abort issue locates in hw/usb/hcd-ohci.c:1297:ohci_frame_boundary

Bug #1911216 reported by Gaoning Pan
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Invalid
Undecided
Unassigned

Bug Description

Hello,

I found an assertion failure in hw/usb/hcd-ohci.c:1297

This was found in latest version 5.2.0.

my reproduced environment is as follows:
    Host: ubuntu 18.04
    Guest: ubuntu 18.04

QEMU boot command line:
qemu-system-x86_64 -enable-kvm -boot c -m 4G -drive format=qcow2,file=./ubuntu.img -nic user,hostfwd=tcp:0.0.0.0:5555-:22 -display none -device pci-ohci,id=ohci -device usb-tablet,bus=ohci.0,port=1,id=usbdev1

backtrace is as follows
pwndbg> bt
#0 0x00007fdf392aa438 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007fdf392ac03a in __GI_abort () at abort.c:89
#2 0x000055c613721118 in ohci_frame_boundary (opaque=0x6270000191f0) at hw/usb/hcd-ohci.c:1297
#3 0x000055c6140bdf0e in timerlist_run_timers (timer_list=0x60b00005bcc0) at util/qemu-timer.c:572
#4 0x000055c6140be15a in qemu_clock_run_timers (type=QEMU_CLOCK_VIRTUAL) at util/qemu-timer.c:586
#5 0x000055c6140beac7 in qemu_clock_run_all_timers () at util/qemu-timer.c:672
#6 0x000055c6140a1938 in main_loop_wait (nonblocking=0) at util/main-loop.c:523
#7 0x000055c6125d87e9 in qemu_main_loop () at /home/dell/qemu5-hypervisor/vm/fuzz-seedpool/hcd-ohci/qemu-5.1.0/softmmu/vl.c:1676
#8 0x000055c613f216ea in main (argc=7, argv=0x7fff174cdd28, envp=0x7fff174cdd68) at /home/dell/qemu5-hypervisor/vm/fuzz-seedpool/hcd-ohci/qemu-5.1.0/softmmu/main.c:49
#9 0x00007fdf39295840 in __libc_start_main (main=0x55c613f21699 <main>, argc=7, argv=0x7fff174cdd28, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff174cdd18) at ../csu/libc-start.c:291
#10 0x000055c6120a4349 in _start ()

The poc is attached.

Tags: fuzzer
Revision history for this message
Gaoning Pan (hades0506) wrote :
Revision history for this message
Alexander Bulekov (a1xndr) wrote :

Seems to be the same as OSS-Fuzz Issue 29224

=== Reproducer ===
cat << EOF | ./qemu-system-i386 -machine q35 \
-machine accel=qtest, -m 512M -nodefaults \
-device pci-ohci -display none -qtest stdio
outl 0xcf8 0x80000801
outl 0xcfc 0x16000000
outl 0xcf8 0x80000813
outl 0xcfc 0x23
clock_step
write 0x23000004 0x1 0x84
clock_step
write 0x0 0x1 0x7e
write 0x1 0x1 0xaa
write 0x3 0x1 0x16
write 0x1600aa8a 0x1 0xa0
write 0xa1 0x1 0x80
write 0xa4 0x1 0x20
clock_step
EOF

=== Stack Trace ===
==6351==ERROR: AddressSanitizer: ABRT on unknown address 0x0539000018cf (pc 0x7f675c885438 bp 0x7fff157e6150 sp 0x7fff157e5e68 T0)
#0 raise
#1 abort
#2 ohci_frame_boundary /src/qemu/hw/usb/hcd-ohci.c:1297:13
#3 timerlist_run_timers /src/qemu/util/qemu-timer.c:574:9
#4 qemu_clock_run_timers /src/qemu/util/qemu-timer.c:588:12
#5 qtest_clock_warp /src/qemu/softmmu/qtest.c:356:9
#6 qtest_process_command /src/qemu/softmmu/qtest.c:752:9
#7 qtest_process_inbuf /src/qemu/softmmu/qtest.c:797:9
#8 qtest_server_inproc_recv /src/qemu/softmmu/qtest.c:904:9
#9 send_wrapper /src/qemu/tests/qtest/libqtest.c:1388:5
#10 qtest_sendf /src/qemu/tests/qtest/libqtest.c:438:5
#11 qtest_clock_step_next /src/qemu/tests/qtest/libqtest.c:910:5
#12 op_clock_step /src/qemu/tests/qtest/fuzz/generic_fuzz.c:575:5
#13 generic_fuzz /src/qemu/tests/qtest/fuzz/generic_fuzz.c:681:17

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29176

tags: added: fuzzer
Revision history for this message
Thomas Huth (th-huth) wrote :

Hi! Can you still reproduce this issue with QEMU v6.0 ? At least Alexander's reproducer does not seem to trigger this issue anymore...

Changed in qemu:
status: New → Incomplete
Revision history for this message
Alexander Bulekov (a1xndr) wrote :

OSS-Fuzz still has a functioning reproducer. I'll copy this one over to gitlab

Thomas Huth (th-huth)
Changed in qemu:
status: Incomplete → Confirmed
Revision history for this message
Alexander Bulekov (a1xndr) wrote :

I moved this report over to QEMU's new bug tracker on gitlab.com.
Please continue with the discussion here:

https://gitlab.com/qemu-project/qemu/-/issues/545

Revision history for this message
Thomas Huth (th-huth) wrote :

Thanks for moving it over! ... let's close this one here on Launchpad now.

Changed in qemu:
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.