* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
@ 2021-03-20 13:14 ` Aaro Koskinen
2021-03-20 14:44 ` Aaro Koskinen
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Aaro Koskinen @ 2021-03-20 13:14 UTC (permalink / raw)
To: qemu-devel
** Description changed:
- A trivial program compiler with QuickBASIC 4.5 with integer overflow
+ A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
- C:\KILLER>type killer.bas
- A% = VAL("99999"):PRINT A%
-
- C:\KILLER>killer.exe
- **
- ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
+ C:\KILLER>type killer.bas
+ A% = VAL("99999"):PRINT A%
+
+ C:\KILLER>killer.exe
+ **
+ ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
New
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
2021-03-20 13:14 ` [Bug 1920602] " Aaro Koskinen
@ 2021-03-20 14:44 ` Aaro Koskinen
2021-03-20 15:41 ` Aaro Koskinen
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Aaro Koskinen @ 2021-03-20 14:44 UTC (permalink / raw)
To: qemu-devel
The program works (in TCQ mode) with QEMU v5.0.0.
QEMU starts crashing with the commit:
commit 975af797f1e04e4d1b1a12f1731141d3770fdbce
Author: Joseph Myers <joseph@codesourcery.com>
Date: Fri May 15 21:21:24 2020 +0000
target/i386: fix IEEE x87 floating-point exception raising
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
New
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
2021-03-20 13:14 ` [Bug 1920602] " Aaro Koskinen
2021-03-20 14:44 ` Aaro Koskinen
@ 2021-03-20 15:41 ` Aaro Koskinen
2021-05-09 20:17 ` Aaro Koskinen
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Aaro Koskinen @ 2021-03-20 15:41 UTC (permalink / raw)
To: qemu-devel
For -enable-kvm I haven't been able to find a working commit. All
versions since v3.1.0 just silently hang with the program.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
New
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
` (2 preceding siblings ...)
2021-03-20 15:41 ` Aaro Koskinen
@ 2021-05-09 20:17 ` Aaro Koskinen
2021-05-09 21:14 ` Philippe Mathieu-Daudé
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Aaro Koskinen @ 2021-05-09 20:17 UTC (permalink / raw)
To: qemu-devel
Attached is a minimal FreeDOS floppy disk to reproduce the TCG crash.
Still reproducible with QEMU v6.0.0:
WARNING: Image format was not specified for 'test-floppy.img' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
SeaBIOS (version rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org)
Booting from Floppy...
................................................123
FreeDOS kernel 2042 (build 2042 OEM:0xfd) [compiled May 11 2016]
Kernel compatibility 7.10 - WATCOMC - FAT32 support
(C) Copyright 1995-2012 Pasquale J. Villani and The FreeDOS Project.
All Rights Reserved. This is free software and comes with ABSOLUTELY NO
WARRANTY; you can redistribute it and/or modify it under the terms of the
GNU General Public License as published by the Free Software Foundation;
either version 2, or (at your option) any later version.
- InitDiskno hard disks detected
FreeCom version 0.84-pre2 XMS_Swap [Aug 28 2006 00:29:00]
A:\>KILLER.EXE
**
ERROR:../accel/tcg/tcg-accel-ops.c:80:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Bail out! ERROR:../accel/tcg/tcg-accel-ops.c:80:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
** Attachment added: "test-floppy.img.gz"
https://bugs.launchpad.net/qemu/+bug/1920602/+attachment/5495920/+files/test-floppy.img.gz
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
New
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
` (3 preceding siblings ...)
2021-05-09 20:17 ` Aaro Koskinen
@ 2021-05-09 21:14 ` Philippe Mathieu-Daudé
2021-05-09 21:42 ` Philippe Mathieu-Daudé
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-05-09 21:14 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: New => Confirmed
** Tags added: i386 tcg
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
Confirmed
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
` (4 preceding siblings ...)
2021-05-09 21:14 ` Philippe Mathieu-Daudé
@ 2021-05-09 21:42 ` Philippe Mathieu-Daudé
2021-05-10 5:34 ` Philippe Mathieu-Daudé
2021-05-15 14:04 ` Thomas Huth
7 siblings, 0 replies; 9+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-05-09 21:42 UTC (permalink / raw)
To: qemu-devel
Since commit 975af797f1e helper_fist_ST0() sets float_flag_invalid.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
Confirmed
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
` (5 preceding siblings ...)
2021-05-09 21:42 ` Philippe Mathieu-Daudé
@ 2021-05-10 5:34 ` Philippe Mathieu-Daudé
2021-05-15 14:04 ` Thomas Huth
7 siblings, 0 replies; 9+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-05-10 5:34 UTC (permalink / raw)
To: qemu-devel
FErr# IRQ raise since bf13bfab084 ("i386: implement IGNNE"):
Change the handling of port F0h writes and FPU exceptions to implement IGNNE.
The implementation mixes a bit what the chipset and processor do in real
hardware, but the effect is the same as what happens with actual FERR#
and IGNNE# pins: writing to port F0h asserts IGNNE# in addition to lowering
FP_IRQ; while clearing the SE bit in the FPU status word deasserts IGNNE#.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
Confirmed
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug 1920602] Re: QEMU crash after a QuickBASIC program integer overflow
2021-03-20 13:08 [Bug 1920602] [NEW] QEMU crash after a QuickBASIC program integer overflow Aaro Koskinen
` (6 preceding siblings ...)
2021-05-10 5:34 ` Philippe Mathieu-Daudé
@ 2021-05-15 14:04 ` Thomas Huth
7 siblings, 0 replies; 9+ messages in thread
From: Thomas Huth @ 2021-05-15 14:04 UTC (permalink / raw)
To: qemu-devel
This is an automated cleanup. This bug report has been moved to QEMU's
new bug tracker on gitlab.com and thus gets marked as 'expired' now.
Please continue with the discussion here:
https://gitlab.com/qemu-project/qemu/-/issues/318
** Changed in: qemu
Status: Confirmed => Expired
** Bug watch added: gitlab.com/qemu-project/qemu/-/issues #318
https://gitlab.com/qemu-project/qemu/-/issues/318
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1920602
Title:
QEMU crash after a QuickBASIC program integer overflow
Status in QEMU:
Expired
Bug description:
A trivial program compiled with QuickBASIC 4.5 with integer overflow
will crash QEMU when ran under MS-DOS 5.0 or FreeDOS 1.2:
C:\KILLER>type killer.bas
A% = VAL("99999"):PRINT A%
C:\KILLER>killer.exe
**
ERROR:../qemu-5.2.0/accel/tcg/tcg-cpus.c:541:tcg_handle_interrupt: assertion failed: (qemu_mutex_iothread_locked())
Aborted
QEMU version v5.2, compiler for ARM, and started with command line:
qemu-system-i386 -curses -cpu 486 -m 1 -drive dos.img
The same test under Ubuntu QEMU and KVM/x86_64 (QEMU emulator version
4.2.1 (Debian 1:4.2-3ubuntu6.14)) will just silently hang the QEMU. On
DOSBOX, the machine does not die and program outputs the value -31073.
The EXE to reproduce the issue is attached.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1920602/+subscriptions
^ permalink raw reply [flat|nested] 9+ messages in thread