blob: 7f1c55807612bd83620e18d9cffc85df151a542f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
id = 2327
title = "negative shift exponent in cirrus_colorexpand_pattern_transp_0_24()"
state = "opened"
created_at = "2024-05-06T06:20:05.860Z"
closed_at = "n/a"
labels = ["Fuzzer", "device:graphics"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2327"
host-os = "Ubuntu 22.04"
host-arch = "x86-64"
qemu-version = "commit 248f6f62df073a3b4"
guest-os = "n/a"
guest-arch = "arm"
description = """My fuzzer detected a runtime error in cirrus_colorexpand_pattern_transp_0_24()
The stack trace is:
```
../hw/display/cirrus_vga_rop2.h:216:23: runtime error: shift exponent -2 is negative
#0 0x5589a028c89a in cirrus_colorexpand_pattern_transp_0_24 hw/display/cirrus_vga_rop2.h:216:23
#1 0x5589a031e239 in cirrus_bitblt_common_patterncopy hw/display/cirrus_vga.c:689:5
#2 0x5589a032735d in cirrus_bitblt_cputovideo_next hw/display/cirrus_vga.c:820:13
#3 0x5589a032cde9 in cirrus_linear_write hw/display/cirrus_vga.c:2365:13
#4 0x5589a2982823 in memory_region_write_accessor system/memory.c:497:5
#5 0x5589a2981f05 in access_with_adjusted_size system/memory.c:573:18
#6 0x5589a297fe69 in memory_region_dispatch_write system/memory.c:1521:16
#7 0x5589a2a2193e in flatview_write_continue_step system/physmem.c:2749:18
#8 0x5589a2a211d4 in flatview_write_continue system/physmem.c:2779:19
#9 0x5589a29f9cfb in flatview_write system/physmem.c:2810:12
#10 0x5589a29f97c8 in address_space_write system/physmem.c:2930:18
...
```"""
reproduce = """Arguments:\\
export QEMU_ARGS="-display none -machine accel=qtest, -m 512M -machine\\
q35 -nodefaults -device cirrus-vga -display vnc=localhost:99 -L ../pc-bios/"\\
The base addresses of memory regions:
* cirrus-io, 0x3b0
* cirrus-low-memory, 0xa0000
* cirrus-linear-io, 0xe0000000
* cirrus-bitblt-mmio, 0xe1000000
* cirrus-mmio, 0xe2000000
Reproducer:
```
writeb 0xe2000108 0x642a8d58
writeb 0xe2000117 0x335af91c
writeb 0xe2000118 0x765861ed
writeb 0xe200010d 0x7c3af934
writeb 0xe2000140 0x33f13baf
clock_step
writeb 0xe01f0e68 0x6ea3696c
writeb 0xe13bc720 0x11bb09ba
readb 0xe2000133
writeb 0xe033629b 0x80f19dd
writeb 0xe134bba7 0x1eb198f9
readb 0xe2000680
writeb 0xe2000b84 0x3f0591fc
clock_step
writeb 0xe003469e 0xdbd627e
writeb 0xe114f2bc 0x41adfe48
readb 0xe2000cde
readb 0xb269d
writeb 0xe1368066 0x3c9ab77
readb 0xe12a7fe1
writeb 0xe0191988 0x7e18b0d1
EOF
```"""
additional = """Ack: Chuhong Yuan (hslester96@gmail.com)"""
|