Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Output error in rt_device_write function #9417

Open
LecterChu opened this issue Sep 10, 2024 · 0 comments
Open

[Bug] Output error in rt_device_write function #9417

LecterChu opened this issue Sep 10, 2024 · 0 comments

Comments

@LecterChu
Copy link

LecterChu commented Sep 10, 2024

RT-Thread Version

5.2.0 commit 2f55990

Hardware Type/Architectures

VEXPRESS_A9

Develop Toolchain

GCC

Describe the bug

Log output fails due to serial device busy or buffer overflow.

Steps to reproduce

1.Build RT-Thread
2.Use the following command to start the kernel with QEMU:

qemu-system-arm \
    -M vexpress-a9 \
    -smp 2 \
    -m 4096M \
    -kernel /path/to/rt-thread/bsp/qemu-vexpress-a9/rtthread.bin \
    -drive if=sd,file=/path/to/rt-thread/bsp/qemu-vexpress-a9/sd.bin,format=raw \
    -nographic \
    -semihosting \

Source code location

/root/rtthread/rt-thread/components/drivers/core/device.c : 396

    if (dev->ref_count == 0)
    {
        rt_set_errno(-RT_ERROR);
        return 0;
    }

    /* call device_write interface */
    if (device_write != RT_NULL)
    {
        return device_write(dev, pos, buffer, size);  //  396
    }

    /* set error code */
    rt_set_errno(-RT_ENOSYS);

Test case

syz_create_bind_socket (0xbc78, 0x0, 0x101, 0x0)

long syz_create_bind_socket(volatile long domain, volatile long type, volatile long protocol, volatile long sockaddr_ptr) {
    int sock = socket((int)domain, (int)type, (int)protocol);
    if (sock < 0) {
        return -1;
    }
    struct sockaddr_in addr;
    if (sockaddr_ptr != 0) {
        memcpy(&addr, (struct sockaddr_in *)sockaddr_ptr, sizeof(struct sockaddr_in));
    } else {
        memset(&addr, 0, sizeof(struct sockaddr_in));
        addr.sin_family = AF_INET;
        addr.sin_port = htons(12345);
        addr.sin_addr.s_addr = htonl(INADDR_ANY);
    }
    if (bind(sock, (struct sockaddr *)&addr, sizeof(struct sockaddr_in)) < 0) {
        closesocket(sock);
        return -2;
    }
    return (long)sock;
}

Backtrace upon hitting the bug

#executing syz_create_bind_socket (0xbc78, 0x0, 0x101, 0x0)
2024/09/04 09:02:55 Syscall execution is ok
2024/09/04 09:02:56 qemu run inst merger err: execution timed out
2024/09/04 09:02:56 Received stop signal, requires feedback = true
2024/09/04 09:02:56 running diagnose
2024/09/04 09:02:56 VM-0 failed reading regs: dial tcp 127.0.0.1:14695: connect: connection refused
2024/09/04 09:02:56 VM-0 failed reading regs: dial tcp 127.0.0.1:14695: connect: connection refused
2024/09/04 09:02:56 Stack frames at BUG: unexpected stop:
2024/09/04 09:02:56 Level: 0: 1611238748, /root/kcov.c : __sanitizer_cov_trace_pc : 71 : 
2024/09/04 09:02:56 Level: 1: 1611348476, /root/rtthread/rt-thread/components/drivers/serial/serial.c : rt_serial_write : 917 : 
2024/09/04 09:02:56 Level: 2: 1611243408, /root/rtthread/rt-thread/components/drivers/core/device.c : rt_device_write : 396 : 
2024/09/04 09:02:56 Level: 3: 1611466872, /root/rtthread/rt-thread/src/kservice.c : _kputs : 298 : 
2024/09/04 09:02:56 Level: 4: 1611467092, /root/rtthread/rt-thread/src/kservice.c : rt_kprintf : 349 : 
2024/09/04 09:02:56 Level: 5: 1611175348, /root/rtthread/rt-thread/components/net/sal/src/sal_socket.c : sal_socket : 1059 : 
2024/09/04 09:02:56 Level: 6: 1611165780, /root/rtthread/rt-thread/components/net/sal/socket/net_sockets.c : socket : 244 : 
2024/09/04 09:02:56 Level: 7: 1611220832, /root/rtthread/rt-thread/bsp/qemu-vexpress-a9/applications/common_freertos.h : syz_create_bind_socket : 896 : 

I would greatly appreciate it if you could kindly inform me of any mistakes in the previous issues.

Other additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant