From nobody Sun May 19 02:26:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) client-ip=216.205.24.124; envelope-from=philmd@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) smtp.mailfrom=philmd@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1611850465; cv=none; d=zohomail.com; s=zohoarc; b=YT3+PHPVwsK1XWi884Bu/BLuz4L/vWLTbjrzgUtPNJ9lbhda254A/CjyQN7nl+9mwZB5pRMHs0eNLMBLBlgm81dd6LxOLYvIAMTzoO0U73sC7wVH7xryChIVymVnFqSvKtW+XieEK5zYR+4iZISInG61hM5CEEXFp0BekharijI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1611850465; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:MIME-Version:Message-ID:Subject:To; bh=Vohs2+KlSVFNeHtYycpizObEwEjoJ1/fOO/41o5aITY=; b=b33kUOU6xsbeX7CeF/S4OvIGoVaGGiXWKBytkaZfFfeLBzqmAt6z1dO0dmsz4HAA3krp9+zoqiTE6EcKxBwn4hGngiJ72uOrcQeN7cquWq8mB6ruw74h3M/fWE0HiJsT2V3OyNPPGQvkNwrJKQKa2IWuLBfZ4Uj0jhTV87RYRF4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) smtp.mailfrom=philmd@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.zohomail.com with SMTPS id 1611850465945874.8155606031931; Thu, 28 Jan 2021 08:14:25 -0800 (PST) Received: from mail-ed1-f70.google.com (mail-ed1-f70.google.com [209.85.208.70]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-575-7LbFLce5O3GQ4Bu5PqskMQ-1; Thu, 28 Jan 2021 11:14:23 -0500 Received: by mail-ed1-f70.google.com with SMTP id v19so3399294edx.22 for ; Thu, 28 Jan 2021 08:14:22 -0800 (PST) Return-Path: Return-Path: Received: from x1w.redhat.com (13.red-83-57-169.dynamicip.rima-tde.net. [83.57.169.13]) by smtp.gmail.com with ESMTPSA id lz27sm2464220ejb.50.2021.01.28.08.14.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Jan 2021 08:14:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1611850464; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Vohs2+KlSVFNeHtYycpizObEwEjoJ1/fOO/41o5aITY=; b=SYZGCtq2zkw8U8w7vL/i/Zs51M2bEdN8PvVfyUsE6wTCeIqd5DV2bz7YW9w9/eUX7sNB9Z wKAHw2lITEPLCRjy5K8klPMR70HQuoIO+/jk+Dl7qoDygloPkY6V8UyJ9XZy4DdEnfASAF woonTEbVuLjUTKWW2XXcRot+Xa8Y3T4= X-MC-Unique: 7LbFLce5O3GQ4Bu5PqskMQ-1 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Vohs2+KlSVFNeHtYycpizObEwEjoJ1/fOO/41o5aITY=; b=sjfSFoYY5h68fiTZ5udTqI2opEwOkXi1u4D3GAGAbn9acP0ccUJj0boA7bwUF6yjcI Xlu/rpvfKurrdyL5vutcDjBHWQM1eDFjzIzYwrD3I37ZIWIYB8DgtMoeiyVfxREFh2Qp Lo+GDHjcneg/HfNw7/G2rsQO+ztmm3b8Ur/QhEScByPoSfUunfakxJLhHq8IMhTzGtlH zhNkGY2xZ8mvQdlJp9n64LBAKxlhh9u0lM6fuxgUzLfhigDbUKmb56RBSJi2s6xJLMWS UdZ8rlVKs2aDXmn/7EO/VsxWI5YoYajV1AlA3QzHQJrj0ln4gRN0PIbkwc2rwOq0E8N2 j4uQ== X-Gm-Message-State: AOAM5303caNa72JeyQIXUdz0OpLm3KzsCUCCz9uBnqIhWrPwj73bM64Z SaYdOY7oenJK8e4McYAVhtfMdrmS90hG9GZANOw2K6hAJPCw12oFjxLSTQU8SCero56MHh2DyTo Ej09AOnViWRSpCg== X-Received: by 2002:a17:907:9801:: with SMTP id ji1mr105104ejc.420.1611850460872; Thu, 28 Jan 2021 08:14:20 -0800 (PST) X-Google-Smtp-Source: ABdhPJwETFK6s9x6Et2enzglxqyxoYvDTpxdk3h5aBGxXxI3joXyTiC9FW6ySz2kRhkvp13xaXtuqg== X-Received: by 2002:a17:907:9801:: with SMTP id ji1mr105069ejc.420.1611850460550; Thu, 28 Jan 2021 08:14:20 -0800 (PST) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Paolo Bonzini , Peter Maydell , Thomas Huth , qemu-arm@nongnu.org, Darren Kenny , Eric Auger , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Alexander Bulekov Subject: [PATCH] hw/intc/arm_gic: Allow to use QTest without crashing Date: Thu, 28 Jan 2021 17:14:17 +0100 Message-Id: <20210128161417.3726358-1-philmd@redhat.