Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
| 2 | /* |
| 3 | * QTest fuzzer-generated testcase for LSI53C895A device |
| 4 | * |
| 5 | * Copyright (c) Red Hat |
| 6 | */ |
| 7 | |
| 8 | #include "qemu/osdep.h" |
Marc-André Lureau | 907b510 | 2022-03-30 13:39:05 +0400 | [diff] [blame] | 9 | #include "libqtest.h" |
Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 10 | |
| 11 | /* |
Mauro Matteo Cascella | 4367a20 | 2022-07-11 14:33:16 +0200 | [diff] [blame] | 12 | * This used to trigger a UAF in lsi_do_msgout() |
| 13 | * https://gitlab.com/qemu-project/qemu/-/issues/972 |
| 14 | */ |
| 15 | static void test_lsi_do_msgout_cancel_req(void) |
| 16 | { |
| 17 | QTestState *s; |
| 18 | |
| 19 | if (sizeof(void *) == 4) { |
| 20 | g_test_skip("memory size too big for 32-bit build"); |
| 21 | return; |
| 22 | } |
| 23 | |
Juan Quintela | f15cfe4 | 2022-09-02 18:51:19 +0200 | [diff] [blame] | 24 | s = qtest_init("-M q35 -m 2G -nodefaults " |
Mauro Matteo Cascella | 4367a20 | 2022-07-11 14:33:16 +0200 | [diff] [blame] | 25 | "-device lsi53c895a,id=scsi " |
| 26 | "-device scsi-hd,drive=disk0 " |
| 27 | "-drive file=null-co://,id=disk0,if=none,format=raw"); |
| 28 | |
| 29 | qtest_outl(s, 0xcf8, 0x80000810); |
| 30 | qtest_outl(s, 0xcf8, 0xc000); |
| 31 | qtest_outl(s, 0xcf8, 0x80000810); |
| 32 | qtest_outw(s, 0xcfc, 0x7); |
| 33 | qtest_outl(s, 0xcf8, 0x80000810); |
| 34 | qtest_outl(s, 0xcfc, 0xc000); |
| 35 | qtest_outl(s, 0xcf8, 0x80000804); |
| 36 | qtest_outw(s, 0xcfc, 0x05); |
| 37 | qtest_writeb(s, 0x69736c10, 0x08); |
| 38 | qtest_writeb(s, 0x69736c13, 0x58); |
| 39 | qtest_writeb(s, 0x69736c1a, 0x01); |
| 40 | qtest_writeb(s, 0x69736c1b, 0x06); |
| 41 | qtest_writeb(s, 0x69736c22, 0x01); |
| 42 | qtest_writeb(s, 0x69736c23, 0x07); |
| 43 | qtest_writeb(s, 0x69736c2b, 0x02); |
| 44 | qtest_writeb(s, 0x69736c48, 0x08); |
| 45 | qtest_writeb(s, 0x69736c4b, 0x58); |
| 46 | qtest_writeb(s, 0x69736c52, 0x04); |
| 47 | qtest_writeb(s, 0x69736c53, 0x06); |
| 48 | qtest_writeb(s, 0x69736c5b, 0x02); |
| 49 | qtest_outl(s, 0xc02d, 0x697300); |
| 50 | qtest_writeb(s, 0x5a554662, 0x01); |
| 51 | qtest_writeb(s, 0x5a554663, 0x07); |
| 52 | qtest_writeb(s, 0x5a55466a, 0x10); |
| 53 | qtest_writeb(s, 0x5a55466b, 0x22); |
| 54 | qtest_writeb(s, 0x5a55466c, 0x5a); |
| 55 | qtest_writeb(s, 0x5a55466d, 0x5a); |
| 56 | qtest_writeb(s, 0x5a55466e, 0x34); |
| 57 | qtest_writeb(s, 0x5a55466f, 0x5a); |
| 58 | qtest_writeb(s, 0x5a345a5a, 0x77); |
| 59 | qtest_writeb(s, 0x5a345a5b, 0x55); |
| 60 | qtest_writeb(s, 0x5a345a5c, 0x51); |
| 61 | qtest_writeb(s, 0x5a345a5d, 0x27); |
| 62 | qtest_writeb(s, 0x27515577, 0x41); |
