb-uhci3\
,bus=pcie.0,addr=1d.2,multifunction=on,masterbus=ich9-ehci-1.0,firstport\
=4 -drive if=none,id=usbcdrom,media=cdrom -device \
usb-tablet,bus=ich9-ehci-1.0,port=1,usb_version=1 -device \
usb-storage,bus=ich9-ehci-1.0,port=2,drive=usbcdrom -qtest stdio
outl 0xcf8 0x8000e900
inw 0xcfc
outl 0xcf8 0x8000e920
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000e920
inl 0xcfc
outl 0xcf8 0x8000e920
outl 0xcfc 0xc001
outl 0xcf8 0x8000e904
inw 0xcfc
outl 0xcf8 0x8000e904
outw 0xcfc 0x7
outl 0xcf8 0x8000e904
inw 0xcfc
outl 0xcf8 0x8000ef00
inw 0xcfc
outl 0xcf8 0x8000ef10
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000ef10
inl 0xcfc
outl 0xcf8 0x8000ef10
outl 0xcfc 0xe0000000
outl 0xcf8 0x8000ef04
inw 0xcfc
outl 0xcf8 0x8000ef04
outw 0xcfc 0x7
outl 0xcf8 0x8000ef04
inw 0xcfc
outl 0xcf8 0x8000ea00
inw 0xcfc
outl 0xcf8 0x8000ea20
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000ea20
inl 0xcfc
outl 0xcf8 0x8000ea20
outl 0xcfc 0xc021
outl 0xcf8 0x8000ea04
inw 0xcfc
outl 0xcf8 0x8000ea04
outw 0xcfc 0x7
outl 0xcf8 0x8000ea04
inw 0xcfc
outl 0xcf8 0x8000e800
inw 0xcfc
outl 0xcf8 0x8000e820
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000e820
inl 0xcfc
outl 0xcf8 0x8000e820
outl 0xcfc 0xc041
outl 0xcf8 0x8000e804
inw 0xcfc
outl 0xcf8 0x8000e804
outw 0xcfc 0x7
outl 0xcf8 0x8000e804
inw 0xcfc
outl 0xcf8 0x8000fa00
inw 0xcfc
outl 0xcf8 0x8000fa20
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000fa20
inl 0xcfc
outl 0xcf8 0x8000fa20
outl 0xcfc 0xc061
outl 0xcf8 0x8000fa24
outl 0xcfc 0xffffffff
outl 0xcf8 0x8000fa24
inl 0xcfc
outl 0xcf8 0x8000fa24
outl 0xcfc 0xe0001000
outl 0xcf8 0x8000fa04
inw 0xcfc
outl 0xcf8 0x8000fa04
outw 0xcfc 0x7
outl 0xcf8 0x8000fa04
inw 0xcfc
outl 0xcf8 0x8000ea20
outl 0xcfc 0x625f69a0
outb 0xc040 0x46
outb 0xc040 0x69
inb 0xc000
outb 0xc040 0x46
clock_step
outb 0xc040 0x69
clock_step
write 0x0 0x4 0x64657669
write 0x69766560 0x8 0x000000ff6c46f228
write 0x69766568 0x8 0x2d323334319c6c65
write 0xff000000 0x8 0x000000ff6c6f6766
write 0xff000008 0x8 0x8d6c65652d736400
outb 0xc040 0x69
outl 0xcf8 0x8000ef76
outw 0xcfc 0x6563
outb 0xc040 0x46
clock_step
outb 0xc040 0x69
inb 0xc000
clock_step
write 0x4 0x4 0x64657669
write 0x69766560 0x8 0x000000ff6c46f228
write 0x69766568 0x8 0x2d323334319c6c65
write 0xff000000 0x8 0x000000ff6c6f6766
write 0xff000008 0x8 0x8d6c65652d736400
outb 0xc040 0x69
outw 0xc003 0x6769
outb 0xc040 0x69
readq 0xe0000074
outb 0xc040 0x46
clock_step
outb 0xc040 0x69
clock_step
write 0x8 0x4 0x00000100
write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
write 0xff000000 0x8 0x6465766963656d69
write 0xff000008 0x8 0x740d00699b652d63
write 0x69766560 0x8 0x000000ff6c46f228
write 0x69766568 0x8 0x2d323334319c6c65
clock_step
write 0xc 0x4 0x000000ff
write 0xff000000 0x8 0x0000010000000069
write 0xff000008 0x8 0x636c395f61707269
write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
outw 0xc003 0x6f00
outb 0xc040 0x69
outl 0xc053 0x6378616d
clock_step
write 0x10 0x4 0x000000ff
write 0xff000000 0x8 0x6465766963656d69
write 0xff000008 0x8 0x740d00699b652d63
write 0x69766560 0x8 0x000000ff6c46f228
write 0x69766568 0x8 0x2d323334319c6c65
outb 0xc051 0x6d
outb 0xc04f 0x61
outb 0xc040 0x69
clock_step
write 0x14 0x4 0x000000ff
write 0xff000000 0x8 0x0000010000000069
write 0xff000008 0x8 0x636c395f61707269
