From a7db0339ff184a34168de5c1faff523e180fec03 Mon Sep 17 00:00:00 2001 From: Xiao Wang Date: Fri, 11 Jan 2019 07:59:04 +0000 Subject: [PATCH 09/11] virtio-net-test: add large tx buffer test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Xiao Wang Message-id: <20190111075904.2030-10-jasowang@redhat.com> Patchwork-id: 83980 O-Subject: [RHEL8 qemu-kvm PATCH 9/9] virtio-net-test: add large tx buffer test Bugzilla: 1636784 RH-Acked-by: Thomas Huth RH-Acked-by: Philippe Mathieu-Daudé RH-Acked-by: Jens Freimann RH-Acked-by: Maxime Coquelin RH-Acked-by: Michael S. Tsirkin This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang Reviewed-by: Thomas Huth Message-id: 20181204035347.6148-6-jasowang@redhat.com Signed-off-by: Peter Maydell (cherry picked from commit 118cafff251318d16e1cfdef9cbf6b7d1e74cdb5) Signed-off-by: Danilo C. L. de Paula --- tests/virtio-net-test.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/tests/virtio-net-test.c b/tests/virtio-net-test.c index 9da8f3d..99bc605 100644 --- a/tests/virtio-net-test.c +++ b/tests/virtio-net-test.c @@ -245,6 +245,48 @@ static void pci_basic(gconstpointer data) g_free(dev); qtest_shutdown(qs); } + +static void large_tx(gconstpointer data) +{ + QVirtioPCIDevice *dev; + QOSState *qs; + QVirtQueuePCI *tx, *rx; + QVirtQueue *vq; + uint64_t req_addr; + uint32_t free_head; + size_t alloc_size = (size_t)data / 64; + int i; + + qs = pci_test_start("-netdev hubport,id=hp0,hubid=0 " + "-device virtio-net-pci,netdev=hp0"); + dev = virtio_net_pci_init(qs->pcibus, PCI_SLOT); + + rx = (QVirtQueuePCI *)qvirtqueue_setup(&dev->vdev, qs->alloc, 0); + tx = (QVirtQueuePCI *)qvirtqueue_setup(&dev->vdev, qs->alloc, 1); + + driver_init(&dev->vdev); + vq = &tx->vq; + + /* Bypass the limitation by pointing several descriptors to a single + * smaller area */ + req_addr = guest_alloc(qs->alloc, alloc_size); + free_head = qvirtqueue_add(vq, req_addr, alloc_size, false, true); + + for (i = 0; i < 64; i++) { + qvirtqueue_add(vq, req_addr, alloc_size, false, i != 63); + } + qvirtqueue_kick(&dev->vdev, vq, free_head); + + qvirtio_wait_used_elem(&dev->vdev, vq, free_head, NULL, + QVIRTIO_NET_TIMEOUT_US); + + qvirtqueue_cleanup(dev->vdev.bus, &tx->vq, qs->alloc); + qvirtqueue_cleanup(dev->vdev.bus, &rx->vq, qs->alloc); + qvirtio_pci_device_disable(dev); + g_free(dev->pdev); + g_free(dev); + qtest_shutdown(qs); +} #endif static void hotplug(void) @@ -269,6 +311,10 @@ int main(int argc, char **argv) qtest_add_data_func("/virtio/net/pci/basic", send_recv_test, pci_basic); qtest_add_data_func("/virtio/net/pci/rx_stop_cont", stop_cont_test, pci_basic); + qtest_add_data_func("/virtio/net/pci/large_tx_uint_max", + (gconstpointer)UINT_MAX, large_tx); + qtest_add_data_func("/virtio/net/pci/large_tx_net_bufsize", + (gconstpointer)NET_BUFSIZE, large_tx); #endif qtest_add_func("/virtio/net/pci/hotplug", hotplug); -- 1.8.3.1