OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
8893790966
qemu-e2k/tests
History
Li Qiang 1153cf9f5b qtest: add tulip test case 
The tulip networking card emulation has an OOB issue in
'tulip_copy_tx_buffers' when the guest provide malformed descriptor.
This test will trigger a ASAN heap overflow crash. To trigger this
issue we can construct the data as following:

1. construct a 'tulip_descriptor'. Its control is set to
'0x7ff | 0x7ff << 11', this will make the 'tulip_copy_tx_buffers's
'len1' and 'len2' to 0x7ff(2047). So 'len1+len2' will overflow
'TULIPState's 'tx_frame' field. This descriptor's 'buf_addr1' and
'buf_addr2' should set to a guest address.

2. write this descriptor to tulip device's CSR4 register. This will
set the 'TULIPState's 'current_tx_desc' field.

3. write 'CSR6_ST' to tulip device's CSR6 register. This will trigger
'tulip_xmit_list_update' and finally calls 'tulip_copy_tx_buffers'.

Following shows the backtrack of crash:

==31781==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x628000007cd0 at pc 0x7fe03c5a077a bp 0x7fff05b46770 sp 0x7fff05b45f18
WRITE of size 2047 at 0x628000007cd0 thread T0
    #0 0x7fe03c5a0779  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79779)
    #1 0x5575fb6daa6a in flatview_read_continue /home/test/qemu/exec.c:3194
    #2 0x5575fb6daccb in flatview_read /home/test/qemu/exec.c:3227
    #3 0x5575fb6dae66 in address_space_read_full /home/test/qemu/exec.c:3240
    #4 0x5575fb6db0cb in address_space_rw /home/test/qemu/exec.c:3268
    #5 0x5575fbdfd460 in dma_memory_rw_relaxed /home/test/qemu/include/sysemu/dma.h:87
    #6 0x5575fbdfd4b5 in dma_memory_rw /home/test/qemu/include/sysemu/dma.h:110
    #7 0x5575fbdfd866 in pci_dma_rw /home/test/qemu/include/hw/pci/pci.h:787
    #8 0x5575fbdfd8a3 in pci_dma_read /home/test/qemu/include/hw/pci/pci.h:794
    #9 0x5575fbe02761 in tulip_copy_tx_buffers hw/net/tulip.c:585
    #10 0x5575fbe0366b in tulip_xmit_list_update hw/net/tulip.c:678
    #11 0x5575fbe04073 in tulip_write hw/net/tulip.c:783

