| Message ID | 20201201191026.4149955-4-philmd@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | hw/scsi/megasas: Avoid buffer overrun in megasas_handle_scsi() | expand |
On 12/1/20 8:10 PM, Philippe Mathieu-Daudé wrote: > Add a reproducer which triggers (without the previous patch): > > $ make check-qtest-x86_64 > Running test qtest-x86_64/fuzz-test > qemu-system-x86_64: hw/scsi/megasas.c:1679: megasas_handle_scsi: Assertion `cdb_len > 0 && scsi_cdb_length(cdb) <= cdb_len' failed. > tests/qtest/libqtest.c:181: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) > ERROR qtest-x86_64/fuzz-test - too few tests run (expected 1, got 0) > > Signed-off-by: Alexander Bulekov <alxndr@bu.edu> > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> > --- > tests/qtest/fuzz-test.c | 19 +++++++++++++++++++ > 1 file changed, 19 insertions(+) Oops this should be patch #4...
On 01/12/2020 20.10, Philippe Mathieu-Daudé wrote: > Add a reproducer which triggers (without the previous patch): > > $ make check-qtest-x86_64 > Running test qtest-x86_64/fuzz-test > qemu-system-x86_64: hw/scsi/megasas.c:1679: megasas_handle_scsi: Assertion `cdb_len > 0 && scsi_cdb_length(cdb) <= cdb_len' failed. > tests/qtest/libqtest.c:181: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped) > ERROR qtest-x86_64/fuzz-test - too few tests run (expected 1, got 0) > > Signed-off-by: Alexander Bulekov <alxndr@bu.edu> > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> > --- > tests/qtest/fuzz-test.c | 19 +++++++++++++++++++ > 1 file changed, 19 insertions(+) > > diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c > index 87b72307a5b..31f90cfb4fc 100644 > --- a/tests/qtest/fuzz-test.c > +++ b/tests/qtest/fuzz-test.c > @@ -48,6 +48,23 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void) > qtest_quit(s); > } > > +static void test_megasas_cdb_len_zero(void) > +{ > + QTestState *s; > + > + s = qtest_init("-M pc -nodefaults " > + "-device megasas-gen2 -device scsi-cd,drive=null0 " > + "-blockdev driver=null-co,read-zeroes=on,node-name=null0"); > + > + qtest_outl(s, 0xcf8, 0x80001011); > + qtest_outb(s, 0xcfc, 0xbb); > + qtest_outl(s, 0xcf8, 0x80001002); > + qtest_outl(s, 0xcfc, 0xf3ff2966); > + qtest_writeb(s, 0x4600, 0x03); > + qtest_outw(s, 0xbb40, 0x460b); > + qtest_quit(s); > +} > + > int main(int argc, char **argv) > { > const char *arch = qtest_get_arch(); > @@ -59,6 +76,8 @@ int main(int argc, char **argv) > test_lp1878263_megasas_zero_iov_cnt); > qtest_add_func("fuzz/test_lp1878642_pci_bus_get_irq_level_assert", > test_lp1878642_pci_bus_get_irq_level_assert); > + qtest_add_func("fuzz/test_megasas_cdb_len_zero", > + test_megasas_cdb_len_zero); > } > > return g_test_run(); > Acked-by: Thomas Huth <thuth@redhat.com>
diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c index 87b72307a5b..31f90cfb4fc 100644 --- a/tests/qtest/fuzz-test.c +++ b/tests/qtest/fuzz-test.c @@ -48,6 +48,23 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void) qtest_quit(s); } +static void test_megasas_cdb_len_zero(void) +{ + QTestState *s; + + s = qtest_init("-M pc -nodefaults " + "-device megasas-gen2 -device scsi-cd,drive=null0 " + "-blockdev driver=null-co,read-zeroes=on,node-name=null0"); + + qtest_outl(s, 0xcf8, 0x80001011); + qtest_outb(s, 0xcfc, 0xbb); + qtest_outl(s, 0xcf8, 0x80001002); + qtest_outl(s, 0xcfc, 0xf3ff2966); + qtest_writeb(s, 0x4600, 0x03); + qtest_outw(s, 0xbb40, 0x460b); + qtest_quit(s); +} + int main(int argc, char **argv) { const char *arch = qtest_get_arch(); @@ -59,6 +76,8 @@ int main(int argc, char **argv) test_lp1878263_megasas_zero_iov_cnt); qtest_add_func("fuzz/test_lp1878642_pci_bus_get_irq_level_assert", test_lp1878642_pci_bus_get_irq_level_assert); + qtest_add_func("fuzz/test_megasas_cdb_len_zero", + test_megasas_cdb_len_zero); } return g_test_run();