mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-04 00:03:54 -06:00
* SCSI fuzzing fix (Mauro)
* pre-install data files in the build directory (Akihiko) * SCSI fixes for Mac OS (Mark) -----BEGIN PGP SIGNATURE----- iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmLO3bQUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroNv5AgAgGe8hGOcqJSzmFgeUJ7UEaauap6E fF4zau8Xux7R6pnvPe2FeJ70AlvstFAUoU++7G3linQ+eqnFD7E18KQkfp9qX7jY xDFPJRf6JNhwDjxQ2Tp0ShOcm5HkDv4Z4cPlx0T+wfKTlUWCzNEkhVrjOhpDYnSe OldsdFjY0sUjZ1R/QNiuQ65aWwOr9gJ07KfakJQMX2YCMun6SO3kB/GtmyecTV3C uNAUIdqJLsEbR1ckdMVVmixhtzMPW2R7/vjJkxG8RXUAcDmDHkuKPhWKyZ9a7/hh CV8iMQMup6mgT8ndb5DWv551Y+C/rA1bH9U1NkaeQ9RP83CE4a6fpSMiiQ== =82zT -----END PGP SIGNATURE----- Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging * SCSI fuzzing fix (Mauro) * pre-install data files in the build directory (Akihiko) * SCSI fixes for Mac OS (Mark) # gpg: Signature made Wed 13 Jul 2022 15:59:00 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: pc-bios/s390-ccw: add -Wno-array-bounds q800: add default vendor and product information for scsi-cd devices q800: add default vendor and product information for scsi-hd devices scsi-disk: allow MODE SELECT block descriptor to set the block size scsi-disk: allow the MODE_PAGE_R_W_ERROR AWRE bit to be changeable for CDROM drives q800: implement compat_props to enable quirk_mode_page_truncated for scsi-cd devices scsi-disk: add SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED quirk for Macintosh scsi-disk: add FORMAT UNIT command q800: implement compat_props to enable quirk_mode_page_vendor_specific_apple for scsi devices scsi-disk: add SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE quirk for Macintosh q800: implement compat_props to enable quirk_mode_sense_rom_use_dbd for scsi-cd devices scsi-disk: add SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD quirk for Macintosh q800: implement compat_props to enable quirk_mode_page_apple_vendor for scsi-cd devices scsi-disk: add MODE_PAGE_APPLE_VENDOR quirk for Macintosh scsi-disk: add new quirks bitmap to SCSIDiskState meson: Prefix each element of firmware path module: Use bundle mechanism datadir: Use bundle mechanism cutils: Introduce bundle mechanism scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell
commit
285f64fcbf
26 changed files with 348 additions and 113 deletions
|
|
@ -8,6 +8,79 @@
|
|||
#include "qemu/osdep.h"
|
||||
#include "libqtest.h"
|
||||
|
||||
/*
|
||||
* This used to trigger a UAF in lsi_do_msgout()
|
||||
* https://gitlab.com/qemu-project/qemu/-/issues/972
|
||||
*/
|
||||
static void test_lsi_do_msgout_cancel_req(void)
|
||||
{
|
||||
QTestState *s;
|
||||
|
||||
if (sizeof(void *) == 4) {
|
||||
g_test_skip("memory size too big for 32-bit build");
|
||||
return;
|
||||
}
|
||||
|
||||
s = qtest_init("-M q35 -m 4G -display none -nodefaults "
|
||||
"-device lsi53c895a,id=scsi "
|
||||
"-device scsi-hd,drive=disk0 "
|
||||
"-drive file=null-co://,id=disk0,if=none,format=raw");
|
||||
|
||||
qtest_outl(s, 0xcf8, 0x80000810);
|
||||
qtest_outl(s, 0xcf8, 0xc000);
|
||||
qtest_outl(s, 0xcf8, 0x80000810);
|
||||
qtest_outw(s, 0xcfc, 0x7);
|
||||
qtest_outl(s, 0xcf8, 0x80000810);
|
||||
qtest_outl(s, 0xcfc, 0xc000);
|
||||
qtest_outl(s, 0xcf8, 0x80000804);
|
||||
qtest_outw(s, 0xcfc, 0x05);
|
||||
qtest_writeb(s, 0x69736c10, 0x08);
|
||||
qtest_writeb(s, 0x69736c13, 0x58);
|
||||
qtest_writeb(s, 0x69736c1a, 0x01);
|
||||
qtest_writeb(s, 0x69736c1b, 0x06);
|
||||
qtest_writeb(s, 0x69736c22, 0x01);
