From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E9C4C4338F for ; Sat, 21 Aug 2021 02:17:09 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 66CB26117A for ; Sat, 21 Aug 2021 02:17:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 66CB26117A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=bugs.launchpad.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=nongnu.org Received: from localhost ([::1]:53318 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mHGZH-0003cq-5Z for qemu-devel@archiver.kernel.org; Fri, 20 Aug 2021 22:17:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33560) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mHGXv-0002rG-3c for qemu-devel@nongnu.org; Fri, 20 Aug 2021 22:15:43 -0400 Received: from smtp-relay-services-1.canonical.com ([185.125.188.251]:47590) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mHGXs-00036Z-19 for qemu-devel@nongnu.org; Fri, 20 Aug 2021 22:15:42 -0400 Received: from loganberry.canonical.com (loganberry.canonical.com [91.189.90.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp-relay-services-1.canonical.com (Postfix) with ESMTPSA id 4195D3F7D5 for ; Sat, 21 Aug 2021 02:15:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=launchpad.net; s=20210803; t=1629512135; bh=fkNeuxyHde/KE0AGj6QuFXfh9Bxo8AiZZS6Smsn8enA=; h=MIME-Version:Content-Type:Date:From:To:Reply-To:References: Message-Id:Subject; b=bH9tPMmHLMYUoxYYT3S9AhvkJp4Z/cd8laBgb+7Ko15MRoIotiPvxHtxXpMT6SDPP ueDCrn358PEUFaqf6kHCa1EvIUGRBDPYx0a3EdkZFIZKXbAo8TY9zT1GsAVZcjfFgd IqhHgtl5TazOnKMYMVYjKuiqTBE5KFBh0cOQ9rbXrMcMpf5/7tRKFn1Xpf9IitK8zP 2fZkZbVd03/ij9fdYfZiYM2Er1LaizrFObJMpZmh9D625LaNJJZQWgsawLg/HAs6Lh 2u0vP4OV/MgAaSHptG/L/A2R2fP0IsCVx21q9cioaJqICNq5sr960BPg82JgSdxn8S PcZv908pc7g+w== Received: from loganberry.canonical.com (localhost [127.0.0.1]) by loganberry.canonical.com (Postfix) with ESMTP id EDFB62E8167 for ; Sat, 21 Aug 2021 02:15:34 +0000 (UTC) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Date: Sat, 21 Aug 2021 02:10:21 -0000 From: Alexander Bulekov <1890159@bugs.launchpad.net> To: qemu-devel@nongnu.org X-Launchpad-Notification-Type: bug X-Launchpad-Bug: product=qemu; status=Fix Committed; importance=Undecided; assignee=None; X-Launchpad-Bug-Information-Type: Public X-Launchpad-Bug-Private: no X-Launchpad-Bug-Security-Vulnerability: no X-Launchpad-Bug-Commenters: a1xndr th-huth X-Launchpad-Bug-Reporter: Alexander Bulekov (a1xndr) X-Launchpad-Bug-Modifier: Alexander Bulekov (a1xndr) References: <159646522011.3204.4947256792028563402.malonedeb@gac.canonical.com> Message-Id: <162951182150.27707.7463600617230492988.malone@wampee.canonical.com> Subject: [Bug 1890159] Re: Assertion failure in net_tx_pkt_add_raw_fragment through vmxnet3 X-Launchpad-Message-Rationale: Subscriber (QEMU) @qemu-devel-ml X-Launchpad-Message-For: qemu-devel-ml Precedence: bulk X-Generated-By: Launchpad (canonical.com); Revision="25edfd4b3e79d9ee9d9c3a750eb93e4d41d56c9e"; Instance="production" X-Launchpad-Hash: 06f3851af9d723956ede4442d4062f97499028ae Received-SPF: pass client-ip=185.125.188.251; envelope-from=noreply@launchpad.net; helo=smtp-relay-services-1.canonical.com X-Spam_score_int: -42 X-Spam_score: -4.3 X-Spam_bar: ---- X-Spam_report: (-4.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Bug 1890159 <1890159@bugs.launchpad.net> Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" Looks like this was fixed by 283f0a05e2 ("hw/net/net_tx_pkt: Fix crash detected by fuzzer") ** Changed in: qemu Status: Confirmed =3D> Fix Committed --=20 You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1890159 Title: Assertion failure in net_tx_pkt_add_raw_fragment through vmxnet3 Status in QEMU: Fix Committed Bug description: Hello, Reproducer: cat << EOF | ./i386-softmmu/qemu-system-i386 \ -device vmxnet3 -m 64 -nodefaults -qtest stdio -nographic outl 0xcf8 0x80001010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80001014 outl 0xcfc 0xe0001000 outl 0xcf8 0x80001018 outl 0xcf8 0x80001001 outl 0xcfc 0x3fff3fff outl 0xcf8 0x80001016 outl 0xcfc 0x5c84ff00 outl 0xcf8 0x800010ff write 0x0 0x1 0xe1 write 0x1 0x1 0xfe write 0x2 0x1 0xbe write 0x3 0x1 0xba writeq 0xff001020 0xef0bff5ecafe0000 writel 0xe0000605 0xa7ff845e EOF =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D qemu-system-i386: hw/net/net_tx_pkt.c:382: _Bool net_tx_pkt_add_raw_fragm= ent(struct NetTxPkt *, hwaddr, size_t): Assertion `pkt->max_raw_frags > pkt= ->raw_frags' failed. Aborted =20 #9 0x5607db7efdc0 in net_tx_pkt_add_raw_fragment /home/alxndr/Development= /qemu/general-fuzz/hw/net/net_tx_pkt.c:382:5 #10 0x5607db902ef0 in vmxnet3_process_tx_queue /home/alxndr/Development/q= emu/general-fuzz/hw/net/vmxnet3.c:653:18 #11 0x5607db9021db in vmxnet3_io_bar0_write /home/alxndr/Development/qemu= /general-fuzz/hw/net/vmxnet3.c:1097:9 #12 0x5607da41f193 in memory_region_write_accessor /home/alxndr/Developme= nt/qemu/general-fuzz/softmmu/memory.c:483:5 #13 0x5607da41e637 in access_with_adjusted_size /home/alxndr/Development/= qemu/general-fuzz/softmmu/memory.c:544:18 #14 0x5607da41c256 in memory_region_dispatch_write /home/alxndr/Developme= nt/qemu/general-fuzz/softmmu/memory.c:1466:16 #15 0x5607d97cd4a6 in flatview_write_continue /home/alxndr/Development/qe= mu/general-fuzz/exec.c:3176:23 -Alex To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1890159/+subscriptions