1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3  * QTest fuzzer-generated testcase for LSI53C895A device
4  *
5  * Copyright (c) Red Hat
6  */
7 
8 #include "qemu/osdep.h"
9 #include "libqtest.h"
10 
11 /*
12  * This used to trigger a DMA reentrancy issue
13  * leading to memory corruption bugs like stack
14  * overflow or use-after-free
15  * https://gitlab.com/qemu-project/qemu/-/issues/1563
16  */
17 static void test_lsi_dma_reentrancy(void)
18 {
19     QTestState *s;
20 
21     s = qtest_init("-M q35 -m 512M -nodefaults "
22                    "-blockdev driver=null-co,node-name=null0 "
23                    "-device lsi53c810 -device scsi-cd,drive=null0");
24 
25     qtest_outl(s, 0xcf8, 0x80000804); /* PCI Command Register */
26     qtest_outw(s, 0xcfc, 0x7);        /* Enables accesses */
27     qtest_outl(s, 0xcf8, 0x80000814); /* Memory Bar 1 */
28     qtest_outl(s, 0xcfc, 0xff100000); /* Set MMIO Address*/
29     qtest_outl(s, 0xcf8, 0x80000818); /* Memory Bar 2 */
30     qtest_outl(s, 0xcfc, 0xff000000); /* Set RAM Address*/
31     qtest_writel(s, 0xff000000, 0xc0000024);
32     qtest_writel(s, 0xff000114, 0x00000080);
33     qtest_writel(s, 0xff00012c, 0xff000000);
34     qtest_writel(s, 0xff000004, 0xff000114);
35     qtest_writel(s, 0xff000008, 0xff100014);
36     qtest_writel(s, 0xff10002f, 0x000000ff);
37 
38     qtest_quit(s);
39 }
40 
41 /*
42  * This used to trigger a UAF in lsi_do_msgout()
43  * https://gitlab.com/qemu-project/qemu/-/issues/972
44  */
45 static void test_lsi_do_msgout_cancel_req(void)
46 {
47     QTestState *s;
48 
49     if (sizeof(void *) == 4) {
50         g_test_skip("memory size too big for 32-bit build");
51         return;
52     }
53 
54     s = qtest_init("-M q35 -m 2G -nodefaults "
55                    "-device lsi53c895a,id=scsi "
56                    "-device scsi-hd,drive=disk0 "
57                    "-drive file=null-co://,id=disk0,if=none,format=raw");
58 
59     qtest_outl(s, 0xcf8, 0x80000810);
60     qtest_outl(s, 0xcf8, 0xc000);
61     qtest_outl(s, 0xcf8, 0x80000810);
62     qtest_outw(s, 0xcfc, 0x7);
63     qtest_outl(s, 0xcf8, 0x80000810);
64     qtest_outl(s, 0xcfc, 0xc000);
65     qtest_outl(s, 0xcf8, 0x80000804);
66     qtest_outw(s, 0xcfc, 0x05);
67     qtest_writeb(s, 0x69736c10, 0x08);
68     qtest_writeb(s, 0x69736c13, 0x58);
69     qtest_writeb(s, 0x69736c1a, 0x01);
70     qtest_writeb(s, 0x69736c1b, 0x06);
71     qtest_writeb(s, 0x69736c22, 0x01);
72     qtest_writeb(s, 0x69736c23, 0x07);
73     qtest_writeb(s, 0x69736c2b, 0x02);
74     qtest_writeb(s, 0x69736c48, 0x08);
75     qtest_writeb(s, 0x69736c4b, 0x58);
76     qtest_writeb(s, 0x69736c52, 0x04);
77     qtest_writeb(s, 0x69736c53, 0x06);
78     qtest_writeb(s, 0x69736c5b, 0x02);
79     qtest_outl(s, 0xc02d, 0x697300);
80     qtest_writeb(s, 0x5a554662, 0x01);
81     qtest_writeb(s, 0x5a554663, 0x07);
82     qtest_writeb(s, 0x5a55466a, 0x10);
83     qtest_writeb(s, 0x5a55466b, 0x22);
84     qtest_writeb(s, 0x5a55466c, 0x5a);
85     qtest_writeb(s, 0x5a55466d, 0x5a);
86     qtest_writeb(s, 0x5a55466e, 0x34);
87     qtest_writeb(s, 0x5a55466f, 0x5a);
88     qtest_writeb(s, 0x5a345a5a, 0x77);
89     qtest_writeb(s, 0x5a345a5b, 0x55);
90     qtest_writeb(s, 0x5a345a5c, 0x51);
91     qtest_writeb(s, 0x5a345a5d, 0x27);
92     qtest_writeb(s, 0x27515577, 0x41);
93     qtest_outl(s, 0xc02d, 0x5a5500);
94     qtest_writeb(s, 0x364001d0, 0x08);
95     qtest_writeb(s, 0x364001d3, 0x58);
96     qtest_writeb(s, 0x364001da, 0x01);
97     qtest_writeb(s, 0x364001db, 0x26);
98     qtest_writeb(s, 0x364001dc, 0x0d);
99     qtest_writeb(s, 0x364001dd, 0xae);
100     qtest_writeb(s, 0x364001de, 0x41);
101     qtest_writeb(s, 0x364001df, 0x5a);
102     qtest_writeb(s, 0x5a41ae0d, 0xf8);
103     qtest_writeb(s, 0x5a41ae0e, 0x36);
104     qtest_writeb(s, 0x5a41ae0f, 0xd7);
105     qtest_writeb(s, 0x5a41ae10, 0x36);
106     qtest_writeb(s, 0x36d736f8, 0x0c);
107     qtest_writeb(s, 0x36d736f9, 0x80);
108     qtest_writeb(s, 0x36d736fa, 0x0d);
109     qtest_outl(s, 0xc02d, 0x364000);
110 
111     qtest_quit(s);
112 }
113 
114 /*
115  * This used to trigger the assert in lsi_do_dma()
116  * https://bugs.launchpad.net/qemu/+bug/697510
117  * https://bugs.launchpad.net/qemu/+bug/1905521
118  * https://bugs.launchpad.net/qemu/+bug/1908515
119  */
120 static void test_lsi_do_dma_empty_queue(void)
121 {
122     QTestState *s;
123 
124     s = qtest_init("-M q35 -nographic -monitor none -serial none "
125                    "-drive if=none,id=drive0,"
126                             "file=null-co://,file.read-zeroes=on,format=raw "
127                    "-device lsi53c895a,id=scsi0 "
128                    "-device scsi-hd,drive=drive0,"
129                             "bus=scsi0.0,channel=0,scsi-id=0,lun=0");
130     qtest_outl(s, 0xcf8, 0x80001814);
131     qtest_outl(s, 0xcfc, 0xe1068000);
132     qtest_outl(s, 0xcf8, 0x80001818);
133     qtest_outl(s, 0xcf8, 0x80001804);
134     qtest_outw(s, 0xcfc, 0x7);
135     qtest_outl(s, 0xcf8, 0x80002010);
136 
137     qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */
138     qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */
139 
140     qtest_quit(s);
141 }
142 
143 int main(int argc, char **argv)
144 {
145     g_test_init(&argc, &argv, NULL);
146 
147     if (!qtest_has_device("lsi53c895a")) {
148         return 0;
149     }
150 
151     qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
152                    test_lsi_do_dma_empty_queue);
153 
154     qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
155                    test_lsi_do_msgout_cancel_req);
156 
157     qtest_add_func("fuzz/lsi53c895a/lsi_dma_reentrancy",
158                    test_lsi_dma_reentrancy);
159 
160     return g_test_run();
161 }
162