tests/qtest/fuzz-lsi53c895a-test.c

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2 /*
   3  * QTest fuzzer-generated testcase for LSI53C895A device
   4  *
   5  * Copyright (c) Red Hat
   6  */
   7
   8 #include "qemu/osdep.h"
   9 #include "libqtest.h"
  10
  11 /*
  12  * This used to trigger a UAF in lsi_do_msgout()
  13  * https://gitlab.com/qemu-project/qemu/-/issues/972
  14  */
  15 static void test_lsi_do_msgout_cancel_req(void)
  16 {
  17     QTestState *s;
  18
  19     if (sizeof(void *) == 4) {
  20         g_test_skip("memory size too big for 32-bit build");
  21         return;
  22     }
  23
  24     s = qtest_init("-M q35 -m 2G -nodefaults "
  25                    "-device lsi53c895a,id=scsi "
  26                    "-device scsi-hd,drive=disk0 "
  27                    "-drive file=null-co://,id=disk0,if=none,format=raw");
  28
  29     qtest_outl(s, 0xcf8, 0x80000810);
  30     qtest_outl(s, 0xcf8, 0xc000);
  31     qtest_outl(s, 0xcf8, 0x80000810);
  32     qtest_outw(s, 0xcfc, 0x7);
  33     qtest_outl(s, 0xcf8, 0x80000810);
  34     qtest_outl(s, 0xcfc, 0xc000);
  35     qtest_outl(s, 0xcf8, 0x80000804);
  36     qtest_outw(s, 0xcfc, 0x05);
  37     qtest_writeb(s, 0x69736c10, 0x08);
  38     qtest_writeb(s, 0x69736c13, 0x58);
  39     qtest_writeb(s, 0x69736c1a, 0x01);
  40     qtest_writeb(s, 0x69736c1b, 0x06);
  41     qtest_writeb(s, 0x69736c22, 0x01);
  42     qtest_writeb(s, 0x69736c23, 0x07);
  43     qtest_writeb(s, 0x69736c2b, 0x02);
  44     qtest_writeb(s, 0x69736c48, 0x08);
  45     qtest_writeb(s, 0x69736c4b, 0x58);
  46     qtest_writeb(s, 0x69736c52, 0x04);
  47     qtest_writeb(s, 0x69736c53, 0x06);
  48     qtest_writeb(s, 0x69736c5b, 0x02);
  49     qtest_outl(s, 0xc02d, 0x697300);
  50     qtest_writeb(s, 0x5a554662, 0x01);
  51     qtest_writeb(s, 0x5a554663, 0x07);
  52     qtest_writeb(s, 0x5a55466a, 0x10);
  53     qtest_writeb(s, 0x5a55466b, 0x22);
  54     qtest_writeb(s, 0x5a55466c, 0x5a);
  55     qtest_writeb(s, 0x5a55466d, 0x5a);
  56     qtest_writeb(s, 0x5a55466e, 0x34);
  57     qtest_writeb(s, 0x5a55466f, 0x5a);
  58     qtest_writeb(s, 0x5a345a5a, 0x77);
  59     qtest_writeb(s, 0x5a345a5b, 0x55);
  60     qtest_writeb(s, 0x5a345a5c, 0x51);
  61     qtest_writeb(s, 0x5a345a5d, 0x27);
  62     qtest_writeb(s, 0x27515577, 0x41);
  63     qtest_outl(s, 0xc02d, 0x5a5500);
  64     qtest_writeb(s, 0x364001d0, 0x08);
  65     qtest_writeb(s, 0x364001d3, 0x58);
  66     qtest_writeb(s, 0x364001da, 0x01);
  67     qtest_writeb(s, 0x364001db, 0x26);
  68     qtest_writeb(s, 0x364001dc, 0x0d);
  69     qtest_writeb(s, 0x364001dd, 0xae);
  70     qtest_writeb(s, 0x364001de, 0x41);
  71     qtest_writeb(s, 0x364001df, 0x5a);
  72     qtest_writeb(s, 0x5a41ae0d, 0xf8);
  73     qtest_writeb(s, 0x5a41ae0e, 0x36);
  74     qtest_writeb(s, 0x5a41ae0f, 0xd7);
  75     qtest_writeb(s, 0x5a41ae10, 0x36);
  76     qtest_writeb(s, 0x36d736f8, 0x0c);
  77     qtest_writeb(s, 0x36d736f9, 0x80);
  78     qtest_writeb(s, 0x36d736fa, 0x0d);
  79     qtest_outl(s, 0xc02d, 0x364000);
  80
  81     qtest_quit(s);
  82 }
  83
  84 /*
  85  * This used to trigger the assert in lsi_do_dma()
  86  * https://bugs.launchpad.net/qemu/+bug/697510
  87  * https://bugs.launchpad.net/qemu/+bug/1905521
  88  * https://bugs.launchpad.net/qemu/+bug/1908515
  89  */
  90 static void test_lsi_do_dma_empty_queue(void)
  91 {
  92     QTestState *s;
  93
  94     s = qtest_init("-M q35 -nographic -monitor none -serial none "
  95                    "-drive if=none,id=drive0,"
  96                             "file=null-co://,file.read-zeroes=on,format=raw "
  97                    "-device lsi53c895a,id=scsi0 "
  98                    "-device scsi-hd,drive=drive0,"
  99                             "bus=scsi0.0,channel=0,scsi-id=0,lun=0");
 100     qtest_outl(s, 0xcf8, 0x80001814);
 101     qtest_outl(s, 0xcfc, 0xe1068000);
 102     qtest_outl(s, 0xcf8, 0x80001818);
 103     qtest_outl(s, 0xcf8, 0x80001804);
 104     qtest_outw(s, 0xcfc, 0x7);
 105     qtest_outl(s, 0xcf8, 0x80002010);
 106
 107     qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */
 108     qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */
 109
 110     qtest_quit(s);
 111 }
 112
 113 int main(int argc, char **argv)
 114 {
 115     if (!qtest_has_device("lsi53c895a")) {
 116         return 0;
 117     }
 118
 119     g_test_init(&argc, &argv, NULL);
 120
 121     qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
 122                    test_lsi_do_dma_empty_queue);
 123
 124     qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
 125                    test_lsi_do_msgout_cancel_req);
 126
 127     return g_test_run();
 128 }