Signed-off-by: Li Qiang <liq3ea@163.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31 21:14:35 +08:00
..
acceptance Acceptance test: add "boot_linux" tests 2020-03-17 18:55:52 -04:00
data rebuild-expected-aml.sh: remind about the process 2020-02-25 08:23:18 -05:00
decode decodetree: Allow !function with no input bits 2019-08-19 08:03:41 -07:00
docker tests/docker: Add libepoxy and libudev packages to the Fedora image 2020-03-27 13:43:20 +00:00
fp testing: don't nest build for fp-test 2020-01-09 11:41:29 +00:00
guest-debug tests/guest-debug: add a simple test runner 2020-03-17 17:38:47 +00:00
image-fuzzer image-fuzzer: Use OSerror.strerror instead of tuple subscript 2019-11-05 16:36:11 +01:00
keys
migration drop "from __future__ import print_function" 2020-02-07 15:15:16 +01:00
multiboot tests/multiboot: Fix load address of test kernels 2019-07-30 12:25:43 +02:00
perf/block/qcow2 tests/perf: Test lseek influence on qcow2 block-status 2019-06-04 15:20:41 +02:00
plugin tests/plugins: make howvec clean-up after itself. 2020-02-25 20:20:23 +00:00
qapi-schema qapi: New special feature flag "deprecated" 2020-03-17 21:42:47 +01:00
qemu-iotests iotests/138: Test leaks/corruptions fixed report 2020-03-26 14:52:43 +01:00
qtest qtest: add tulip test case 2020-03-31 21:14:35 +08:00
rocker
tcg tests/tcg/aarch64: add test-sve-ioctl guest-debug test 2020-03-17 17:38:47 +00:00
uefi-test-tools edk2 build scripts: work around TianoCore#1607 without forcing Python 2 2019-10-07 15:14:15 +02:00
vm tests/vm: fix basevm config 2020-03-27 13:43:20 +00:00
vmstate-static-checker-data
.gitignore tests/tcg/aarch64: add a gdbstub testcase for SVE registers 2020-03-17 17:38:47 +00:00
atomic64-bench.c
atomic_add-bench.c
benchmark-crypto-cipher.c tests: benchmark crypto with fixed data size, not time period 2019-10-28 13:32:21 +01:00
benchmark-crypto-hash.c tests: benchmark crypto with fixed data size, not time period 2019-10-28 13:32:21 +01:00
benchmark-crypto-hmac.c
check-block-qdict.c
check-block.sh build: move TARGET_GPROF to config-host.mak 2020-02-12 16:29:27 +01:00
check-qdict.c
check-qjson.c test: Use g_strndup instead of plain strndup 2019-08-21 10:27:13 +02:00
check-qlist.c
check-qlit.c
check-qnull.c
check-qnum.c
check-qobject.c
check-qom-interface.c
check-qom-proplist.c
check-qstring.c
crypto-tls-psk-helpers.c
crypto-tls-psk-helpers.h Supply missing header guards 2019-06-12 13:20:21 +02:00
crypto-tls-x509-helpers.c
crypto-tls-x509-helpers.h Supply missing header guards 2019-06-12 13:20:21 +02:00
dbus-vmstate-daemon.sh tests: add dbus-vmstate-test 2020-01-06 18:41:32 +04:00
io-channel-helpers.c
io-channel-helpers.h Normalize position of header guard 2019-06-12 13:20:20 +02:00
iothread.c tests/iothread: Always connect iothread GSource to a GMainContext 2020-01-07 14:32:57 +00:00
iothread.h
Makefile.include Python and tests (mostly acceptance) patches 2020-03-17 2020-03-19 12:33:50 +00:00
pkix_asn1_tab.c
ptimer-test-stubs.c util/qemu-timer: refactor deadline calculation for external timers 2019-08-20 17:26:21 +02:00
ptimer-test.c tests/ptimer: Remove unnecessary inclusion of libqtest.h 2020-01-12 11:42:40 +01:00
ptimer-test.h
qht-bench.c
rcutorture.c tests/rcutorture: mild documenting refactor of update thread 2020-02-25 17:42:59 +00:00
requirements.txt Acceptance test: add "boot_linux" tests 2020-03-17 18:55:52 -04:00
socket-helpers.c tests: specify the address family when checking bind 2019-08-22 17:30:25 +04:00
socket-helpers.h tests: specify the address family when checking bind 2019-08-22 17:30:25 +04:00
test-aio-multithread.c
test-aio.c util/async: make bh_aio_poll() O(1) 2020-02-22 08:26:47 +00:00
test-authz-list.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-authz-listfile.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-authz-pam.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-authz-simple.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-base64.c
