[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] hw/sd: sdhci: Do not transfer any data when command fails
|
From: |
Philippe Mathieu-Daudé |
|
Subject: |
Re: [PATCH] hw/sd: sdhci: Do not transfer any data when command fails |
|
Date: |
Tue, 9 Feb 2021 12:03:37 +0100 |
|
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 |
On 2/9/21 11:54 AM, Bin Meng wrote:
> At the end of sdhci_send_command(), it starts a data transfer if
> the command register indicates a data is associated. However the
> data transfer should only be initiated when the command execution
> has succeeded.
>
> Cc: qemu-stable@nongnu.org
> Fixes: CVE-2020-17380
> Fixes: CVE-2020-25085
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Reported-by: Sergej Schumilo (Ruhr-University Bochum)
> Reported-by: Cornelius Aschermann (Ruhr-University Bochum)
> Reported-by: Simon Wrner (Ruhr-University Bochum)
> Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
> Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
> ---
>
> hw/sd/sdhci.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>