write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
EOF
```
# Additional information
The crash report triggered by the reproducer is:
```
[R +0.033173] outl 0xcf8 0x8000e900
[S +0.033189] [R +0.033195] inw 0xcfc
[S +0.033205] [R +0.033212] outl 0xcf8 0x8000e920
[S +0.033218] [R +0.033222] outl 0xcfc 0xffffffff
[S +0.033231] [R +0.033235] outl 0xcf8 0x8000e920
[S +0.033241] [R +0.033245] inl 0xcfc
[S +0.033250] [R +0.033255] outl 0xcf8 0x8000e920
[S +0.033261] [R +0.033265] outl 0xcfc 0xc001
[S +0.033271] [R +0.033275] outl 0xcf8 0x8000e904
[S +0.033281] [R +0.033285] inw 0xcfc
[S +0.033290] [R +0.033295] outl 0xcf8 0x8000e904
[S +0.033300] [R +0.033306] outw 0xcfc 0x7
[S +0.033755] [R +0.033767] outl 0xcf8 0x8000e904
[S +0.033774] [R +0.033779] inw 0xcfc
[S +0.033785] [R +0.033792] outl 0xcf8 0x8000ef00
[S +0.033798] [R +0.033802] inw 0xcfc
[S +0.033808] [R +0.033813] outl 0xcf8 0x8000ef10
[S +0.033818] [R +0.033840] outl 0xcfc 0xffffffff
[S +0.033848] [R +0.033853] outl 0xcf8 0x8000ef10
[S +0.033859] [R +0.033864] inl 0xcfc
[S +0.033870] [R +0.033875] outl 0xcf8 0x8000ef10
[S +0.033880] [R +0.033884] outl 0xcfc 0xe0000000
[S +0.033891] [R +0.033895] outl 0xcf8 0x8000ef04
[S +0.033901] [R +0.033904] inw 0xcfc
[S +0.033909] [R +0.033916] outl 0xcf8 0x8000ef04
[S +0.033922] [R +0.033926] outw 0xcfc 0x7
[S +0.034381] [R +0.034389] outl 0xcf8 0x8000ef04
[S +0.034395] [R +0.034399] inw 0xcfc
[S +0.034405] [R +0.034412] outl 0xcf8 0x8000ea00
[S +0.034417] [R +0.034421] inw 0xcfc
[S +0.034427] [R +0.034431] outl 0xcf8 0x8000ea20
[S +0.034437] [R +0.034441] outl 0xcfc 0xffffffff
[S +0.034448] [R +0.034452] outl 0xcf8 0x8000ea20
[S +0.034457] [R +0.034463] inl 0xcfc
[S +0.034469] [R +0.034474] outl 0xcf8 0x8000ea20
[S +0.034480] [R +0.034484] outl 0xcfc 0xc021
[S +0.034490] [R +0.034494] outl 0xcf8 0x8000ea04
[S +0.034500] [R +0.034504] inw 0xcfc
[S +0.034509] [R +0.034515] outl 0xcf8 0x8000ea04
[S +0.034521] [R +0.034525] outw 0xcfc 0x7
[S +0.034948] [R +0.034955] outl 0xcf8 0x8000ea04
[S +0.034961] [R +0.034965] inw 0xcfc
[S +0.034971] [R +0.034989] outl 0xcf8 0x8000e800
[S +0.034996] [R +0.035000] inw 0xcfc
[S +0.035005] [R +0.035010] outl 0xcf8 0x8000e820
[S +0.035016] [R +0.035020] outl 0xcfc 0xffffffff
[S +0.035027] [R +0.035033] outl 0xcf8 0x8000e820
[S +0.035039] [R +0.035043] inl 0xcfc
[S +0.035048] [R +0.035053] outl 0xcf8 0x8000e820
[S +0.035059] [R +0.035065] outl 0xcfc 0xc041
[S +0.035071] [R +0.035075] outl 0xcf8 0x8000e804
[S +0.035081] [R +0.035084] inw 0xcfc
[S +0.035089] [R +0.035094] outl 0xcf8 0x8000e804
[S +0.035100] [R +0.035103] outw 0xcfc 0x7
[S +0.035525] [R +0.035532] outl 0xcf8 0x8000e804
[S +0.035538] [R +0.035542] inw 0xcfc
[S +0.035548] [R +0.035553] outl 0xcf8 0x8000fa00
[S +0.035558] [R +0.035562] inw 0xcfc
[S +0.035567] [R +0.035572] outl 0xcf8 0x8000fa20
[S +0.035578] [R +0.035581] outl 0xcfc 0xffffffff
[S +0.035589] [R +0.035594] outl 0xcf8 0x8000fa20
[S +0.035600] [R +0.035604] inl 0xcfc
[S +0.035609] [R +0.035613] outl 0xcf8 0x8000fa20
[S +0.035618] [R +0.035623] outl 0xcfc 0xc061
[S +0.035629] [R +0.035633] outl 0xcf8 0x8000fa24
[S +0.035638] [R +0.035642] outl 0xcfc 0xffffffff
[S +0.035648] [R +0.035652] outl 0xcf8 0x8000fa24
[S +0.035658] [R +0.035664] inl 0xcfc
[S +0.035669] [R +0.035673] outl 0xcf8 0x8000fa24
[S +0.035679] [R +0.035683] outl 0xcfc 0xe0001000