| 63 | qtest_outl(s, 0xc02d, 0x5a5500); |
| 64 | qtest_writeb(s, 0x364001d0, 0x08); |
| 65 | qtest_writeb(s, 0x364001d3, 0x58); |
| 66 | qtest_writeb(s, 0x364001da, 0x01); |
| 67 | qtest_writeb(s, 0x364001db, 0x26); |
| 68 | qtest_writeb(s, 0x364001dc, 0x0d); |
| 69 | qtest_writeb(s, 0x364001dd, 0xae); |
| 70 | qtest_writeb(s, 0x364001de, 0x41); |
| 71 | qtest_writeb(s, 0x364001df, 0x5a); |
| 72 | qtest_writeb(s, 0x5a41ae0d, 0xf8); |
| 73 | qtest_writeb(s, 0x5a41ae0e, 0x36); |
| 74 | qtest_writeb(s, 0x5a41ae0f, 0xd7); |
| 75 | qtest_writeb(s, 0x5a41ae10, 0x36); |
| 76 | qtest_writeb(s, 0x36d736f8, 0x0c); |
| 77 | qtest_writeb(s, 0x36d736f9, 0x80); |
| 78 | qtest_writeb(s, 0x36d736fa, 0x0d); |
| 79 | qtest_outl(s, 0xc02d, 0x364000); |
| 80 | |
| 81 | qtest_quit(s); |
| 82 | } |
| 83 | |
| 84 | /* |
Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 85 | * This used to trigger the assert in lsi_do_dma() |
| 86 | * https://bugs.launchpad.net/qemu/+bug/697510 |
| 87 | * https://bugs.launchpad.net/qemu/+bug/1905521 |
| 88 | * https://bugs.launchpad.net/qemu/+bug/1908515 |
| 89 | */ |
| 90 | static void test_lsi_do_dma_empty_queue(void) |
| 91 | { |
| 92 | QTestState *s; |
| 93 | |
| 94 | s = qtest_init("-M q35 -nographic -monitor none -serial none " |
| 95 | "-drive if=none,id=drive0," |
| 96 | "file=null-co://,file.read-zeroes=on,format=raw " |
| 97 | "-device lsi53c895a,id=scsi0 " |
| 98 | "-device scsi-hd,drive=drive0," |
| 99 | "bus=scsi0.0,channel=0,scsi-id=0,lun=0"); |
| 100 | qtest_outl(s, 0xcf8, 0x80001814); |
| 101 | qtest_outl(s, 0xcfc, 0xe1068000); |
| 102 | qtest_outl(s, 0xcf8, 0x80001818); |
| 103 | qtest_outl(s, 0xcf8, 0x80001804); |
| 104 | qtest_outw(s, 0xcfc, 0x7); |
| 105 | qtest_outl(s, 0xcf8, 0x80002010); |
| 106 | |
| 107 | qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */ |
| 108 | qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */ |
| 109 | |
| 110 | qtest_quit(s); |
| 111 | } |
| 112 | |
| 113 | int main(int argc, char **argv) |
| 114 | { |
Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 115 | g_test_init(&argc, &argv, NULL); |
| 116 | |
Thomas Huth | b911c30 | 2022-04-14 15:01:27 +0200 | [diff] [blame] | 117 | qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue", |
| 118 | test_lsi_do_dma_empty_queue); |
Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 119 | |
Mauro Matteo Cascella | 4367a20 | 2022-07-11 14:33:16 +0200 | [diff] [blame] | 120 | qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req", |
| 121 | test_lsi_do_msgout_cancel_req); |
| 122 | |
Philippe Mathieu-Daudé | aa62976 | 2021-11-23 12:17:32 +0100 | [diff] [blame] | 123 | return g_test_run(); |
| 124 | } |