Re: [PATCH v2 3/4] tests/qtest/fuzz-test: Add test_megasas_cdb_len_zero() reproducer

[Thomas Huth]

On 01/12/2020 20.10, Philippe Mathieu-Daudé wrote:
> Add a reproducer which triggers (without the previous patch):
> 
>   $ make check-qtest-x86_64
>   Running test qtest-x86_64/fuzz-test
>   qemu-system-x86_64: hw/scsi/megasas.c:1679: megasas_handle_scsi: Assertion 
> `cdb_len > 0 && scsi_cdb_length(cdb) <= cdb_len' failed.
>   tests/qtest/libqtest.c:181: kill_qemu() detected QEMU death from signal 6 
> (Aborted) (core dumped)
>   ERROR qtest-x86_64/fuzz-test - too few tests run (expected 1, got 0)
> 
> Signed-off-by: Alexander Bulekov 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  tests/qtest/fuzz-test.c | 19 +++
>  1 file changed, 19 insertions(+)
> 
> diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c
> index 87b72307a5b..31f90cfb4fc 100644
> --- a/tests/qtest/fuzz-test.c
> +++ b/tests/qtest/fuzz-test.c
> @@ -48,6 +48,23 @@ static void 
> test_lp1878642_pci_bus_get_irq_level_assert(void)
>  qtest_quit(s);
>  }
>  
> +static void test_megasas_cdb_len_zero(void)
> +{
> +QTestState *s;
> +
> +s = qtest_init("-M pc -nodefaults "
> +   "-device megasas-gen2 -device scsi-cd,drive=null0 "
> +   "-blockdev 
> driver=null-co,read-zeroes=on,node-name=null0");
> +
> +qtest_outl(s, 0xcf8, 0x80001011);
> +qtest_outb(s, 0xcfc, 0xbb);
> +qtest_outl(s, 0xcf8, 0x80001002);
> +qtest_outl(s, 0xcfc, 0xf3ff2966);
> +qtest_writeb(s, 0x4600, 0x03);
> +qtest_outw(s, 0xbb40, 0x460b);
> +qtest_quit(s);
> +}
> +
>  int main(int argc, char **argv)
>  {
>  const char *arch = qtest_get_arch();
> @@ -59,6 +76,8 @@ int main(int argc, char **argv)
> test_lp1878263_megasas_zero_iov_cnt);
>  qtest_add_func("fuzz/test_lp1878642_pci_bus_get_irq_level_assert",
> test_lp1878642_pci_bus_get_irq_level_assert);
> +qtest_add_func("fuzz/test_megasas_cdb_len_zero",
> +   test_megasas_cdb_len_zero);
>  }
>  
>  return g_test_run();
> 

Acked-by: Thomas Huth 

Re: [PATCH v2 3/4] tests/qtest/fuzz-test: Add test_megasas_cdb_len_zero() reproducer

[Philippe Mathieu-Daudé]

On 12/1/20 8:10 PM, Philippe Mathieu-Daudé wrote:
> Add a reproducer which triggers (without the previous patch):
> 
>   $ make check-qtest-x86_64
>   Running test qtest-x86_64/fuzz-test
>   qemu-system-x86_64: hw/scsi/megasas.c:1679: megasas_handle_scsi: Assertion 
> `cdb_len > 0 && scsi_cdb_length(cdb) <= cdb_len' failed.
>   tests/qtest/libqtest.c:181: kill_qemu() detected QEMU death from signal 6 
> (Aborted) (core dumped)
>   ERROR qtest-x86_64/fuzz-test - too few tests run (expected 1, got 0)
> 
> Signed-off-by: Alexander Bulekov 
> Signed-off-by: Philippe Mathieu-Daudé 
> ---
>  tests/qtest/fuzz-test.c | 19 +++
>  1 file changed, 19 insertions(+)

Oops this should be patch #4...

[PATCH v2 3/4] tests/qtest/fuzz-test: Add test_megasas_cdb_len_zero() reproducer

[Philippe Mathieu-Daudé]

Add a reproducer which triggers (without the previous patch):

  $ make check-qtest-x86_64
  Running test qtest-x86_64/fuzz-test
  qemu-system-x86_64: hw/scsi/megasas.c:1679: megasas_handle_scsi: Assertion 
`cdb_len > 0 && scsi_cdb_length(cdb) <= cdb_len' failed.
  tests/qtest/libqtest.c:181: kill_qemu() detected QEMU death from signal 6 
(Aborted) (core dumped)
  ERROR qtest-x86_64/fuzz-test - too few tests run (expected 1, got 0)

Signed-off-by: Alexander Bulekov 
Signed-off-by: Philippe Mathieu-Daudé 
---
 tests/qtest/fuzz-test.c | 19 +++
 1 file changed, 19 insertions(+)

diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c
index 87b72307a5b..31f90cfb4fc 100644
--- a/tests/qtest/fuzz-test.c
+++ b/tests/qtest/fuzz-test.c
@@ -48,6 +48,23 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 qtest_quit(s);
 }
 
+static void test_megasas_cdb_len_zero(void)
+{
+QTestState *s;
+
+s = qtest_init("-M pc -nodefaults "
+   "-device megasas-gen2 -device scsi-cd,drive=null0 "
+   "-blockdev driver=null-co,read-zeroes=on,node-name=null0");
+
+qtest_outl(s, 0xcf8, 0x80001011);
+qtest_outb(s, 0xcfc, 0xbb);
+qtest_outl(s, 0xcf8, 0x80001002);
+qtest_outl(s, 0xcfc, 0xf3ff2966);
+qtest_writeb(s, 0x4600, 0x03);
+qtest_outw(s, 0xbb40, 0x460b);
+qtest_quit(s);
+}
+
 int main(int argc, char **argv)
 {
 const char *arch = qtest_get_arch();
@@ -59,6 +76,8 @@ int main(int argc, char **argv)
test_lp1878263_megasas_zero_iov_cnt);
 qtest_add_func("fuzz/test_lp1878642_pci_bus_get_irq_level_assert",
test_lp1878642_pci_bus_get_irq_level_assert);
+qtest_add_func("fuzz/test_megasas_cdb_len_zero",
+   test_megasas_cdb_len_zero);
 }
 
 return g_test_run();
-- 
2.26.2