summaryrefslogtreecommitdiffstats
path: root/tests/qtest/fuzz-lsi53c895a-test.c
Commit message (Collapse)AuthorAgeFilesLines
* qtest: "-display none" is set in qtest_init()Juan Quintela2022-10-111-1/+1
| | | | | | | | | So we don't need to set anywhere else. Signed-off-by: Juan Quintela <quintela@redhat.com> [thuth: Drop changes in tests/qtest/fuzz/ since the fuzzers still need this] Message-Id: <20220902165126.1482-2-quintela@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* qtest/fuzz-lsi53c895a-test: set guest RAM to 2GMauro Matteo Cascella2022-09-191-1/+1
| | | | | | | | | | | | | test_lsi_do_msgout_cancel_req does not run on machines with small size memory. Reduce guest memory from 4G to 2G to alleviate the problem. Reported-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20220902133853.834065-1-mcascell@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)Mauro Matteo Cascella2022-07-131-0/+76
| | | | | | | | | | | | | | | | Set current_req to NULL, not current_req->req, to prevent reusing a free'd buffer in case of repeated SCSI cancel requests. Also apply the fix to CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel the request. Thanks to Alexander Bulekov for providing a reproducer. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20220711123316.421279-1-mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* tests: move libqtest.h back under qtest/Marc-André Lureau2022-05-031-1/+1
| | | | | | | | | | | Since commit a2ce7dbd917 ("meson: convert tests/qtest to meson"), libqtest.h is under libqos/ directory, while libqtest.c is still in qtest/. Move back to its original location to avoid mixing with libqos/. Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
* tests/qtest: Move the fuzz tests to x86 onlyThomas Huth2022-04-201-6/+2Star
| | | | | | | | | | | The fuzz tests are currently scheduled for all targets, but their setup code limits the run to "i386", so that these tests always show "SKIP" on other targets. Move it to the right x86 list in meson.build, then we can drop the architecture check during runtime, too. Message-Id: <20220414130127.719528-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest: Add fuzz-lsi53c895a-testPhilippe Mathieu-Daudé2021-11-301-0/+52
Without the previous commit, this test triggers: $ make check-qtest-x86_64 [...] Running test qtest-x86_64/fuzz-lsi53c895a-test qemu-system-x86_64: hw/scsi/lsi53c895a.c:624: lsi_do_dma: Assertion `s->current' failed. ERROR qtest-x86_64/fuzz-lsi53c895a-test - too few tests run (expected 1, got 0) Suggested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20211123111732.83137-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>