tests/qtest/fuzz-lsi53c895a-test.c

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2 /*
   3  * QTest fuzzer-generated testcase for LSI53C895A device
   4  *
   5  * Copyright (c) Red Hat
   6  */
   7
   8 #include "qemu/osdep.h"
   9 #include "libqtest.h"
  10
  11 /*
  12  * This used to trigger a DMA reentrancy issue
  13  * leading to memory corruption bugs like stack
  14  * overflow or use-after-free
  15  * https://gitlab.com/qemu-project/qemu/-/issues/1563
  16  */
  17 static void test_lsi_dma_reentrancy(void)
  18 {
  19     QTestState *s;
  20
  21     s = qtest_init("-M q35 -m 512M -nodefaults "
  22                    "-blockdev driver=null-co,node-name=null0 "
  23                    "-device lsi53c810 -device scsi-cd,drive=null0");
  24
  25     qtest_outl(s, 0xcf8, 0x80000804); /* PCI Command Register */
  26     qtest_outw(s, 0xcfc, 0x7);        /* Enables accesses */
  27     qtest_outl(s, 0xcf8, 0x80000814); /* Memory Bar 1 */
  28     qtest_outl(s, 0xcfc, 0xff100000); /* Set MMIO Address*/
  29     qtest_outl(s, 0xcf8, 0x80000818); /* Memory Bar 2 */
  30     qtest_outl(s, 0xcfc, 0xff000000); /* Set RAM Address*/
  31     qtest_writel(s, 0xff000000, 0xc0000024);
  32     qtest_writel(s, 0xff000114, 0x00000080);
  33     qtest_writel(s, 0xff00012c, 0xff000000);
  34     qtest_writel(s, 0xff000004, 0xff000114);
  35     qtest_writel(s, 0xff000008, 0xff100014);
  36     qtest_writel(s, 0xff10002f, 0x000000ff);
  37
  38     qtest_quit(s);
  39 }
  40
  41 /*
  42  * This used to trigger a UAF in lsi_do_msgout()
  43  * https://gitlab.com/qemu-project/qemu/-/issues/972
  44  */
  45 static void test_lsi_do_msgout_cancel_req(void)
  46 {
  47     QTestState *s;
  48
  49     if (sizeof(void *) == 4) {
  50         g_test_skip("memory size too big for 32-bit build");
  51         return;
  52     }
  53
  54     s = qtest_init("-M q35 -m 2G -nodefaults "
  55                    "-device lsi53c895a,id=scsi "
  56                    "-device scsi-hd,drive=disk0 "
  57                    "-drive file=null-co://,id=disk0,if=none,format=raw");
  58
  59     qtest_outl(s, 0xcf8, 0x80000810);
  60     qtest_outl(s, 0xcf8, 0xc000);
  61     qtest_outl(s, 0xcf8, 0x80000810);
  62     qtest_outw(s, 0xcfc, 0x7);
  63     qtest_outl(s, 0xcf8, 0x80000810);
  64     qtest_outl(s, 0xcfc, 0xc000);
  65     qtest_outl(s, 0xcf8, 0x80000804);
  66     qtest_outw(s, 0xcfc, 0x05);
  67     qtest_writeb(s, 0x69736c10, 0x08);
  68     qtest_writeb(s, 0x69736c13, 0x58);
  69     qtest_writeb(s, 0x69736c1a, 0x01);
  70     qtest_writeb(s, 0x69736c1b, 0x06);
  71     qtest_writeb(s, 0x69736c22, 0x01);
  72     qtest_writeb(s, 0x69736c23, 0x07);
  73     qtest_writeb(s, 0x69736c2b, 0x02);
  74     qtest_writeb(s, 0x69736c48, 0x08);
  75     qtest_writeb(s, 0x69736c4b, 0x58);
  76     qtest_writeb(s, 0x69736c52, 0x04);
  77     qtest_writeb(s, 0x69736c53, 0x06);
  78     qtest_writeb(s, 0x69736c5b, 0x02);
  79     qtest_outl(s, 0xc02d, 0x697300);
  80     qtest_writeb(s, 0x5a554662, 0x01);
