[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when
|
From: |
Philippe Mathieu-Daudé |
|
Subject: |
Re: [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress |
|
Date: |
Thu, 18 Feb 2021 19:23:32 +0100 |
|
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.7.0 |
On 2/16/21 4:46 AM, Bin Meng wrote:
> Per "SD Host Controller Standard Specification Version 7.00"
> chapter 2.2.1 SDMA System Address Register:
>
> This register can be accessed only if no transaction is executing
> (i.e., after a transaction has stopped).
>
> With this fix, the following reproducer:
>
> https://paste.debian.net/plain/1185137
>
> cannot be reproduced with the following QEMU command line:
>
> $ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
> -nodefaults -device sdhci-pci,sd-spec-version=3 \
> -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
> -device sd-card,drive=mydrive -qtest stdio
Without the rest applied, I still can :(
AddressSanitizer: heap-buffer-overflow
- [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409, Bin Meng, 2021/02/15
- [PATCH v2 1/6] hw/sd: sdhci: Don't transfer any data when command time out, Bin Meng, 2021/02/15
- [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress, Bin Meng, 2021/02/15
- [PATCH v2 3/6] hw/sd: sdhci: Correctly set the controller status for ADMA, Bin Meng, 2021/02/15
- [PATCH v2 4/6] hw/sd: sdhci: Simplify updating s->prnsts in sdhci_sdma_transfer_multi_blocks(), Bin Meng, 2021/02/15
- [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable, Bin Meng, 2021/02/15