xhci_find_stream: Assertion `streamid != 0' failed.
Bug #1883729 reported by
Bugs SysSec
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Expired
|
Undecided
|
Unassigned |
Bug Description
To reproduce run the QEMU with the following command line:
```
qemu-system-x86_64 -cdrom hypertrash_
```
QEMU Version:
```
# qemu-5.0.0
$ ./configure --target-
$ x86_64-
QEMU emulator version 5.0.0
Copyright (c) 2003-2020 Fabrice Bellard and the QEMU Project developers
```
Attaching a QTest reproducer. softmmu/ qemu-system- i386 -device nec-usb-xhci -trace usb\* \ drive=mydrive \ file=null- co://,size= 2M,format= raw,if= none \
./i386-
-device usb-audio -device usb-storage,
-drive id=mydrive,
-nodefaults -nographic -qtest stdio < repro
Close to the crash: 3.503068: usb_xhci_ slot_configure slotid 58 3.503074: usb_xhci_ ep_disable slotid 58, epid 2 3.503077: usb_xhci_ ep_enable slotid 58, epid 2 3.503085: usb_xhci_ ep_disable slotid 58, epid 6 3.503088: usb_xhci_ ep_enable slotid 58, epid 6 3.503092: usb_xhci_ ep_disable slotid 58, epid 24 3.503095: usb_xhci_ ep_enable slotid 58, epid 24 3.503099: usb_xhci_ ep_disable slotid 58, epid 25 3.503102: usb_xhci_ ep_enable slotid 58, epid 25 3.503106: usb_xhci_ ep_disable slotid 58, epid 29 3.503109: usb_xhci_ ep_enable slotid 58, epid 29 3.503113: usb_xhci_ ep_disable slotid 58, epid 30 3.503116: usb_xhci_ ep_enable slotid 58, epid 30 3.503121: usb_xhci_ fetch_trb addr 0x0000000000000b20, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 3.503127: usb_xhci_ slot_enable slotid 59 3.503130: usb_xhci_ fetch_trb addr 0x0000000000000b30, CR_SET_TR_DEQUEUE, p 0x0000000000000000, s 0x00000000, c 0x00004300 3.503135: usb_xhci_ fetch_trb addr 0x0000000000000b40, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 3.503140: usb_xhci_ slot_enable slotid 60 3.503143: usb_xhci_ fetch_trb addr 0x0000000000000b50, CR_EVALUATE_ CONTEXT, p 0x0000000000000000, s 0x00000000, c 0x00003600 3.503149: usb_xhci_ fetch_trb addr 0x0000000000000b60, CR_STOP_ENDPOINT, p 0x0000000000000000, s 0x00000000, c 0x3afd3c00 3.503154: usb_xhci_ ep_stop slotid 58, epid 29 3.503159: usb_xhci_ ep_state slotid 58, epid 29, running -> stopped 3.503163: usb_xhci_ fetch_trb addr 0x0000000000000b70, CR_ENABLE_SLOT, p 0x0000000000000000, s 0x00000000, c 0x00002700 3.503168: usb_xhci_ slot_enable slotid 61 3.503171: usb_xhci_ fetch_trb addr 0x0000000000000b80, CR_SET_TR_DEQUEUE, p 0x0000000000000000, s 0x00000000, c 0x3afd4300 3.503177: usb_xhci_ ep_set_ dequeue slotid 58, epid 29, streamid 0, ptr 0x0000000000000000 hcd-xhci. c:1016: XHCIStreamContext *xhci_find_ stream( XHCIEPContext *, unsigned int, uint32_t *): Assertion `streamid != 0' failed.
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
21000@159711171
qemu-system-i386: hw/usb/
Aborted