[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
QMP command dumpdtb crash bug
From: |
Markus Armbruster |
Subject: |
QMP command dumpdtb crash bug |
Date: |
Thu, 23 Mar 2023 07:29:19 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
Watch this:
$ gdb --args ../qemu/bld/qemu-system-aarch64 -S -M virt -display none -qmp
stdio
[...]
(gdb) r
[...]
{"QMP": {"version": {"qemu": {"micro": 50, "minor": 2, "major": 7},
"package": "v7.2.0-2331-gda89f78a7d"}, "capabilities": ["oob"]}}
[New Thread 0x7fffed62c6c0 (LWP 1021967)]
{"execute": "qmp_capabilities", "arguments": {"enable": ["oob"]}}
{"return": {}}
{"execute": "dumpdtb", "arguments": {"filename": "fdt.dtb"}}
Thread 1 "qemu-system-aar" received signal SIGSEGV, Segmentation fault.
qmp_dumpdtb (filename=0x5555581c5170 "fdt.dtb",
errp=errp@entry=0x7fffffffdae8)
at ../softmmu/device_tree.c:661
661 size = fdt_totalsize(current_machine->fdt);
current_machine->fdt is non-null here. The crash is within
fdt_totalsize().
I suspect ...
void qmp_dumpdtb(const char *filename, Error **errp)
{
g_autoptr(GError) err = NULL;
uint32_t size;
if (!current_machine->fdt) {
error_setg(errp, "This machine doesn't have a FDT");
return;
}
... we're missing an "FDT isn't ready" guard here.
size = fdt_totalsize(current_machine->fdt);
g_assert(size > 0);
if (!g_file_set_contents(filename, current_machine->fdt, size, &err)) {
error_setg(errp, "Error saving FDT to file %s: %s",
filename, err->message);
}
}
Also, I think the error message "does not have a FDT" should say "an
FDT".
- QMP command dumpdtb crash bug,
Markus Armbruster <=