From: Alexander Bulekov <alxndr@bu.edu>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: Eduardo Habkost <ehabkost@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
qemu-devel@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>,
Richard Henderson <rth@twiddle.net>
Subject: Re: [RFC PATCH v2] hw/i386/vmport: Allow QTest use without crashing
Date: Sat, 23 May 2020 22:22:36 -0400 [thread overview]
Message-ID: <20200524022230.rij2ehcmerhoj3ur@mozz.bu.edu> (raw)
In-Reply-To: <20200518103113.9882-1-f4bug@amsat.org>
On 200518 1231, Philippe Mathieu-Daudé wrote:
> Trying libFuzzer on the vmport device, we get:
>
> AddressSanitizer:DEADLYSIGNAL
> =================================================================
> ==29476==ERROR: AddressSanitizer: SEGV on unknown address 0x000000008840 (pc 0x56448bec4d79 bp 0x7ffeec9741b0 sp 0x7ffeec9740e0 T0)
> ==29476==The signal is caused by a READ memory access.
> #0 0x56448bec4d78 in vmport_ioport_read (qemu-fuzz-i386+0x1260d78)
> #1 0x56448bb5f175 in memory_region_read_accessor (qemu-fuzz-i386+0xefb175)
> #2 0x56448bb30c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
> #3 0x56448bb2ea27 in memory_region_dispatch_read1 (qemu-fuzz-i386+0xecaa27)
> #4 0x56448bb2e443 in memory_region_dispatch_read (qemu-fuzz-i386+0xeca443)
> #5 0x56448b961ab1 in flatview_read_continue (qemu-fuzz-i386+0xcfdab1)
> #6 0x56448b96336d in flatview_read (qemu-fuzz-i386+0xcff36d)
> #7 0x56448b962ec4 in address_space_read_full (qemu-fuzz-i386+0xcfeec4)
>
> X86CPU is NULL because QTest accelerator does not use CPU.
> Fix by returning default values when QTest accelerator is used.
>
Ah - it was QTest. Thank you for this - I would always run into this
crash within a second of fuzzing.
-Alex
prev parent reply other threads:[~2020-05-24 2:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-18 10:31 [RFC PATCH v2] hw/i386/vmport: Allow QTest use without crashing Philippe Mathieu-Daudé
2020-05-21 15:54 ` Paolo Bonzini
2020-05-24 2:22 ` Alexander Bulekov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200524022230.rij2ehcmerhoj3ur@mozz.bu.edu \
--to=alxndr@bu.edu \
--cc=ehabkost@redhat.com \
--cc=f4bug@amsat.org \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).