FPE in npcm7xx_clk_update_pll

Bug #1913667 reported by Alexander Bulekov
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Undecided
Unassigned

Bug Description

I've been working on integrating the generic-fuzzer with ARM machines on OSS-Fuzz so we can fuzz devices on architectures beyond i386 devices. Since I saw that there is some active development for the Nuvoton machines, I thought it might be useful to fuzz the NPCM750 machine

Reproducer:
cat << EOF | ./qemu-system-aarch64 -M npcm750-evb \
-accel qtest -qtest stdio
write 0xf080100c 0x4 0x00
write 0xf080100c 0x4 0x00
EOF

Trace:
../hw/misc/npcm7xx_clk.c:131:14: runtime error: division by zero
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/misc/npcm7xx_clk.c:131:14 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==717855==ERROR: AddressSanitizer: FPE on unknown address 0x5619201fcd8c (pc 0x5619201fcd8c bp 0x7ffc94214e50 sp 0x7ffc94214e30 T0)
#0 0x5619201fcd8c in npcm7xx_clk_update_pll /hw/misc/npcm7xx_clk.c:131:14
#1 0x5619201ff5dc in npcm7xx_clk_write /hw/misc/npcm7xx_clk.c:799:13
#2 0x5619214781fe in memory_region_write_accessor /softmmu/memory.c:491:5
#3 0x561921477bfb in access_with_adjusted_size /softmmu/memory.c:552:18
#4 0x561921477467 in memory_region_dispatch_write /softmmu/memory.c
#5 0x561921807ffb in flatview_write_continue /softmmu/physmem.c:2759:23
#6 0x5619217fd71b in flatview_write /softmmu/physmem.c:2799:14
#7 0x5619217fd71b in address_space_write /softmmu/physmem.c:2891:18
#8 0x561921465eee in qtest_process_command /softmmu/qtest.c:539:13
#9 0x561921462b97 in qtest_process_inbuf /softmmu/qtest.c:797:9
#10 0x561921cb3286 in fd_chr_read /chardev/char-fd.c:68:9
#11 0x7f4ad283baae in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
#12 0x56192230e363 in glib_pollfds_poll /util/main-loop.c:232:9
#13 0x56192230e363 in os_host_main_loop_wait /util/main-loop.c:255:5
#14 0x56192230e363 in main_loop_wait /util/main-loop.c:531:11
#15 0x5619213c9599 in qemu_main_loop /softmmu/runstate.c:721:9
#16 0x56191f6561fd in main /softmmu/main.c:50:5
#17 0x7f4ad22e0cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
#18 0x56191f5a9bc9 in _start (/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)

tags: added: fuzzer
tags: added: arm
Changed in qemu:
status: New → Confirmed
Revision history for this message
Alexander Bulekov (a1xndr) wrote :

I moved this report over to QEMU's new bug tracker on gitlab.com.
Please continue with the discussion here:

https://gitlab.com/qemu-project/qemu/-/issues/549

Revision history for this message
Thomas Huth (th-huth) wrote :

Thanks for moving it over! ... let's close this one here on Launchpad now.

Changed in qemu:
status: Confirmed → Incomplete
status: Incomplete → Invalid
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.