qemu-3.1.0-rc0: tcg.c crash in temp_load
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
QEMU version:
-------------
qemu-3.1.0-rc0 compiled from sources (earlier versions also affected)
Summary:
--------
TCG crashes in i386 and x86_64 when it tries to execute some specific illegal instructions. When running full OS emulation, both the guest system and QEMU crash.
The issue has been reproduced in two scenarios:
Ubuntu x64 host running Debian x86 guest with the following command line: qemu-system-x86_64 -m 4G debian.qcow
When the attached ELF file is executed inside the guest, QEMU crashes.
It can also be reproduced from the command line:
$ qemu-i386 tcg_crash.elf
/home/alberto/
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
zsh: segmentation fault (core dumped) ../qemu-
GDB backtrace:
(gdb) bt
#0 0x0000000060206488 in raise ()
#1 0x0000000060206b8a in abort ()
#2 0x0000000060007016 in temp_load (s=s@entry=
at /home/alberto/
#3 0x000000006000a4d9 in tcg_reg_alloc_op (op=0x62808c20, s=<optimized out>) at /home/alberto/
#4 tcg_gen_code (s=<optimized out>, tb=tb@entry=
#5 0x000000006003ef9a in tb_gen_code (cpu=cpu@
at /home/alberto/
#6 0x000000006003d979 in tb_find (cf_mask=0, tb_exit=0, last_tb=0x0, cpu=0x0) at /home/alberto/
#7 cpu_exec (cpu=cpu@
#8 0x000000006006e1a0 in cpu_loop (env=env@
#9 0x00000000600037c5 in main (argc=2, argv=0x7fffffff
(gdb)
Testcase:
---------
Find ELF file attached.
tags: | added: tcg |
Changed in qemu: | |
status: | Fix Committed → Fix Released |
Can you please re-test on the current master, I think this was fixed by:
commit e84fcd7f662a0d8 198703f6f89416d 7ac2c32767
Author: Richard Henderson <email address hidden>
Date: Tue Nov 13 20:35:10 2018 +0100
target/i386: Generate #UD when applying LOCK to a register destination
Testing on my box:
12:14:20 [alex@idun: ~/l/qemu. git] master + ./i386- linux-user/ qemu-i386 ~/tcg_crash.elf linux-user/ qemu-i386 ~/t…” terminated by signal SIGILL (Illegal instruction)
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
fish: “./i386-