[S +0.035689] [R +0.035696] outl 0xcf8 0x8000fa04
[S +0.035702] [R +0.035706] inw 0xcfc
[S +0.035711] [R +0.035716] outl 0xcf8 0x8000fa04
[S +0.035722] [R +0.035725] outw 0xcfc 0x7
[S +0.036402] [R +0.036412] outl 0xcf8 0x8000fa04
[S +0.036418] [R +0.036422] inw 0xcfc
[S +0.036434] [R +0.036442] outl 0xcf8 0x8000ea20
[S +0.036448] [R +0.036463] outl 0xcfc 0x625f69a0
[S +0.036906] [I +0.036981] CLOSED
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x46
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] inb 0xc000
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x46
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x0 0x4 0x64657669
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x000000ff6c6f6766
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x8d6c65652d736400
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outl 0xcf8 0x8000ef76
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outw 0xcfc 0x6563
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x46
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] inb 0xc000
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x4 0x4 0x64657669
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x000000ff6c6f6766
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x8d6c65652d736400
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outw 0xc003 0x6769
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] readq 0xe0000074
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x46
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x8 0x4 0x00000100
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x6465766963656d69
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x740d00699b652d63
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xc 0x4 0x000000ff
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x0000010000000069
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x636c395f61707269
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outw 0xc003 0x6f00
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outl 0xc053 0x6378616d
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x10 0x4 0x000000ff
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x6465766963656d69
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x740d00699b652d63
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766560 0x8 0x000000ff6c46f228
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x69766568 0x8 0x2d323334319c6c65
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc051 0x6d
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc04f 0x61
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] outb 0xc040 0x69
x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] clock_step
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x14 0x4 0x000000ff
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000000 0x8 0x0000010000000069
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0xff000008 0x8 0x636c395f61707269
[DMA] x86_64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[R +0.000000] write 0x10000 0x10 0x000000ff6c46f2282d00363939333336
qemu-fuzz-x86_64: ../hw/usb/core.c:744: struct USBEndpoint *usb_ep_get(USBDevice *, int, int): Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
==892641== ERROR: libFuzzer: deadly signal
