mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-18 05:28:36 -07:00
09bbdb89bc
Alexander reported an issue in gic_get_current_cpu() using the
fuzzer. Yet another "deref current_cpu with QTest" bug, reproducible
doing:
$ echo readb 0xf03ff000 | qemu-system-arm -M npcm750-evb,accel=qtest -qtest stdio
[I 1611849440.651452] OPENED
[R +0.242498] readb 0xf03ff000
hw/intc/arm_gic.c:63:29: runtime error: member access within null pointer of type 'CPUState' (aka 'struct CPUState')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/intc/arm_gic.c:63:29 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3719691==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000082a0 (pc 0x5618790ac882 bp 0x7ffca946f4f0 sp 0x7ffca946f4a0 T0)
==3719691==The signal is caused by a READ memory access.
#0 0x5618790ac882 in gic_get_current_cpu hw/intc/arm_gic.c:63:29
#1 0x5618790a8901 in gic_dist_readb hw/intc/arm_gic.c:955:11
#2 0x5618790a7489 in gic_dist_read hw/intc/arm_gic.c:1158:17
#3 0x56187adc573b in memory_region_read_with_attrs_accessor softmmu/memory.c:464:9
#4 0x56187ad7903a in access_with_adjusted_size softmmu/memory.c:552:18
#5 0x56187ad766d6 in memory_region_dispatch_read1 softmmu/memory.c:1426:16
#6 0x56187ad758a8 in memory_region_dispatch_read softmmu/memory.c:1449:9
#7 0x56187b09e84c in flatview_read_continue softmmu/physmem.c:2822:23
#8 0x56187b0a0115 in flatview_read softmmu/physmem.c:2862:12
#9 0x56187b09fc9e in address_space_read_full softmmu/physmem.c:2875:18
#10 0x56187aa88633 in address_space_read include/exec/memory.h:2489:18
#11 0x56187aa88633 in qtest_process_command softmmu/qtest.c:558:13
#12 0x56187aa81881 in qtest_process_inbuf softmmu/qtest.c:797:9
#13 0x56187aa80e02 in qtest_read softmmu/qtest.c:809:5
current_cpu is NULL because QTest accelerator does not use CPU.
Fix by skipping the check and returning the first CPU index when
QTest accelerator is used, similarly to commit
|
||
|---|---|---|
| .. | ||
| allwinner-a10-pic.c | ||
| apic.c | ||
| apic_common.c | ||
| arm_gic.c | ||
| arm_gic_common.c | ||
| arm_gic_kvm.c | ||
| arm_gicv2m.c | ||
| arm_gicv3.c | ||
| arm_gicv3_common.c | ||
| arm_gicv3_cpuif.c | ||
| arm_gicv3_dist.c | ||
| arm_gicv3_its_common.c | ||
| arm_gicv3_its_kvm.c | ||
| arm_gicv3_kvm.c | ||
| arm_gicv3_redist.c | ||
| armv7m_nvic.c | ||
| aspeed_vic.c | ||
| bcm2835_ic.c | ||
| bcm2836_control.c | ||
| etraxfs_pic.c | ||
| exynos4210_combiner.c | ||
| exynos4210_gic.c | ||
| gic_internal.h | ||
| gicv3_internal.h | ||
| grlib_irqmp.c | ||
| heathrow_pic.c | ||
| i8259.c | ||
| i8259_common.c | ||
| ibex_plic.c | ||
| imx_avic.c | ||
| imx_gpcv2.c | ||
| intc.c | ||
| ioapic.c | ||
| ioapic_common.c | ||
| Kconfig | ||
| lm32_pic.c | ||
| loongson_liointc.c | ||
| meson.build | ||
| mips_gic.c | ||
| omap_intc.c | ||
| ompic.c | ||
| openpic.c | ||
| openpic_kvm.c | ||
| pl190.c | ||
| pnv_xive.c | ||
| pnv_xive_regs.h | ||
| ppc-uic.c | ||
| puv3_intc.c | ||
| realview_gic.c | ||
| rx_icu.c | ||
| s390_flic.c | ||
| s390_flic_kvm.c | ||
| sh_intc.c | ||
| sifive_clint.c | ||
| sifive_plic.c | ||
| slavio_intctl.c | ||
| spapr_xive.c | ||
| spapr_xive_kvm.c | ||
| trace-events | ||
| trace.h | ||
| vgic_common.h | ||
| xics.c | ||
| xics_kvm.c | ||
| xics_pnv.c | ||
| xics_spapr.c | ||
| xilinx_intc.c | ||
| xive.c | ||
| xlnx-pmu-iomod-intc.c | ||
| xlnx-zynqmp-ipi.c | ||