From nobody Mon Feb 9 08:19:23 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of _spf.google.com designates 209.85.221.51 as permitted sender) client-ip=209.85.221.51; envelope-from=philippe.mathieu.daude@gmail.com; helo=mail-wr1-f51.google.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of _spf.google.com designates 209.85.221.51 as permitted sender) smtp.mailfrom=philippe.mathieu.daude@gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1623840233; cv=none; d=zohomail.com; s=zohoarc; b=SJYRXA90RR+CJBtfrdgTz5qlScQ8kNpVXlgSDbL4mrJwB+FtPQ6FGCVs+bB3qvJMES8+oPHaG/uWqFubxnK9Co5J9V2E7EeFOumyX6jgV8U1uwX7YNJLT4qA68TGYCoSkbe2wYZpDy6PcCmK8cyhD1KH41zsUxkt7YQ8FyN4yjk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1623840233; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:MIME-Version:Message-ID:Sender:Subject:To; bh=UAVfUJHulbrUfT86pvPmOWYnBxX7mZ7NTqcwWBwD568=; b=Etznz3m6TOk1kTtZ0Q1i1qAmkA6K6jQg3x5np7My2iLvhG0RGXNhjqyt+CPYH9c72fS00orY5E/NvOsGufg7P6BK34lBMK6KSbbXkLGqBDQ9+3ktVHArh85zHKgt1OCxTVxII7CDFUlEtX8jyyA5j0uqkR3hwVhjF8retC+k0bU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of _spf.google.com designates 209.85.221.51 as permitted sender) smtp.mailfrom=philippe.mathieu.daude@gmail.com Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.zohomail.com with SMTPS id 1623840233291267.3803635152668; Wed, 16 Jun 2021 03:43:53 -0700 (PDT) Received: by mail-wr1-f51.google.com with SMTP id m18so2128913wrv.2 for ; Wed, 16 Jun 2021 03:43:52 -0700 (PDT) Return-Path: Return-Path: Received: from x1w.redhat.com (93.red-83-35-24.dynamicip.rima-tde.net. [83.35.24.93]) by smtp.gmail.com with ESMTPSA id k5sm1645655wmk.11.2021.06.16.03.43.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Jun 2021 03:43:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=UAVfUJHulbrUfT86pvPmOWYnBxX7mZ7NTqcwWBwD568=; b=fok5f+Ybxuoy5wnMQlLZms3MQ17u8uqT0bgtIih19uAcoDxKex9mwRQNKsvP1bhSlU V59Wl3mswi1YP6soc/K4hqPluRlH1qJ4eYYlr7wgwnyTqgLFQxXmLZnqz2jblu/oSbye HbXMvSZ+9I8Q7C99R4mbBHR8mWcSOHSLA5jzm112rVfnx5seSmQo3yZ8grMupCp2ANZd T+TTgEWLlmXoy27C1q5mMgydXDXtXDYVij7D76PIR8IyMfVAzzUbQKh9jQPTdS3MLgUs rNx1tTID1cC2L8iqFoPg7zvLI4tkW6u01b+GED5+mBS6iM6NLIHFpncO4UQy6VZXPKP2 JyMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :mime-version:content-transfer-encoding; bh=UAVfUJHulbrUfT86pvPmOWYnBxX7mZ7NTqcwWBwD568=; b=fkYlcjVt6nncHVMDimAYuXGhqU7Z48ZZ3TeS+YpXnfAAT0bfSZ1DEWSMuc4jfYlC+J ACwMrQrQ2GYlFOsDjHG+de7Oqx/8tbeW9iTK5ahuegQLp9RsHz0UtRgSR8AFtob8lyMM UJvhkFXxd/qYZzbzt9YvAtgz35K7UPV7CxF142KimKzQ3U+sJu+LVSWRHCW10egFId9l IQ317AynqSvXYEUR+lSmJckekLCNKJtGNMaNveouMyN9kXMZtJQqQf9hlRxoQ5uT0BLc ovazkBNjzQRJm1iuXomuzcf4utjRMIqQOaZp34NANueaeZnWuL/GeM8S/Jx4lQ5XfC/l xEFw== X-Gm-Message-State: AOAM531Nia2o7FUvyqX9MB57OTKWabLYm/a5zZ3L9sHR2rxyyUPhahPn WL9W9dDMEORM0bEqYUuTzks= X-Google-Smtp-Source: ABdhPJwnRvjd25RKKb1IY0mH6xLlBY8U0g0qKVeGKHKVo7MBQa8zsygDrtFe0NzMk8t1zLigo+To0g== X-Received: by 2002:adf:e112:: with SMTP id t18mr4548706wrz.46.1623840231453; Wed, 16 Jun 2021 03:43:51 -0700 (PDT) Sender: =?UTF-8?Q?Philippe_Mathieu=2DDaud=C3=A9?