[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when
|
From: |
Philippe Mathieu-Daudé |
|
Subject: |
Re: [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress |
|
Date: |
Thu, 18 Feb 2021 21:31:08 +0100 |
|
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.7.0 |
On 2/18/21 7:23 PM, Philippe Mathieu-Daudé wrote:
> On 2/16/21 4:46 AM, Bin Meng wrote:
>> Per "SD Host Controller Standard Specification Version 7.00"
>> chapter 2.2.1 SDMA System Address Register:
>>
>> This register can be accessed only if no transaction is executing
>> (i.e., after a transaction has stopped).
>>
>> With this fix, the following reproducer:
>>
>> https://paste.debian.net/plain/1185137
>>
>> cannot be reproduced with the following QEMU command line:
>>
>> $ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
>> -nodefaults -device sdhci-pci,sd-spec-version=3 \
>> -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
>> -device sd-card,drive=mydrive -qtest stdio
>
> Without the rest applied, I still can :(
>
> AddressSanitizer: heap-buffer-overflow
Err, I used an old build for this test, sorry...
- [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409, Bin Meng, 2021/02/15
- [PATCH v2 1/6] hw/sd: sdhci: Don't transfer any data when command time out, Bin Meng, 2021/02/15
- [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress, Bin Meng, 2021/02/15
- [PATCH v2 3/6] hw/sd: sdhci: Correctly set the controller status for ADMA, Bin Meng, 2021/02/15
- [PATCH v2 4/6] hw/sd: sdhci: Simplify updating s->prnsts in sdhci_sdma_transfer_multi_blocks(), Bin Meng, 2021/02/15
- [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable, Bin Meng, 2021/02/15