qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Markus Armbruster <armbru@redhat.com>
To: Daniel Henrique Barboza <danielhb413@gmail.com>
Cc: "Daniel Henrique Barboza" <dbarboza@ventanamicro.com>,
	"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	qemu-devel@nongnu.org
Subject: QMP command dumpdtb crash bug
Date: Thu, 23 Mar 2023 07:29:19 +0100	[thread overview]
Message-ID: <87jzz82d6o.fsf@pond.sub.org> (raw)

Watch this:

    $ gdb --args ../qemu/bld/qemu-system-aarch64 -S -M virt -display none -qmp stdio
    [...]
    (gdb) r
    [...]
    {"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 7}, "package": "v7.2.0-2331-gda89f78a7d"}, "capabilities": ["oob"]}}
    [New Thread 0x7fffed62c6c0 (LWP 1021967)]
    {"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
    {"return": {}}
    {"execute": "dumpdtb", "arguments": {"filename": "fdt.dtb"}}

    Thread 1 "qemu-system-aar" received signal SIGSEGV, Segmentation fault.
    qmp_dumpdtb (filename=0x5555581c5170 "fdt.dtb", errp=errp@entry=0x7fffffffdae8)
        at ../softmmu/device_tree.c:661
    661	    size = fdt_totalsize(current_machine->fdt);

current_machine->fdt is non-null here.  The crash is within
fdt_totalsize().

I suspect ...

    void qmp_dumpdtb(const char *filename, Error **errp)
    {
        g_autoptr(GError) err = NULL;
        uint32_t size;

        if (!current_machine->fdt) {
            error_setg(errp, "This machine doesn't have a FDT");
            return;
        }

... we're missing an "FDT isn't ready" guard here.

        size = fdt_totalsize(current_machine->fdt);

        g_assert(size > 0);

        if (!g_file_set_contents(filename, current_machine->fdt, size, &err)) {
            error_setg(errp, "Error saving FDT to file %s: %s",
                       filename, err->message);
        }
    }

Also, I think the error message "does not have a FDT" should say "an
FDT".



             reply	other threads:[~2023-03-23  6:30 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-23  6:29 Markus Armbruster [this message]
2023-03-23 12:17 ` QMP command dumpdtb crash bug Daniel Henrique Barboza
2023-03-23 13:29   ` Markus Armbruster
2023-03-23 13:38     ` Peter Maydell
2023-03-23 15:13       ` Daniel Henrique Barboza
2023-03-23 18:41         ` Bernhard Beschow

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87jzz82d6o.fsf@pond.sub.org \
    --to=armbru@redhat.com \
    --cc=danielhb413@gmail.com \
    --cc=dbarboza@ventanamicro.com \
    --cc=f4bug@amsat.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).