  81     qtest_writeb(s, 0x5a554663, 0x07);
  82     qtest_writeb(s, 0x5a55466a, 0x10);
  83     qtest_writeb(s, 0x5a55466b, 0x22);
  84     qtest_writeb(s, 0x5a55466c, 0x5a);
  85     qtest_writeb(s, 0x5a55466d, 0x5a);
  86     qtest_writeb(s, 0x5a55466e, 0x34);
  87     qtest_writeb(s, 0x5a55466f, 0x5a);
  88     qtest_writeb(s, 0x5a345a5a, 0x77);
  89     qtest_writeb(s, 0x5a345a5b, 0x55);
  90     qtest_writeb(s, 0x5a345a5c, 0x51);
  91     qtest_writeb(s, 0x5a345a5d, 0x27);
  92     qtest_writeb(s, 0x27515577, 0x41);
  93     qtest_outl(s, 0xc02d, 0x5a5500);
  94     qtest_writeb(s, 0x364001d0, 0x08);
  95     qtest_writeb(s, 0x364001d3, 0x58);
  96     qtest_writeb(s, 0x364001da, 0x01);
  97     qtest_writeb(s, 0x364001db, 0x26);
  98     qtest_writeb(s, 0x364001dc, 0x0d);
  99     qtest_writeb(s, 0x364001dd, 0xae);
 100     qtest_writeb(s, 0x364001de, 0x41);
 101     qtest_writeb(s, 0x364001df, 0x5a);
 102     qtest_writeb(s, 0x5a41ae0d, 0xf8);
 103     qtest_writeb(s, 0x5a41ae0e, 0x36);
 104     qtest_writeb(s, 0x5a41ae0f, 0xd7);
 105     qtest_writeb(s, 0x5a41ae10, 0x36);
 106     qtest_writeb(s, 0x36d736f8, 0x0c);
 107     qtest_writeb(s, 0x36d736f9, 0x80);
 108     qtest_writeb(s, 0x36d736fa, 0x0d);
 109     qtest_outl(s, 0xc02d, 0x364000);
 110
 111     qtest_quit(s);
 112 }
 113
 114 /*
 115  * This used to trigger the assert in lsi_do_dma()
 116  * https://bugs.launchpad.net/qemu/+bug/697510
 117  * https://bugs.launchpad.net/qemu/+bug/1905521
 118  * https://bugs.launchpad.net/qemu/+bug/1908515
 119  */
 120 static void test_lsi_do_dma_empty_queue(void)
 121 {
 122     QTestState *s;
 123
 124     s = qtest_init("-M q35 -nographic -monitor none -serial none "
 125                    "-drive if=none,id=drive0,"
 126                             "file=null-co://,file.read-zeroes=on,format=raw "
 127                    "-device lsi53c895a,id=scsi0 "
 128                    "-device scsi-hd,drive=drive0,"
 129                             "bus=scsi0.0,channel=0,scsi-id=0,lun=0");
 130     qtest_outl(s, 0xcf8, 0x80001814);
 131     qtest_outl(s, 0xcfc, 0xe1068000);
 132     qtest_outl(s, 0xcf8, 0x80001818);
 133     qtest_outl(s, 0xcf8, 0x80001804);
 134     qtest_outw(s, 0xcfc, 0x7);
 135     qtest_outl(s, 0xcf8, 0x80002010);
 136
 137     qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */
 138     qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */
 139
 140     qtest_quit(s);
 141 }
 142
 143 int main(int argc, char **argv)
 144 {
 145     g_test_init(&argc, &argv, NULL);
 146
 147     if (!qtest_has_device("lsi53c895a")) {
 148         return 0;
 149     }
 150
 151     qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
 152                    test_lsi_do_dma_empty_queue);
 153
 154     qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
 155                    test_lsi_do_msgout_cancel_req);
 156
 157     qtest_add_func("fuzz/lsi53c895a/lsi_dma_reentrancy",
 158                    test_lsi_dma_reentrancy);
 159
 160     return g_test_run();
 161 }