Skip to content

QEMU segfault (null pointer dereference) in sve_probe_page from ldff1* instructions

Host environment

  • Operating system: Fedora 36
  • OS/kernel version:
    6.0.15-200.fc36.x86_64
  • Architecture: x86
  • QEMU flavor: qemu-system-aarch64
  • QEMU version: 7.2.0

Emulated/Virtualized environment

  • Architecture: AArch64

Description of problem

After upgrading to QEMU v7.2.0 from v7.1.0, when executing any SVE ldff1* instructions with a faulting address, QEMU crashes due to a null pointer dereference at target/arm/sve_helper.c:5364

I believe this was introduced in b8967ddf (@rth7680), since in that commit full is dereferenced before the flags & TLB_INVALID_MASK check at line 5369, and full is set to null by probe_access_full when TLB_INVALID_MASK is given.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information