Abort when runs into unsupported AUXCommand in xlnx_dp_aux_set_command

When we are fuzzing the xlnx-dp, it is easy to reach this abort. I wonder if we can remove this abort to make the fuzzer surviving from early crashes.

// xlnx_dp_aux_set_command
switch (cmd) {
case READ_AUX:
case READ_I2C:
case READ_I2C_MOT:
    // omit
    break;
case WRITE_AUX:
case WRITE_I2C:
    // omit
    break;
case WRITE_I2C_STATUS:
    qemu_log_mask(LOG_UNIMP, "xlnx_dp: Write i2c status not implemented\n");
    break;
default:
    error_report("%s: invalid command: %u", __func__, cmd);
    abort();
}

More technique details

QEMU version, upstream commit/tag

3e13d8e3/6.0.50

Host and Guest

Ubuntu 18.04 docker/QTest Fuzzer

Stack traces, crash details

aarch64: xlnx_dp_aux_set_command: invalid command: 14
==21== ERROR: libFuzzer: deadly signal
    #0 0x55dc6cc90178 in __sanitizer_print_stack_trace /root/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86
    #1 0x55dc6cbeab32 in fuzzer::PrintStackTrace() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210
    #2 0x55dc6cb9ccd0 in fuzzer::Fuzzer::CrashCallback() (.part.284) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233
    #3 0x55dc6cbc28ac in fuzzer::Fuzzer::CrashCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:205
    #4 0x55dc6cbc28ac in fuzzer::Fuzzer::StaticCrashSignalCallback() /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:204
    #5 0x7ffb5966697f  (/root/qemu/build-oss-fuzz/DEST_DIR/lib/libpthread.so.0+0x1297f)
    #6 0x7ffb58c7dfb6 in raise (/root/qemu/build-oss-fuzz/DEST_DIR/lib/libc.so.6+0x3efb6)
    #7 0x7ffb58c7f920 in abort (/root/qemu/build-oss-fuzz/DEST_DIR/lib/libc.so.6+0x40920)
    #8 0x55dc6d3fb47c in xlnx_dp_aux_set_command /root/qemu/build-oss-fuzz/../hw/display/xlnx_dp.c:530:9
    #9 0x55dc6d3fa91a in xlnx_dp_write /root/qemu/build-oss-fuzz/../hw/display/xlnx_dp.c:783:9
    #10 0x55dc6e0676a7 in memory_region_write_accessor /root/qemu/build-oss-fuzz/../softmmu/memory.c:491:5
    #11 0x55dc6e06708d in access_with_adjusted_size /root/qemu/build-oss-fuzz/../softmmu/memory.c:552:18
    #12 0x55dc6e06708d in memory_region_dispatch_write /root/qemu/build-oss-fuzz/../softmmu/memory.c:1502:16
    #13 0x55dc6df15ed1 in flatview_write_continue /root/qemu/build-oss-fuzz/../softmmu/physmem.c:2746:23
    #14 0x55dc6df08a67 in flatview_write /root/qemu/build-oss-fuzz/../softmmu/physmem.c:2786:14
    #15 0x55dc6df0820c in address_space_write /root/qemu/build-oss-fuzz/../softmmu/physmem.c:2878:18
    #16 0x55dc6ccd7dfc in __wrap_qtest_writel /root/qemu/build-oss-fuzz/../tests/qtest/fuzz/qtest_wrappers.c:177:9
    #17 0x55dc6ccd2cfa in stateful_fuzz /root/qemu/build-oss-fuzz/../tests/qtest/fuzz/stateful_fuzz.c:402:13
    #18 0x55dc6ccd4470 in LLVMFuzzerTestOneInput /root/qemu/build-oss-fuzz/../tests/qtest/fuzz/fuzz.c:151:5
    #19 0x55dc6cbc3213 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:603
    #20 0x55dc6cba665a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323
    #21 0x55dc6cbb1431 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:858
    #22 0x55dc6cb9cfa2 in main /root/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20
    #23 0x7ffb58c60bf6 in __libc_start_main (/root/qemu/build-oss-fuzz/DEST_DIR/lib/libc.so.6+0x21bf6)
    #24 0x55dc6cb9cff9 in _start (/root/qemu/build-oss-fuzz/DEST_DIR/qemu-fuzz-aarch64-target-stateful-fuzz-xlnx-dp+0x123cff9)

Reproducer steps

#!/bin/bash -x
export QEMU=/root/qemu/build-oss-fuzz/qemu-system-aarch64
export BUILDROOT=./
cat << EOF | $QEMU \
-machine xlnx-zcu102,accel=qtest -qtest stdio -monitor none -serial none \
-display none -nodefaults -qtest stdio
writel 0xfd4a0100 0x7e04
EOF

Suggested fix

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 4fd6aeb..0198761 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -526,8 +526,7 @@ static void xlnx_dp_aux_set_command(XlnxDPState *s, uint32_t value)
         qemu_log_mask(LOG_UNIMP, "xlnx_dp: Write i2c status not implemented\n");
         break;
     default:
-        error_report("%s: invalid command: %u", __func__, cmd);
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid command: %u", __func__, cmd);
     }

     s->core_registers[DP_INTERRUPT_SIGNAL_STATE] |= 0x04;

Contact

Let me know if I need to provide more information.