QEMU segfault (null pointer dereference) in sve_probe_page from ldff1* instructions
Host environment
- Operating system: Fedora 36
- OS/kernel version:
6.0.15-200.fc36.x86_64
- Architecture: x86
- QEMU flavor: qemu-system-aarch64
- QEMU version: 7.2.0
Emulated/Virtualized environment
- Architecture: AArch64
Description of problem
After upgrading to QEMU v7.2.0 from v7.1.0, when executing any SVE ldff1* instructions with a faulting address, QEMU crashes due to a null pointer dereference at target/arm/sve_helper.c:5364
I believe this was introduced in b8967ddf (@rth7680), since in that commit full
is dereferenced before the flags & TLB_INVALID_MASK
check at line 5369, and full is set to null by probe_access_full
when TLB_INVALID_MASK
is given.