riscv/qemu - qemu - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Thomas Huth	b987718bbb	hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) We cannot use the generic reentrancy guard in the LSI code, so we have to manually prevent endless reentrancy here. The problematic lsi_execute_script() function has already a way to detect whether too many instructions have been executed - we just have to slightly change the logic here that it also takes into account if the function has been called too often in a reentrant way. The code in fuzz-lsi53c895a-test.c has been taken from an earlier patch by Mauro Matteo Cascella. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563 Message-Id: <20230522091011.1082574-1-thuth@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>	3 years ago
Richard W.M. Jones	ae4b01b349	tests: Ensure TAP version is printed before other messages These two tests were failing with this error: stderr: TAP parsing error: version number must be on the first line [...] Unknown TAP version. The first line MUST be `TAP version <int>`. Assuming version 12. This can be fixed by ensuring we always call g_test_init first in the body of main. Thanks: Daniel Berrange, for diagnosing the problem Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20230227174019.1164205-1-rjones@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230228190653.1602033-17-alex.bennee@linaro.org>	3 years ago
Fabiano Rosas	dee66bc969	tests/qtest: Do not run lsi53c895a test if device is not present The tests are built once for all the targets, so as long as one QEMU binary is built with CONFIG_LSI_SCSI_PCI=y, this test will run. However some binaries might not include the device. So check this again in runtime. Signed-off-by: Fabiano Rosas <farosas@suse.de> Message-Id: <20230208194700.11035-3-farosas@suse.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>	3 years ago
Juan Quintela	f15cfe419e	qtest: "-display none" is set in qtest_init() So we don't need to set anywhere else. Signed-off-by: Juan Quintela <quintela@redhat.com> [thuth: Drop changes in tests/qtest/fuzz/ since the fuzzers still need this] Message-Id: <20220902165126.1482-2-quintela@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>	4 years ago
Mauro Matteo Cascella	a772ddc1c0	qtest/fuzz-lsi53c895a-test: set guest RAM to 2G test_lsi_do_msgout_cancel_req does not run on machines with small size memory. Reduce guest memory from 4G to 2G to alleviate the problem. Reported-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20220902133853.834065-1-mcascell@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>	4 years ago
Mauro Matteo Cascella	4367a20cc4	scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) Set current_req to NULL, not current_req->req, to prevent reusing a free'd buffer in case of repeated SCSI cancel requests. Also apply the fix to CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel the request. Thanks to Alexander Bulekov for providing a reproducer. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20220711123316.421279-1-mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	4 years ago
Marc-André Lureau	907b5105f1	tests: move libqtest.h back under qtest/ Since commit `a2ce7dbd91` ("meson: convert tests/qtest to meson"), libqtest.h is under libqos/ directory, while libqtest.c is still in qtest/. Move back to its original location to avoid mixing with libqos/. Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>	4 years ago
Thomas Huth	b911c30c56	tests/qtest: Move the fuzz tests to x86 only The fuzz tests are currently scheduled for all targets, but their setup code limits the run to "i386", so that these tests always show "SKIP" on other targets. Move it to the right x86 list in meson.build, then we can drop the architecture check during runtime, too. Message-Id: <20220414130127.719528-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>	4 years ago
Philippe Mathieu-Daudé	aa62976c9d	tests/qtest: Add fuzz-lsi53c895a-test Without the previous commit, this test triggers: $ make check-qtest-x86_64 [...] Running test qtest-x86_64/fuzz-lsi53c895a-test qemu-system-x86_64: hw/scsi/lsi53c895a.c:624: lsi_do_dma: Assertion `s->current' failed. ERROR qtest-x86_64/fuzz-lsi53c895a-test - too few tests run (expected 1, got 0) Suggested-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20211123111732.83137-3-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	4 years ago