FPE in npcm7xx_adc_convert
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Reproducer:
cat << EOF | ./qemu-
-accel qtest -qtest stdio
write 0xf000c000 0x4 0x02400200
clock_step
EOF
Trace:
../hw/adc/
SUMMARY: UndefinedBehavi
AddressSanitize
=======
==717962==ERROR: AddressSanitizer: FPE on unknown address 0x55901aa6e67a (pc 0x55901aa6e67a bp 0x7fff0ac087e0 sp 0x7fff0ac087a0 T0)
#0 0x55901aa6e67a in npcm7xx_adc_convert /hw/adc/
#1 0x55901aa6e67a in npcm7xx_
#2 0x55901ceb847e in timerlist_
#3 0x55901c05d804 in qtest_clock_warp /softmmu/
#4 0x55901c059781 in qtest_process_
#5 0x55901c051b97 in qtest_process_inbuf /softmmu/
#6 0x55901c8a2286 in fd_chr_read /chardev/
#7 0x7fa5c43f1aae in g_main_
#8 0x55901cefd363 in glib_pollfds_poll /util/main-
#9 0x55901cefd363 in os_host_
#10 0x55901cefd363 in main_loop_wait /util/main-
#11 0x55901bfb8599 in qemu_main_loop /softmmu/
#12 0x55901a2451fd in main /softmmu/
#13 0x7fa5c3e96cc9 in __libc_start_main csu/../
#14 0x55901a198bc9 in _start (/home/
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /hw/adc/
tags: | added: fuzzer |
Cc'ing supporters:
$ ./scripts/ get_maintainer. pl -f hw/arm/npcm7xx.c
Havard Skinnemoen <email address hidden> (supporter:Nuvoton NPCM7xx)
Tyrone Ting <email address hidden> (supporter:Nuvoton NPCM7xx)
On 1/29/21 3:36 AM, Alexander Bulekov wrote: system- aarch64 -M npcm750-evb \ npcm7xx_ adc.c:60: 51: runtime error: division by zero orSanitizer: undefined-behavior ../hw/adc/ npcm7xx_ adc.c:60: 51 in r:DEADLYSIGNAL ======= ======= ======= ======= ======= ======= ======= ======= == npcm7xx_ adc.c:60: 51 adc_convert_ done /hw/adc/ npcm7xx_ adc.c:106: 15 run_timers /util/qemu- timer.c: 574:9 qtest.c: 356:9 command /softmmu/ qtest.c: 752:9 qtest.c: 797:9 char-fd. c:68:9 context_ dispatch (/usr/lib/ x86_64- linux-gnu/ libglib- 2.0.so. 0+0x51aae) loop.c: 232:9 main_loop_ wait /util/main- loop.c: 255:5 loop.c: 531:11 runstate. c:721:9 main.c: 50:5 csu/libc- start.c: 308:16 alxndr/ Development/ qemu/build/ qemu-system- aarch64+ 0x3350bc9) npcm7xx_ adc.c:60: 51 in npcm7xx_adc_convert
> Public bug reported:
>
> Reproducer:
> cat << EOF | ./qemu-
> -accel qtest -qtest stdio
> write 0xf000c000 0x4 0x02400200
> clock_step
> EOF
>
> Trace:
> ../hw/adc/
> SUMMARY: UndefinedBehavi
> AddressSanitize
> =======
> ==717962==ERROR: AddressSanitizer: FPE on unknown address 0x55901aa6e67a (pc 0x55901aa6e67a bp 0x7fff0ac087e0 sp 0x7fff0ac087a0 T0)
> #0 0x55901aa6e67a in npcm7xx_adc_convert /hw/adc/
> #1 0x55901aa6e67a in npcm7xx_
> #2 0x55901ceb847e in timerlist_
> #3 0x55901c05d804 in qtest_clock_warp /softmmu/
> #4 0x55901c059781 in qtest_process_
> #5 0x55901c051b97 in qtest_process_inbuf /softmmu/
> #6 0x55901c8a2286 in fd_chr_read /chardev/
> #7 0x7fa5c43f1aae in g_main_
> #8 0x55901cefd363 in glib_pollfds_poll /util/main-
> #9 0x55901cefd363 in os_host_
> #10 0x55901cefd363 in main_loop_wait /util/main-
> #11 0x55901bfb8599 in qemu_main_loop /softmmu/
> #12 0x55901a2451fd in main /softmmu/
> #13 0x7fa5c3e96cc9 in __libc_start_main csu/../
> #14 0x55901a198bc9 in _start (/home/
>
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: FPE /hw/adc/
The ADC realization in npcm7xx_realize is incomplete, vref/iref
properties are not set, thus 0.
Looking at the qtests (npcm7xx_ adc-test. c) these are set via
'qom-set' QMP calls.
Assuming vref/iref are constant on a board, shouldn't we have adc_realize( ) method checking these properties are
a npcm7xx_
set, returning a proper error message if not?
Thanks,
Phil.