From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1963BC47082 for ; Wed, 26 May 2021 15:42:43 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 34E11613D3 for ; Wed, 26 May 2021 15:42:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 34E11613D3 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=bugs.launchpad.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:39464 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1llvg9-0003Uq-1h for qemu-devel@archiver.kernel.org; Wed, 26 May 2021 11:42:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:56548) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1llvej-0002fS-5Q for qemu-devel@nongnu.org; Wed, 26 May 2021 11:41:13 -0400 Received: from indium.canonical.com ([91.189.90.7]:55532) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1llveh-0006ZG-7H for qemu-devel@nongnu.org; Wed, 26 May 2021 11:41:12 -0400 Received: from loganberry.canonical.com ([91.189.90.37]) by indium.canonical.com with esmtp (Exim 4.93 #5 (Debian)) id 1llvee-0000Cg-K2 for ; Wed, 26 May 2021 15:41:08 +0000 Received: from loganberry.canonical.com (localhost [127.0.0.1]) by loganberry.canonical.com (Postfix) with ESMTP id 6F7552E8187 for ; Wed, 26 May 2021 15:41:08 +0000 (UTC) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Date: Wed, 26 May 2021 15:31:09 -0000 From: Thomas Huth <1910603@bugs.launchpad.net> To: qemu-devel@nongnu.org X-Launchpad-Notification-Type: bug X-Launchpad-Bug: product=qemu; status=Confirmed; importance=Undecided; assignee=None; X-Launchpad-Bug-Tags: audio fuzzer X-Launchpad-Bug-Information-Type: Public X-Launchpad-Bug-Private: no X-Launchpad-Bug-Security-Vulnerability: no X-Launchpad-Bug-Commenters: a1xndr th-huth X-Launchpad-Bug-Reporter: Alexander Bulekov (a1xndr) X-Launchpad-Bug-Modifier: Thomas Huth (th-huth) References: <161005830186.3494.9820259593524409716.malonedeb@wampee.canonical.com> Message-Id: <162204306946.21896.6174861679275300202.malone@chaenomeles.canonical.com> Subject: [Bug 1910603] Re: [OSS-Fuzz] Issue 29174 sb16: Abrt in audio_bug X-Launchpad-Message-Rationale: Subscriber (QEMU) @qemu-devel-ml X-Launchpad-Message-For: qemu-devel-ml Precedence: bulk X-Generated-By: Launchpad (canonical.com); Revision="802ed26817d1cdd050553dbe99cc8a3cad1a3bc7"; Instance="production" X-Launchpad-Hash: 222eb2d41158df9b6cf9d508e967005a9a978a85 Received-SPF: none client-ip=91.189.90.7; envelope-from=bounces@canonical.com; helo=indium.canonical.com X-Spam_score_int: -65 X-Spam_score: -6.6 X-Spam_bar: ------ X-Spam_report: (-6.6 / 5.0 requ) BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.248, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Bug 1910603 <1910603@bugs.launchpad.net> Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" This is still reproducible with the current version of QEMU. Marking this as "Confirmed" ** Changed in: qemu Status: New =3D> Confirmed ** Tags added: audio -- = You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1910603 Title: [OSS-Fuzz] Issue 29174 sb16: Abrt in audio_bug Status in QEMU: Confirmed Bug description: =3D=3D=3D Reproducer =3D=3D=3D cat << EOF | ../build-system/qemu-system-i386 \ -machine q35 -device sb16,audiodev=3Dsnd0 \ -audiodev none,id=3Dsnd0 -nographic -nodefaults \ -qtest stdio outw 0x22c 0x41 outb 0x22c 0x0 outw 0x22c 0x1004 outw 0x22c 0x1c EOF =3D=3D=3D Stack Trace =3D=3D=3D A bug was just triggered in audio_calloc Save all your work and restart without audio I am sorry Context: Aborted #0 raise #1 abort #2 audio_bug /src/qemu/audio/audio.c:119:9 #3 audio_calloc /src/qemu/audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out /src/qemu/audio/audio_template.h:116:= 15 #5 audio_pcm_sw_init_out /src/qemu/audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out /src/qemu/audio/audio_template.h:410:9 #7 AUD_open_out /src/qemu/audio/audio_template.h:503:14 #8 continue_dma8 /src/qemu/hw/audio/sb16.c:216:20 #9 dma_cmd8 /src/qemu/hw/audio/sb16.c:276:5 #10 command /src/qemu/hw/audio/sb16.c:0 #11 dsp_write /src/qemu/hw/audio/sb16.c:949:13 #12 portio_write /src/qemu/softmmu/ioport.c:205:13 #13 memory_region_write_accessor /src/qemu/softmmu/memory.c:491:5 #14 access_with_adjusted_size /src/qemu/softmmu/memory.c:552:18 #15 memory_region_dispatch_write /src/qemu/softmmu/memory.c:0:13 #16 flatview_write_continue /src/qemu/softmmu/physmem.c:2759:23 #17 flatview_write /src/qemu/softmmu/physmem.c:2799:14 #18 address_space_write /src/qemu/softmmu/physmem.c:2891:18 #19 cpu_outw /src/qemu/softmmu/ioport.c:70:5 = OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3D29174 To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1910603/+subscriptions