From: Paolo Bonzini <pbonzini@redhat.com>
To: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
qemu-devel@nongnu.org, alxndr@bu.edu, laurent@vivier.eu
Subject: Re: [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer
Date: Thu, 18 Mar 2021 19:13:28 +0100 [thread overview]
Message-ID: <dffedca1-d7e1-206b-3260-6b9d88ac7d54@redhat.com> (raw)
In-Reply-To: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk>
On 18/03/21 00:02, Mark Cave-Ayland wrote:
> Recently there have been a number of issues raised on Launchpad as a result of
> fuzzing the am53c974 (ESP) device. I spent some time over the past couple of
> days checking to see if anything had improved since my last patchset: from
> what I can tell the issues are still present, but the cmdfifo related failures
> now assert rather than corrupting memory.
>
> This patchset applied to master passes my local tests using the qtest fuzz test
> cases added by Alexander for the following Launchpad bugs:
>
> https://bugs.launchpad.net/qemu/+bug/1919035
> https://bugs.launchpad.net/qemu/+bug/1919036
> https://bugs.launchpad.net/qemu/+bug/1910723
> https://bugs.launchpad.net/qemu/+bug/1909247
>
> I'm posting this now just before soft freeze since I see that some of the issues
> have recently been allocated CVEs and so it could be argued that even though
> they have existed for some time, it is worth fixing them for 6.0.
>
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
>
> v2:
> - Add Alexander's R-B tag for patch 2 and Phil's R-B for patch 3
> - Add patch 4 for additional testcase provided in Alexander's patch 1 comment
> - Move current_req NULL checks forward in DMA functions (fixes ASAN bug reported
> at https://bugs.launchpad.net/qemu/+bug/1909247/comments/6) in patch 3
> - Add qtest for am53c974 containing a basic set of regression tests using the
> automatic test cases generated by the fuzzer as requested by Paolo
>
>
> Mark Cave-Ayland (6):
> esp: don't underflow cmdfifo if no message out/command data is present
> esp: don't overflow cmdfifo if TC is larger than the cmdfifo size
> esp: ensure cmdfifo is not empty and current_dev is non-NULL
> esp: don't underflow fifo when writing to the device
> esp: always check current_req is not NULL before use in DMA callbacks
> tests/qtest: add tests for am53c974 device
>
> hw/scsi/esp.c | 73 +++++++++++++--------
> tests/qtest/am53c974-test.c | 122 ++++++++++++++++++++++++++++++++++++
> tests/qtest/meson.build | 1 +
> 3 files changed, 171 insertions(+), 25 deletions(-)
> create mode 100644 tests/qtest/am53c974-test.c
>
Queued, thanks.
Paolo
next prev parent reply other threads:[~2021-03-18 18:31 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-17 23:02 [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 1/6] esp: don't underflow cmdfifo if no message out/command data is present Mark Cave-Ayland
2021-03-17 23:58 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 2/6] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-03-17 23:02 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-03-18 0:10 ` [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL\ Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 4/6] esp: don't underflow fifo when writing to the device Mark Cave-Ayland
2021-03-18 0:12 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-03-18 0:12 ` Alexander Bulekov
2021-03-17 23:02 ` [PATCH v2 6/6] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-03-18 0:14 ` Alexander Bulekov
2021-03-18 12:10 ` Paolo Bonzini
2021-03-18 18:13 ` Paolo Bonzini [this message]
2021-03-30 7:34 ` [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-03-30 9:59 ` Paolo Bonzini
2021-04-01 7:56 ` Mark Cave-Ayland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dffedca1-d7e1-206b-3260-6b9d88ac7d54@redhat.com \
--to=pbonzini@redhat.com \
--cc=alxndr@bu.edu \
--cc=laurent@vivier.eu \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).