#0 0x557dd985fc41 in __sanitizer_print_stack_trace (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x20b2c41) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#1 0x557dd97cfa58 in fuzzer::PrintStackTrace() (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2022a58) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#2 0x557dd97b5ae3 in fuzzer::Fuzzer::CrashCallback() (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2008ae3) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#3 0x7fd7e623c45f (/lib/x86_64-linux-gnu/libc.so.6+0x3c45f) (BuildId: d320ce4e63925d698610ed423fc4b1f0e8ed51f1)
#4 0x7fd7e629152a in __pthread_kill_implementation nptl/pthread_kill.c:43:17
#5 0x7fd7e629152a in __pthread_kill_internal nptl/pthread_kill.c:78:10
#6 0x7fd7e629152a in pthread_kill nptl/pthread_kill.c:89:10
#7 0x7fd7e623c3b5 in raise signal/../sysdeps/posix/raise.c:26:13
#8 0x7fd7e622287b in abort stdlib/abort.c:79:7
#9 0x7fd7e622279a in __assert_fail_base assert/assert.c:92:3
#10 0x7fd7e6233b65 in __assert_fail assert/assert.c:101:3
#11 0x557dda3b67c6 in usb_ep_get /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/core.c:744:5
#12 0x557dda3d8820 in uhci_handle_td /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:819:14
#13 0x557dda3d41ed in uhci_process_frame /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:1022:15
#14 0x557dda3cbf7e in uhci_frame_timer /home/hypervisor/qemu_fuzz/qemu/build2/../hw/usb/hcd-uhci.c:1121:9
#15 0x557ddb90c0ff in timerlist_run_timers /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:576:9
#16 0x557ddb90d3e8 in qemu_clock_run_timers /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:590:12
#17 0x557ddb90d3e8 in qemu_clock_advance_virtual_time /home/hypervisor/qemu_fuzz/qemu/build2/../util/qemu-timer.c:696:9
#18 0x557dda67fa2f in qtest_process_command /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:722:9
#19 0x557dda67b3bb in qtest_process_inbuf /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:776:9
#20 0x557dda67acf6 in qtest_server_inproc_recv /home/hypervisor/qemu_fuzz/qemu/build2/../system/qtest.c:907:9
#21 0x557ddb5fa3e2 in qtest_sendf /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/libqtest.c:640:5
#22 0x557ddb5fa4f4 in qtest_clock_step_next /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/libqtest.c:1009:5
#23 0x557ddb67c2ef in generic_fuzz /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/fuzz/generic_fuzz.c:667:13
#24 0x557ddb66e807 in LLVMFuzzerTestOneInput /home/hypervisor/qemu_fuzz/qemu/build2/../tests/qtest/fuzz/fuzz.c:158:5
#25 0x557dd97b6f52 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2009f52) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#26 0x557dd97a1080 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1ff4080) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#27 0x557dd97a6d07 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1ff9d07) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#28 0x557dd97d0292 in main (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x2023292) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
#29 0x7fd7e6223a8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#30 0x7fd7e6223b48 in __libc_start_main csu/../csu/libc-start.c:360:3
#31 0x557dd979b884 in _start (/home/hypervisor/qemu_fuzz/qemu/build2/qemu-fuzz-x86_64+0x1fee884) (BuildId: 1208fb4c12f2da2381e7763dabbbdabaf2db65e5)
```
|