= From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Bandan Das , Alexander Bulekov , Stefan Hajnoczi , Paolo Bonzini , Thomas Huth , Gerd Hoffmann , Laurent Vivier , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Qiang Liu Subject: [PATCH v2] hw/audio/sb16: Avoid assertion by restricting I/O sampling rate range Date: Wed, 16 Jun 2021 12:43:49 +0200 Message-Id: <20210616104349.2398060-1-f4bug@amsat.org> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @gmail.com) While the SB16 seems to work up to 48000 Hz, the "Sound Blaster Series Hardware Programming Guide" limit the sampling range from 4000 Hz to 44100 Hz (Section 3-9, 3-10: Digitized Sound I/O Programming, tables 3-2 and 3-3). Later, section 6-15 (DSP Commands) is more specific regarding the 41h / 42h registers (Set digitized sound output sampling rate): Valid sampling rates range from 5000 to 45000 Hz inclusive. There is no comment regarding error handling if the register is filled with an out-of-range value. (See also section 3-28 "8-bit or 16-bit Auto-initialize Transfer"). Assume limits are enforced in hardware. This fixes triggering an assertion in audio_calloc(): #1 abort #2 audio_bug audio/audio.c:119:9 #3 audio_calloc audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out audio/audio_template.h:116:15 #5 audio_pcm_sw_init_out audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out audio/audio_template.h:410:9 #7 AUD_open_out audio/audio_template.h:503:14 #8 continue_dma8 hw/audio/sb16.c:216:20 #9 dma_cmd8 hw/audio/sb16.c:276:5 #10 command hw/audio/sb16.c:0 #11 dsp_write hw/audio/sb16.c:949:13 #12 portio_write softmmu/ioport.c:205:13 #13 memory_region_write_accessor softmmu/memory.c:491:5 #14 access_with_adjusted_size softmmu/memory.c:552:18 #15 memory_region_dispatch_write softmmu/memory.c:0:13 #16 flatview_write_continue softmmu/physmem.c:2759:23 #17 flatview_write softmmu/physmem.c:2799:14 #18 address_space_write softmmu/physmem.c:2891:18 #19 cpu_outw softmmu/ioport.c:70:5 [*] http://www.baudline.com/solutions/full_duplex/sb16_pci/index.html Fixes: 85571bc7415 ("audio merge (malc)") Buglink: https://bugs.launchpad.net/bugs/1910603 OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3D29= 174 Tested-by: Qiang Liu Reviewed-by: Qiang Liu Signed-off-by: Philippe Mathieu-Daud=C3=A9 --- v2: Added Qiang Liu's T-b/R-b tags =C2=AF\_(=E3=83=84)_/=C2=AF --- hw/audio/sb16.c | 14 ++++++++++ tests/qtest/fuzz-sb16-test.c | 52 ++++++++++++++++++++++++++++++++++++ MAINTAINERS | 1 + tests/qtest/meson.build | 1 + 4 files changed, 68 insertions(+) create mode 100644 tests/qtest/fuzz-sb16-test.c diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c index 8b207004102..5cf121fe363 100644 --- a/hw/audio/sb16.c +++ b/hw/audio/sb16.c @@ -115,6 +115,9 @@ struct SB16State { PortioList portio_list; }; =20 +#define SAMPLE_RATE_MIN 5000 +#define