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=philmd@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) Alexander reported an issue in gic_get_current_cpu() using the fuzzer. Yet another "deref current_cpu with QTest" bug, reproducible doing: $ echo readb 0xf03ff000 | qemu-system-arm -M npcm750-evb,accel=3Dqtest -q= test stdio [I 1611849440.651452] OPENED [R +0.242498] readb 0xf03ff000 hw/intc/arm_gic.c:63:29: runtime error: member access within null pointer= of type 'CPUState' (aka 'struct CPUState') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/intc/arm_gic.c= :63:29 in AddressSanitizer:DEADLYSIGNAL =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D3719691=3D=3DERROR: AddressSanitizer: SEGV on unknown address 0x000= 0000082a0 (pc 0x5618790ac882 bp 0x7ffca946f4f0 sp 0x7ffca946f4a0 T0) =3D=3D3719691=3D=3DThe signal is caused by a READ memory access. #0 0x5618790ac882 in gic_get_current_cpu hw/intc/arm_gic.c:63:29 #1 0x5618790a8901 in gic_dist_readb hw/intc/arm_gic.c:955:11 #2 0x5618790a7489 in gic_dist_read hw/intc/arm_gic.c:1158:17 #3 0x56187adc573b in memory_region_read_with_attrs_accessor softmmu/m= emory.c:464:9 #4 0x56187ad7903a in access_with_adjusted_size softmmu/memory.c:552:18 #5 0x56187ad766d6 in memory_region_dispatch_read1 softmmu/memory.c:14= 26:16 #6 0x56187ad758a8 in memory_region_dispatch_read softmmu/memory.c:144= 9:9 #7 0x56187b09e84c in flatview_read_continue softmmu/physmem.c:2822:23 #8 0x56187b0a0115 in flatview_read softmmu/physmem.c:2862:12 #9 0x56187b09fc9e in address_space_read_full softmmu/physmem.c:2875:18 #10 0x56187aa88633 in address_space_read include/exec/memory.h:2489:18 #11 0x56187aa88633 in qtest_process_command softmmu/qtest.c:558:13 #12 0x56187aa81881 in qtest_process_inbuf softmmu/qtest.c:797:9 #13 0x56187aa80e02 in qtest_read softmmu/qtest.c:809:5 current_cpu is NULL because QTest accelerator does not use CPU. Fix by skipping the check and returning the first CPU index when QTest accelerator is used, similarly to commit c781a2cc423 ("hw/i386/vmport: Allow QTest use without crashing"). Reported-by: Alexander Bulekov Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Alexander Bulekov Reviewed-by: Darren Kenny --- hw/intc/arm_gic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c index af41e2fb448..c33b1c8c4bc 100644 --- a/hw/intc/arm_gic.c +++ b/hw/intc/arm_gic.c @@ -28,6 +28,7 @@ #include "qemu/module.h" #include "trace.h" #include "sysemu/kvm.h" +#include "sysemu/qtest.h" =20 /* #define DEBUG_GIC */ =20 @@ -57,7 +58,7 @@ static const uint8_t gic_id_gicv2[] =3D { =20 static inline int gic_get_current_cpu(GICState *s) { - if (s->num_cpu > 1) { + if (!qtest_enabled() && s->num_cpu > 1) { return current_cpu->cpu_index; } return 0; --=20 2.26.2