[Bug 1913668] [NEW] FPE in npcm7xx_pwm_calculate_freq

[Alexander Bulekov]

Public bug reported:

Reproducer:
cat << EOF | ./qemu-system-aarch64 -M npcm750-evb \
-accel qtest -qtest stdio
write 0xf0103008 0x4 0x09000000
write 0xf010300c 0x4 0xffffffff
EOF

Trace:
../hw/misc/npcm7xx_pwm.c:94:17: runtime error: division by zero
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior 
../hw/misc/npcm7xx_pwm.c:94:17 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==717868==ERROR: AddressSanitizer: FPE on unknown address 0x5597c7190150 (pc 
0x5597c7190150 bp 0x7fffcb17c5d0 sp 0x7fffcb17c4e0 T0)
#0 0x5597c7190150 in npcm7xx_pwm_calculate_freq /hw/misc/npcm7xx_pwm.c:94:17
#1 0x5597c7190150 in npcm7xx_pwm_update_freq /hw/misc/npcm7xx_pwm.c:122:21
#2 0x5597c718f06d in npcm7xx_pwm_write /hw/misc/npcm7xx_pwm.c
#3 0x5597c8d241fe in memory_region_write_accessor /softmmu/memory.c:491:5
#4 0x5597c8d23bfb in access_with_adjusted_size /softmmu/memory.c:552:18
#5 0x5597c8d23467 in memory_region_dispatch_write /softmmu/memory.c
#6 0x5597c90b3ffb in flatview_write_continue /softmmu/physmem.c:2759:23
#7 0x5597c90a971b in flatview_write /softmmu/physmem.c:2799:14
#8 0x5597c90a971b in address_space_write /softmmu/physmem.c:2891:18
#9 0x5597c8d11eee in qtest_process_command /softmmu/qtest.c:539:13
#10 0x5597c8d0eb97 in qtest_process_inbuf /softmmu/qtest.c:797:9
#11 0x5597c955f286 in fd_chr_read /chardev/char-fd.c:68:9
#12 0x7f994c124aae in g_main_context_dispatch 
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
#13 0x5597c9bba363 in glib_pollfds_poll /util/main-loop.c:232:9
#14 0x5597c9bba363 in os_host_main_loop_wait /util/main-loop.c:255:5
#15 0x5597c9bba363 in main_loop_wait /util/main-loop.c:531:11
#16 0x5597c8c75599 in qemu_main_loop /softmmu/runstate.c:721:9
#17 0x5597c6f021fd in main /softmmu/main.c:50:5
#18 0x7f994bbc9cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
#19 0x5597c6e55bc9 in _start 
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)

** Affects: qemu
     Importance: Undecided
         Status: New


** Tags: fuzzer

** Tags added: fuzzer

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1913668

Title:
  FPE in npcm7xx_pwm_calculate_freq

Status in QEMU:
  New

Bug description:
  Reproducer:
  cat << EOF | ./qemu-system-aarch64 -M npcm750-evb \
  -accel qtest -qtest stdio
  write 0xf0103008 0x4 0x09000000
  write 0xf010300c 0x4 0xffffffff
  EOF

  Trace:
  ../hw/misc/npcm7xx_pwm.c:94:17: runtime error: division by zero
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior 
../hw/misc/npcm7xx_pwm.c:94:17 in
  AddressSanitizer:DEADLYSIGNAL
  =================================================================
  ==717868==ERROR: AddressSanitizer: FPE on unknown address 0x5597c7190150 (pc 
0x5597c7190150 bp 0x7fffcb17c5d0 sp 0x7fffcb17c4e0 T0)
  #0 0x5597c7190150 in npcm7xx_pwm_calculate_freq /hw/misc/npcm7xx_pwm.c:94:17
  #1 0x5597c7190150 in npcm7xx_pwm_update_freq /hw/misc/npcm7xx_pwm.c:122:21
  #2 0x5597c718f06d in npcm7xx_pwm_write /hw/misc/npcm7xx_pwm.c
  #3 0x5597c8d241fe in memory_region_write_accessor /softmmu/memory.c:491:5
  #4 0x5597c8d23bfb in access_with_adjusted_size /softmmu/memory.c:552:18
  #5 0x5597c8d23467 in memory_region_dispatch_write /softmmu/memory.c
  #6 0x5597c90b3ffb in flatview_write_continue /softmmu/physmem.c:2759:23
  #7 0x5597c90a971b in flatview_write /softmmu/physmem.c:2799:14
  #8 0x5597c90a971b in address_space_write /softmmu/physmem.c:2891:18
  #9 0x5597c8d11eee in qtest_process_command /softmmu/qtest.c:539:13
  #10 0x5597c8d0eb97 in qtest_process_inbuf /softmmu/qtest.c:797:9
  #11 0x5597c955f286 in fd_chr_read /chardev/char-fd.c:68:9
  #12 0x7f994c124aae in g_main_context_dispatch 
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51aae)
  #13 0x5597c9bba363 in glib_pollfds_poll /util/main-loop.c:232:9
  #14 0x5597c9bba363 in os_host_main_loop_wait /util/main-loop.c:255:5
  #15 0x5597c9bba363 in main_loop_wait /util/main-loop.c:531:11
  #16 0x5597c8c75599 in qemu_main_loop /softmmu/runstate.c:721:9
  #17 0x5597c6f021fd in main /softmmu/main.c:50:5
  #18 0x7f994bbc9cc9 in __libc_start_main csu/../csu/libc-start.c:308:16
  #19 0x5597c6e55bc9 in _start 
(/home/alxndr/Development/qemu/build/qemu-system-aarch64+0x3350bc9)

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1913668/+subscriptions