[Qemu-devel] Bug report

[J. Mayer]

I just had a SIGSEGV, running qemu under gdb on my PC. Here's the case:
we enter tb_link_phys with phys_pc == 0
Then, we crash in tb_alloc_page because the PageDesc returned by
page_find is NULL.
So, dereferencing this pointer, we get a segfault:

    p = page_find(page_addr >> TARGET_PAGE_BITS);
    tb->page_next[n] = p->first_tb;
                                ^^^^^^
You'll find useful informations in gdb output, attached.

-- 
J. Mayer <address@hidden>
Never organized

(qemu) 
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 27064)]
tb_link_phys (tb=0x83ff094, phys_pc=0, phys_page2=4294967295)
    at /home/jocelyn/devel/ppc_emul/qemu-newCVS/qemu/exec.c:694
694         tb->page_next[n] = p->first_tb;
(gdb) bt
#0  tb_link_phys (tb=0x83ff094, phys_pc=0, phys_page2=4294967295)
    at /home/jocelyn/devel/ppc_emul/qemu-newCVS/qemu/exec.c:694
#1  0x0806a38c in cpu_ppc_exec (env1=0x8f007c0)
    at /home/jocelyn/devel/ppc_emul/qemu-newCVS/qemu/cpu-exec.c:346
#2  0x0804b839 in main_loop ()
    at /home/jocelyn/devel/ppc_emul/qemu-newCVS/qemu/vl.c:1528
#3  0x0804c453 in main (argc=134526736, argv=0xbffff124)
    at /home/jocelyn/devel/ppc_emul/qemu-newCVS/qemu/vl.c:2170
(gdb) p tb
 = (TranslationBlock *) 0x83ff094
(gdb) p/x *tb
 = {pc = 0x7ffff660, cs_base = 0x0, flags = 0x0, size = 0x4, cflags = 0x0, 
  tc_ptr = 0x8de24c0, hash_next = 0x0, phys_hash_next = 0x83919d8, 
  page_next = {0x0, 0x0}, page_addr = {0x37962000, 0x0}, tb_next_offset = {
    0xffff, 0xffff}, tb_jmp_offset = {0x0, 0x0, 0xffff, 0xffff}, jmp_next = {
    0x0, 0x0}, jmp_first = 0x0}
(gdb) p/x l1_map[0]
 = 0x8f18b10
(gdb) p/x *l1_map[0]
 = {phys_offset = 0x0, first_tb = 0x83ff050, code_write_count = 0x0, 
  code_bitmap = 0x0}
(gdb) info registers
eax            0x0      0
ecx            0x83919d8        137959896
edx            0x37962  227682
ebx            0x0      0
esp            0xbfffdc50       0xbfffdc50
ebp            0x8f007c0        0x8f007c0
esi            0x83ff094        138408084
edi            0xffffffff       -1
eip            0x8060886        0x8060886
eflags         0x10246  66118
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x7      7
(gdb) disas
Dump of assembler code for function tb_link_phys:
0x08060830 <tb_link_phys+0>:    push   %ebp
0x08060831 <tb_link_phys+1>:    push   %edi
0x08060832 <tb_link_phys+2>:    push   %esi
0x08060833 <tb_link_phys+3>:    push   %ebx
0x08060834 <tb_link_phys+4>:    sub    bashxc,%esp
0x08060837 <tb_link_phys+7>:    xor    %ebx,%ebx
0x08060839 <tb_link_phys+9>:    mov    0x24(%esp,1),%eax
0x0806083d <tb_link_phys+13>:   mov    0x20(%esp,1),%esi
0x08060841 <tb_link_phys+17>:   mov    0x28(%esp,1),%edi
0x08060845 <tb_link_phys+21>:   mov    %eax,%edx
0x08060847 <tb_link_phys+23>:   and    bashx7fff,%edx
0x0806084d <tb_link_phys+29>:   and    bashxfffff000,%eax
0x08060852 <tb_link_phys+34>:   mov    %eax,0x24(%esi)
0x08060855 <tb_link_phys+37>:   shl    bashx2,%edx
0x08060858 <tb_link_phys+40>:   mov    0x8278780(%edx),%ecx
0x0806085e <tb_link_phys+46>:   mov    %ecx,0x18(%esi)
0x08060861 <tb_link_phys+49>:   mov    %esi,0x8278780(%edx)
0x08060867 <tb_link_phys+55>:   mov    %eax,%edx
0x08060869 <tb_link_phys+57>:   shr    bashx16,%eax
0x0806086c <tb_link_phys+60>:   mov    0x80a55a0(,%eax,4),%eax
0x08060873 <tb_link_phys+67>:   shr    bashxc,%edx
0x08060876 <tb_link_phys+70>:   test   %eax,%eax
0x08060878 <tb_link_phys+72>:   je     0x8060886 <tb_link_phys+86>
0x0806087a <tb_link_phys+74>:   and    bashx3ff,%edx
0x08060880 <tb_link_phys+80>:   shl    bashx4,%edx
0x08060883 <tb_link_phys+83>:   lea    (%edx,%eax,1),%ebx
0x08060886 <tb_link_phys+86>:   mov    0x4(%ebx),%edx