SAMPLE_RATE_MAX 45000 + static void SB_audio_callback (void *opaque, int free); =20 static int magic_of_irq (int irq) @@ -241,6 +244,17 @@ static void dma_cmd8 (SB16State *s, int mask, int dma_= len) int tmp =3D (256 - s->time_const); s->freq =3D (1000000 + (tmp / 2)) / tmp; } + if (s->freq < SAMPLE_RATE_MIN) { + qemu_log_mask(LOG_GUEST_ERROR, + "sampling range too low: %d, increasing to %u\n", + s->freq, SAMPLE_RATE_MIN); + s->freq =3D SAMPLE_RATE_MIN; + } else if (s->freq > SAMPLE_RATE_MAX) { + qemu_log_mask(LOG_GUEST_ERROR, + "sampling range too high: %d, decreasing to %u\n", + s->freq, SAMPLE_RATE_MAX); + s->freq =3D SAMPLE_RATE_MAX; + } =20 if (dma_len !=3D -1) { s->block_size =3D dma_len << s->fmt_stereo; diff --git a/tests/qtest/fuzz-sb16-test.c b/tests/qtest/fuzz-sb16-test.c new file mode 100644 index 00000000000..51030cd7dc4 --- /dev/null +++ b/tests/qtest/fuzz-sb16-test.c @@ -0,0 +1,52 @@ +/* + * QTest fuzzer-generated testcase for sb16 audio device + * + * Copyright (c) 2021 Philippe Mathieu-Daud=C3=A9 + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqos/libqtest.h" + +/* + * This used to trigger the assert in audio_calloc + * https://bugs.launchpad.net/qemu/+bug/1910603 + */ +static void test_fuzz_sb16_0x1c(void) +{ + QTestState *s =3D qtest_init("-M q35 -display none " + "-device sb16,audiodev=3Dsnd0 " + "-audiodev none,id=3Dsnd0"); + qtest_outw(s, 0x22c, 0x41); + qtest_outb(s, 0x22c, 0x00); + qtest_outw(s, 0x22c, 0x1004); + qtest_outw(s, 0x22c, 0x001c); + qtest_quit(s); +} + +static void test_fuzz_sb16_0x91(void) +{ + QTestState *s =3D qtest_init("-M pc -display none " + "-device sb16,audiodev=3Dnone " + "-audiodev id=3Dnone,driver=3Dnone"); + qtest_outw(s, 0x22c, 0xf141); + qtest_outb(s, 0x22c, 0x00); + qtest_outb(s, 0x22c, 0x24); + qtest_outb(s, 0x22c, 0x91); + qtest_quit(s); +} + +int main(int argc, char **argv) +{ + const char *arch =3D qtest_get_arch(); + + g_test_init(&argc, &argv, NULL); + + if (strcmp(arch, "i386") =3D=3D 0) { + qtest_add_func("fuzz/test_fuzz_sb16/1c", test_fuzz_sb16_0x1c); + qtest_add_func("fuzz/test_fuzz_sb16/91", test_fuzz_sb16_0x91); + } + + return g_test_run(); +} diff --git a/MAINTAINERS b/MAINTAINERS index 7d9cd290426..d619ea8fcd1 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2221,6 +2221,7 @@ F: qapi/audio.json F: tests/qtest/ac97-test.c F: tests/qtest/es1370-test.c F: tests/qtest/intel-hda-test.c +F: tests/qtest/fuzz-sb16-test.c =20 Block layer core M: Kevin Wolf diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index c3a223a83d6..b03e8541700 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -20,6 +20,7 @@ qtests_generic =3D \ (config_all_devices.has_key('CONFIG_MEGASAS_SCSI_PCI') ? ['fuzz-megasas-= test'] : []) + \ (config_all_devices.has_key('CONFIG_VIRTIO_SCSI') ? ['fuzz-virtio-scsi-t= est'] : []) + \ + (config_all_devices.has_key('CONFIG_SB16') ? ['fuzz-sb16-test'] : []) + \ [ 'cdrom-test', 'device-introspect-test', --=20 2.31.1