|
||||
qtest_writeb(s, 0x69736c23, 0x07);
|
||||
qtest_writeb(s, 0x69736c2b, 0x02);
|
||||
qtest_writeb(s, 0x69736c48, 0x08);
|
||||
qtest_writeb(s, 0x69736c4b, 0x58);
|
||||
qtest_writeb(s, 0x69736c52, 0x04);
|
||||
qtest_writeb(s, 0x69736c53, 0x06);
|
||||
qtest_writeb(s, 0x69736c5b, 0x02);
|
||||
qtest_outl(s, 0xc02d, 0x697300);
|
||||
qtest_writeb(s, 0x5a554662, 0x01);
|
||||
qtest_writeb(s, 0x5a554663, 0x07);
|
||||
qtest_writeb(s, 0x5a55466a, 0x10);
|
||||
qtest_writeb(s, 0x5a55466b, 0x22);
|
||||
qtest_writeb(s, 0x5a55466c, 0x5a);
|
||||
qtest_writeb(s, 0x5a55466d, 0x5a);
|
||||
qtest_writeb(s, 0x5a55466e, 0x34);
|
||||
qtest_writeb(s, 0x5a55466f, 0x5a);
|
||||
qtest_writeb(s, 0x5a345a5a, 0x77);
|
||||
qtest_writeb(s, 0x5a345a5b, 0x55);
|
||||
qtest_writeb(s, 0x5a345a5c, 0x51);
|
||||
qtest_writeb(s, 0x5a345a5d, 0x27);
|
||||
qtest_writeb(s, 0x27515577, 0x41);
|
||||
qtest_outl(s, 0xc02d, 0x5a5500);
|
||||
qtest_writeb(s, 0x364001d0, 0x08);
|
||||
qtest_writeb(s, 0x364001d3, 0x58);
|
||||
qtest_writeb(s, 0x364001da, 0x01);
|
||||
qtest_writeb(s, 0x364001db, 0x26);
|
||||
qtest_writeb(s, 0x364001dc, 0x0d);
|
||||
qtest_writeb(s, 0x364001dd, 0xae);
|
||||
qtest_writeb(s, 0x364001de, 0x41);
|
||||
qtest_writeb(s, 0x364001df, 0x5a);
|
||||
qtest_writeb(s, 0x5a41ae0d, 0xf8);
|
||||
qtest_writeb(s, 0x5a41ae0e, 0x36);
|
||||
qtest_writeb(s, 0x5a41ae0f, 0xd7);
|
||||
qtest_writeb(s, 0x5a41ae10, 0x36);
|
||||
qtest_writeb(s, 0x36d736f8, 0x0c);
|
||||
qtest_writeb(s, 0x36d736f9, 0x80);
|
||||
qtest_writeb(s, 0x36d736fa, 0x0d);
|
||||
qtest_outl(s, 0xc02d, 0x364000);
|
||||
|
||||
qtest_quit(s);
|
||||
}
|
||||
|
||||
/*
|
||||
* This used to trigger the assert in lsi_do_dma()
|
||||
* https://bugs.launchpad.net/qemu/+bug/697510
|
||||
|
|
@ -44,5 +117,8 @@ int main(int argc, char **argv)
|
|||
qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
|
||||
test_lsi_do_dma_empty_queue);
|
||||
|
||||
qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
|
||||
test_lsi_do_msgout_cancel_req);
|
||||
|
||||
return g_test_run();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -158,8 +158,6 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
|
|||
{
|
||||
|
||||
char *target_name;
|
||||
const char *bindir;
|
||||
char *datadir;
|
||||
GString *cmd_line;
|
||||
gchar *pretty_cmd_line;
|
||||
bool serialize = false;
|
||||
|
|
@ -174,22 +172,6 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
|
|||
target_name = strstr(**argv, "-target-");
|
||||
if (target_name) { /* The binary name specifies the target */
|
||||
target_name += strlen("-target-");
|
||||
/*
|
||||
* With oss-fuzz, the executable is kept in the root of a directory (we
|
||||
* cannot assume the path). All data (including bios binaries) must be
|
||||
* in the same dir, or a subdir. Thus, we cannot place the pc-bios so
|
||||
* that it would be in exec_dir/../pc-bios.
|
||||
* As a workaround, oss-fuzz allows us to use argv[0] to get the
|
||||
* location of the executable. Using this we add exec_dir/pc-bios to
|
||||
* the datadirs.
|
||||
*/
|
||||
bindir = qemu_get_exec_dir();
|
||||
datadir = g_build_filename(bindir, "pc-bios", NULL);
|
||||
if (g_file_test(datadir, G_FILE_TEST_IS_DIR)) {
|
||||
qemu_add_data_dir(datadir);
|
||||
} else {
|
||||
g_free(datadir);
|
||||
}
|
||||
} else if (*argc > 1) { /* The target is specified as an argument */
|
||||
target_name = (*argv)[1];
|
||||
if (!strstr(target_name, "--fuzz-target=")) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue