1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 /* 3 * QTest fuzzer-generated testcase for LSI53C895A device 4 * 5 * Copyright (c) Red Hat 6 */ 7 8 #include "qemu/osdep.h" 9 #include "libqtest.h" 10 11 /* 12 * This used to trigger a DMA reentrancy issue 13 * leading to memory corruption bugs like stack 14 * overflow or use-after-free 15 * https://gitlab.com/qemu-project/qemu/-/issues/1563 16 */ 17 static void test_lsi_dma_reentrancy(void) 18 { 19 QTestState *s; 20 21 s = qtest_init("-M q35 -m 512M -nodefaults " 22 "-blockdev driver=null-co,node-name=null0 " 23 "-device lsi53c810 -device scsi-cd,drive=null0"); 24 25 qtest_outl(s, 0xcf8, 0x80000804); /* PCI Command Register */ 26 qtest_outw(s, 0xcfc, 0x7); /* Enables accesses */ 27 qtest_outl(s, 0xcf8, 0x80000814); /* Memory Bar 1 */ 28 qtest_outl(s, 0xcfc, 0xff100000); /* Set MMIO Address*/ 29 qtest_outl(s, 0xcf8, 0x80000818); /* Memory Bar 2 */ 30 qtest_outl(s, 0xcfc, 0xff000000); /* Set RAM Address*/ 31 qtest_writel(s, 0xff000000, 0xc0000024); 32 qtest_writel(s, 0xff000114, 0x00000080); 33 qtest_writel(s, 0xff00012c, 0xff000000); 34 qtest_writel(s, 0xff000004, 0xff000114); 35 qtest_writel(s, 0xff000008, 0xff100014); 36 qtest_writel(s, 0xff10002f, 0x000000ff); 37 38 qtest_quit(s); 39 } 40 41 /* 42 * This used to trigger a UAF in lsi_do_msgout() 43 * https://gitlab.com/qemu-project/qemu/-/issues/972 44 */ 45 static void test_lsi_do_msgout_cancel_req(void) 46 { 47 QTestState *s; 48 49 if (sizeof(void *) == 4) { 50 g_test_skip("memory size too big for 32-bit build"); 51 return; 52 } 53 54 s = qtest_init("-M q35 -m 2G -nodefaults " 55 "-device lsi53c895a,id=scsi " 56 "-device scsi-hd,drive=disk0 " 57 "-drive file=null-co://,id=disk0,if=none,format=raw"); 58 59 qtest_outl(s, 0xcf8, 0x80000810); 60 qtest_outl(s, 0xcf8, 0xc000); 61 qtest_outl(s, 0xcf8, 0x80000810); 62 qtest_outw(s, 0xcfc, 0x7); 63 qtest_outl(s, 0xcf8, 0x80000810); 64 qtest_outl(s, 0xcfc, 0xc000); 65 qtest_outl(s, 0xcf8, 0x80000804); 66 qtest_outw(s, 0xcfc, 0x05); 67 qtest_writeb(s, 0x69736c10, 0x08); 68 qtest_writeb(s, 0x69736c13, 0x58); 69 qtest_writeb(s, 0x69736c1a, 0x01); 70 qtest_writeb(s, 0x69736c1b, 0x06); 71 qtest_writeb(s, 0x69736c22, 0x01); 72 qtest_writeb(s, 0x69736c23, 0x07); 73 qtest_writeb(s, 0x69736c2b, 0x02); 74 qtest_writeb(s, 0x69736c48, 0x08); 75 qtest_writeb(s, 0x69736c4b, 0x58); 76 qtest_writeb(s, 0x69736c52, 0x04); 77 qtest_writeb(s, 0x69736c53, 0x06); 78 qtest_writeb(s, 0x69736c5b, 0x02); 79 qtest_outl(s, 0xc02d, 0x697300); 80 qtest_writeb(s, 0x5a554662, 0x01); 81 qtest_writeb(s, 0x5a554663, 0x07); 82 qtest_writeb(s, 0x5a55466a, 0x10); 83 qtest_writeb(s, 0x5a55466b, 0x22); 84 qtest_writeb(s, 0x5a55466c, 0x5a); 85 qtest_writeb(s, 0x5a55466d, 0x5a); 86 qtest_writeb(s, 0x5a55466e, 0x34); 87 qtest_writeb(s, 0x5a55466f, 0x5a); 88 qtest_writeb(s, 0x5a345a5a, 0x77); 89 qtest_writeb(s, 0x5a345a5b, 0x55); 90 qtest_writeb(s, 0x5a345a5c, 0x51); 91 qtest_writeb(s, 0x5a345a5d, 0x27); 92 qtest_writeb(s, 0x27515577, 0x41); 93 qtest_outl(s, 0xc02d, 0x5a5500); 94 qtest_writeb(s, 0x364001d0, 0x08); 95 qtest_writeb(s, 0x364001d3, 0x58); 96 qtest_writeb(s, 0x364001da, 0x01); 97 qtest_writeb(s, 0x364001db, 0x26); 98 qtest_writeb(s, 0x364001dc, 0x0d); 99 qtest_writeb(s, 0x364001dd, 0xae); 100 qtest_writeb(s, 0x364001de, 0x41); 101 qtest_writeb(s, 0x364001df, 0x5a); 102 qtest_writeb(s, 0x5a41ae0d, 0xf8); 103 qtest_writeb(s, 0x5a41ae0e, 0x36); 104 qtest_writeb(s, 0x5a41ae0f, 0xd7); 105 qtest_writeb(s, 0x5a41ae10, 0x36); 106 qtest_writeb(s, 0x36d736f8, 0x0c); 107 qtest_writeb(s, 0x36d736f9, 0x80); 108 qtest_writeb(s, 0x36d736fa, 0x0d); 109 qtest_outl(s, 0xc02d, 0x364000); 110 111 qtest_quit(s); 112 } 113 114 /* 115 * This used to trigger the assert in lsi_do_dma() 116 * https://bugs.launchpad.net/qemu/+bug/697510 117 * https://bugs.launchpad.net/qemu/+bug/1905521 118 * https://bugs.launchpad.net/qemu/+bug/1908515 119 */ 120 static void test_lsi_do_dma_empty_queue(void) 121 { 122 QTestState *s; 123 124 s = qtest_init("-M q35 -nographic -monitor none -serial none " 125 "-drive if=none,id=drive0," 126 "file=null-co://,file.read-zeroes=on,format=raw " 127 "-device lsi53c895a,id=scsi0 " 128 "-device scsi-hd,drive=drive0," 129 "bus=scsi0.0,channel=0,scsi-id=0,lun=0"); 130 qtest_outl(s, 0xcf8, 0x80001814); 131 qtest_outl(s, 0xcfc, 0xe1068000); 132 qtest_outl(s, 0xcf8, 0x80001818); 133 qtest_outl(s, 0xcf8, 0x80001804); 134 qtest_outw(s, 0xcfc, 0x7); 135 qtest_outl(s, 0xcf8, 0x80002010); 136 137 qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */ 138 qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */ 139 140 qtest_quit(s); 141 } 142 143 int main(int argc, char **argv) 144 { 145 g_test_init(&argc, &argv, NULL); 146 147 if (!qtest_has_device("lsi53c895a")) { 148 return 0; 149 } 150 151 qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue", 152 test_lsi_do_dma_empty_queue); 153 154 qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req", 155 test_lsi_do_msgout_cancel_req); 156 157 qtest_add_func("fuzz/lsi53c895a/lsi_dma_reentrancy", 158 test_lsi_dma_reentrancy); 159 160 return g_test_run(); 161 } 162