test-bdrv-drain.c job: drop job_drain 2019-09-10 08:58:43 +02:00
test-bdrv-graph-mod.c Include qemu/main-loop.h less 2019-08-16 13:31:52 +02:00
test-bitcnt.c
test-bitmap.c tests: use g_test_rand_int 2019-12-17 09:05:23 +01:00
test-bitops.c
test-block-backend.c Include qemu/main-loop.h less 2019-08-16 13:31:52 +02:00
test-block-iothread.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
test-blockjob-txn.c job: drop job_drain 2019-09-10 08:58:43 +02:00
test-blockjob.c tests-blockjob: Use error_free_or_abort() 2019-12-18 08:36:16 +01:00
test-bufferiszero.c
test-char.c chardev: Use QEMUChrEvent enum in IOEventHandler typedef 2020-01-08 11:15:35 +01:00
test-clone-visitor.c
test-coroutine.c
test-crypto-afsplit.c
test-crypto-block.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-crypto-cipher.c
test-crypto-hash.c
test-crypto-hmac.c
test-crypto-ivgen.c
test-crypto-pbkdf.c
test-crypto-secret.c
test-crypto-tlscredsx509.c glib: use portable g_setenv() 2019-12-17 09:05:23 +01:00
test-crypto-tlssession.c glib: use portable g_setenv() 2019-12-17 09:05:23 +01:00
test-crypto-xts.c
test-cutils.c
test-hbitmap.c block/dirty-bitmap: improve _next_dirty_area API 2020-03-18 14:03:46 -04:00
test-image-locking.c Include qemu/main-loop.h less 2019-08-16 13:31:52 +02:00
test-int128.c
test-io-channel-buffer.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-io-channel-command.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-io-channel-file.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-io-channel-socket.c socket: Add num connections to qio_channel_socket_async() 2019-09-03 23:24:42 +02:00
test-io-channel-tls.c glib: use portable g_setenv() 2019-12-17 09:05:23 +01:00
test-io-task.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
test-iov.c
test-keyval.c test-keyval: Tighten test of trailing crap after size 2019-12-18 12:28:44 +01:00
test-logging.c test-logging: Fix -Werror=maybe-uninitialized warning 2020-02-04 09:00:57 +01:00
test-mul64.c
test-opts-visitor.c
test-qapi-util.c
test-qdev-global-props.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
test-qdist.c
test-qemu-opts.c
test-qga.c tests: use g_test_rand_int 2019-12-17 09:05:23 +01:00
test-qgraph.c
test-qht-par.c
test-qht.c
test-qmp-cmds.c qapi: Add feature flags to remaining definitions 2020-03-17 19:58:34 +01:00
test-qmp-event.c tests/test-qmp-event: Check event is actually emitted 2020-03-17 19:58:34 +01:00
test-qobject-input-visitor.c
test-qobject-output-visitor.c tests: Clean up initialization of Error *err variables 2019-12-18 08:36:15 +01:00
test-rcu-list.c tests: Fix a bug with count variables 2020-03-06 10:35:15 +00:00
test-rcu-simpleq.c
test-rcu-slist.c rcu_queue: add QSLIST functions 2020-02-22 08:26:47 +00:00
test-rcu-tailq.c
test-replication.c tests/test-replication.c: Add test for for secondary node continuing replication 2020-03-03 18:04:47 +08:00
test-shift128.c
test-string-input-visitor.c tests: Fix uninitialized byte in test_visitor_in_fuzz 2019-08-20 17:26:19 +02:00
test-string-output-visitor.c tests: Clean up initialization of Error *err variables 2019-12-18 08:36:15 +01:00
test-thread-pool.c test-thread-pool: be more reliable 2019-06-03 14:03:00 +02:00
test-throttle.c test-throttle: Fix uninitialized use of burst_length 2019-08-20 17:26:19 +02:00
test-timed-average.c
test-util-filemonitor.c tests/test-util-filemonitor: Skip test on non-x86 Travis containers 2019-12-18 20:17:45 +00:00
test-util-sockets.c hmp: Fail gracefully if chardev is already in use 2020-03-06 17:21:28 +01:00
test-uuid.c
test-visitor-serialization.c
test-vmstate.c test-vmstate: Fix memleaks in test_load_qlist 2020-02-28 09:25:49 +01:00
test-write-threshold.c
test-x86-cpuid.c hw/i386: Update structures to save the number of nodes per package 2020-03-17 19:48:10 -04:00
test-xbzrle.c
vhost-user-bridge.c core: replace getpagesize() with qemu_real_host_page_size 2019-10-26 15:38:06 +02:00