[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 1/4] esp: don't underflow cmdfifo if no message out/command d
From: |
Alexander Bulekov |
Subject: |
Re: [PATCH 1/4] esp: don't underflow cmdfifo if no message out/command data is present |
Date: |
Wed, 17 Mar 2021 11:37:12 -0400 |
On 210316 2330, Mark Cave-Ayland wrote:
> If a guest sends a TI (Transfer Information) command without previously
> sending
> any message out/command phase data then cmdfifo will underflow triggering an
> assert reading the IDENTIFY byte.
>
> Buglink: https://bugs.launchpad.net/qemu/+bug/1919035
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Hi Mark,
The original reproducer no longer asserts, but I ran through the fuzz
corpus, and there is another one, that still seems to trigger the same
bug:
cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, \
-m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
outl 0xcf8 0x80001010
outl 0xcfc 0xc000
outl 0xcf8 0x80001004
outw 0xcfc 0x01
outl 0xc008 0x0a
outl 0xc009 0x41000000
outl 0xc009 0x41000000
outl 0xc00b 0x1000
EOF
C Code testcase below.
Thanks
-Alex
/*
* Autogenerated Fuzzer Test Case
*
* Copyright (c) 2021 <name of author>
*
* This work is licensed under the terms of the GNU GPL, version 2 or
* later. See the COPYING file in the top-level directory.
*/
#include "qemu/osdep.h"
#include "libqos/libqtest.h"
/*
* cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, \
* -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
* id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
* outl 0xcf8 0x80001010
* outl 0xcfc 0xc000
* outl 0xcf8 0x80001004
* outw 0xcfc 0x01
* outl 0xc008 0x0a
* outl 0xc009 0x41000000
* outl 0xc009 0x41000000
* outl 0xc00b 0x1000
* EOF
*/
static void test_fuzz(void)
{
QTestState *s = qtest_init(
"-display none , -m 512M -device am53c974,id=scsi -device "
"scsi-hd,drive=disk0 -drive "
"id=disk0,if=none,file=null-co://,format=raw -nodefaults ");
qtest_outl(s, 0xcf8, 0x80001010);
qtest_outl(s, 0xcfc, 0xc000);
qtest_outl(s, 0xcf8, 0x80001004);
qtest_outw(s, 0xcfc, 0x01);
qtest_outl(s, 0xc008, 0x0a);
qtest_outl(s, 0xc009, 0x41000000);
qtest_outl(s, 0xc009, 0x41000000);
qtest_outl(s, 0xc00b, 0x1000);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
g_test_init(&argc, &argv, NULL);
if (strcmp(arch, "i386") == 0) {
qtest_add_func("fuzz/test_fuzz", test_fuzz);
}
return g_test_run();
}
- [PATCH 0/4] esp: fix asserts/segfaults discovered by fuzzer, Mark Cave-Ayland, 2021/03/16
- [PATCH 1/4] esp: don't underflow cmdfifo if no message out/command data is present, Mark Cave-Ayland, 2021/03/16
- [PATCH 2/4] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size, Mark Cave-Ayland, 2021/03/16
- [PATCH 3/4] esp: ensure cmdfifo is not empty and current_dev is non-NULL, Mark Cave-Ayland, 2021/03/16
- [PATCH 4/4] esp: always check current_req is not NULL before use in DMA callbacks, Mark Cave-Ayland, 2021/03/16
- Re: [PATCH 0/4] esp: fix asserts/segfaults discovered by fuzzer, Philippe Mathieu-Daudé, 2021/03/16
- Re: [PATCH 0/4] esp: fix asserts/segfaults discovered by fuzzer, Paolo Bonzini, 2021/03/17