From: Jason Wang <jasowang@redhat.com>
To: Alexander Bulekov <alxndr@bu.edu>, qemu-devel@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>, mst@redhat.com
Subject: Re: Assertion Failure in virtio_net_reset
Date: Mon, 11 May 2020 12:05:41 +0800 [thread overview]
Message-ID: <9d67b5a1-d566-96e6-a057-491263574de9@redhat.com> (raw)
In-Reply-To: <20200511025956.uojost3s6vxcecdf@mozz.bu.edu>
On 2020/5/11 上午10:59, Alexander Bulekov wrote:
> Hello,
> While fuzzing, I found an input that triggers an assertion failure in
> virtio-net.c:
>
> hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion `!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
>
> #9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
> #10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
> #11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
> #12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
> #13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
> #14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
> #15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
> #16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16
>
> I can reproduce it in a qemu 5.0 build using:
> cat << EOF | qemu-system-i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device virtio-net-pci,netdev=qtest-bn0 -display none -nodefaults -nographic -qtest stdio
> outl 0xcf8 0x80000820
> outl 0xcfc 0xe0004000
> outl 0xcf8 0x80000824
> outl 0xcfc 0xc021
> outl 0xcf8 0x80000804
> outw 0xcfc 0x7
> outl 0xcf8 0x8000089a
> write 0xc021e0004016 0x16 0x0100000000ff4f000100cd003d00000000000000f600
> write 0x3d00d8 0xae 0x0100007a000a00000000000d00840100007a000a00000000000f00840100007a000a00000000001100840100007a000a00000000001300840100007a000a00000000001500840100007a000a00000000001700840100007a000a00000000001900840100007a000a00000000001b00840100007a000a00000000001d00840100007a000a00000000001f00840100007a000a00000000002100840100007a000a00000000002300840100007a000a
> write 0xf60002 0x7 0x0a00000000000b
> write 0xc021e0004014 0x9 0x95a4b3c2d1e0effe0d
> write 0xc021e0004014 0x2a3 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
> EOF
>
> I also uploaded the above trace, in case the formatting is broken:
>
> curl https://paste.debian.net/plain/1146086 | qemu-system-i386 -M pc-q35-5.0 -netdev user,id=qtest-bn0 -device virtio-net-pci,netdev=qtest-bn0 -display none -nodefaults -nographic -qtest stdio
>
> Please let me know if I can provide any further info.
> -Alex
I post a patch which seems to fix this issue.
Please have a look and try.
Thanks
>
prev parent reply other threads:[~2020-05-11 4:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-11 2:59 Assertion Failure in virtio_net_reset Alexander Bulekov
2020-05-11 4:05 ` Jason Wang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9d67b5a1-d566-96e6-a057-491263574de9@redhat.com \
--to=jasowang@redhat.com \
--cc=alxndr@bu.edu \
--cc=mst@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).