diff --git a/test/app/fuzz/llvm_nvme_fuzz/llvm_nvme_fuzz.c b/test/app/fuzz/llvm_nvme_fuzz/llvm_nvme_fuzz.c index d357c15001..a9c1833a5d 100644 --- a/test/app/fuzz/llvm_nvme_fuzz/llvm_nvme_fuzz.c +++ b/test/app/fuzz/llvm_nvme_fuzz/llvm_nvme_fuzz.c @@ -145,11 +145,30 @@ fuzz_admin_abort_command(struct fuzz_command *cmd) g_data += 4; } +static void +fuzz_admin_create_io_completion_queue_command(struct fuzz_command *cmd) +{ + memset(&cmd->cmd, 0, sizeof(cmd->cmd)); + cmd->cmd.opc = SPDK_NVME_OPC_CREATE_IO_CQ; + + cmd->cmd.cdw10_bits.raw = 0; + cmd->cmd.cdw10_bits.create_io_q.qid = (g_data[0] << 8) + g_data[1]; + cmd->cmd.cdw10_bits.create_io_q.qsize = (g_data[2] << 8) + g_data[3]; + + cmd->cmd.cdw11_bits.raw = 0; + cmd->cmd.cdw11_bits.create_io_cq.iv = (g_data[4] << 8) + g_data[5]; + cmd->cmd.cdw11_bits.create_io_cq.pc = (g_data[6] >> 7) & 0x01; + cmd->cmd.cdw11_bits.create_io_cq.ien = (g_data[6] >> 6) & 0x01; + + g_data += 7; +} + static struct fuzz_type g_fuzzers[] = { { .fn = fuzz_admin_command, .bytes_per_cmd = sizeof(struct spdk_nvme_cmd) }, { .fn = fuzz_admin_get_log_page_command, .bytes_per_cmd = 6 }, { .fn = fuzz_admin_identify_command, .bytes_per_cmd = 7 }, { .fn = fuzz_admin_abort_command, .bytes_per_cmd = 4}, + { .fn = fuzz_admin_create_io_completion_queue_command, .bytes_per_cmd = 7}, { .fn = NULL, .bytes_per_cmd = 0 } };