All of lore.kernel.org
 help / color / mirror / Atom feed
From: Markus Armbruster <armbru@redhat.com>
To: Daniel Henrique Barboza <danielhb413@gmail.com>
Cc: "Daniel Henrique Barboza" <dbarboza@ventanamicro.com>,
	"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	qemu-devel@nongnu.org
Subject: QMP command dumpdtb crash bug
Date: Thu, 23 Mar 2023 07:29:19 +0100	[thread overview]
Message-ID: <87jzz82d6o.fsf@pond.sub.org> (raw)

Watch this:

    $ gdb --args ../qemu/bld/qemu-system-aarch64 -S -M virt -display none -qmp stdio
    [...]
    (gdb) r
    [...]
    {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 7}, "package": "v7.2.0-2331-gda89f78a7d"}, "capabilities": ["oob"]}}
    [New Thread 0x7fffed62c6c0 (LWP 1021967)]
    {"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
    {"return": {}}
    {"execute": "dumpdtb", "arguments": {"filename": "fdt.dtb"}}

    Thread 1 "qemu-system-aar" received signal SIGSEGV, Segmentation fault.
    qmp_dumpdtb (filename=0x5555581c5170 "fdt.dtb", errp=errp@entry=0x7fffffffdae8)
        at ../softmmu/device_tree.c:661
    661	    size = fdt_totalsize(current_machine->fdt);

current_machine->fdt is non-null here.  The crash is within
fdt_totalsize().

I suspect ...

    void qmp_dumpdtb(const char *filename, Error **errp)
    {
        g_autoptr(GError) err = NULL;
        uint32_t size;

        if (!current_machine->fdt) {
            error_setg(errp, "This machine doesn't have a FDT");
            return;
        }

... we're missing an "FDT isn't ready" guard here.

        size = fdt_totalsize(current_machine->fdt);

        g_assert(size > 0);

        if (!g_file_set_contents(filename, current_machine->fdt, size, &err)) {
            error_setg(errp, "Error saving FDT to file %s: %s",
                       filename, err->message);
        }
    }

Also, I think the error message "does not have a FDT" should say "an
FDT".



             reply	other threads:[~2023-03-23  6:30 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-23  6:29 Markus Armbruster [this message]
2023-03-23 12:17 ` QMP command dumpdtb crash bug Daniel Henrique Barboza
2023-03-23 13:29   ` Markus Armbruster
2023-03-23 13:38     ` Peter Maydell
2023-03-23 15:13       ` Daniel Henrique Barboza
2023-03-23 18:41         ` Bernhard Beschow

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87jzz82d6o.fsf@pond.sub.org \
    --to=armbru@redhat.com \
    --cc=danielhb413@gmail.com \
    --cc=dbarboza@ventanamicro.com \
    --cc=f4bug@amsat.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.