All of lore.kernel.org
 help / color / mirror / Atom feed
From: Bin Meng <bmeng.cn@gmail.com>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>,
	"Mauro Matteo Cascella" <mcascell@redhat.com>,
	"Li Qiang" <liq3ea@163.com>, "Alexander Bulekov" <alxndr@bu.edu>,
	"Alistair Francis" <alistair.francis@wdc.com>,
	"Prasad J Pandit" <ppandit@redhat.com>,
	"Bandan Das" <bsd@redhat.com>
Cc: qemu-devel@nongnu.org, qemu-block@nongnu.org, qemu-stable@nongnu.org
Subject: [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable
Date: Tue, 16 Feb 2021 11:46:53 +0800	[thread overview]
Message-ID: <1613447214-81951-6-git-send-email-bmeng.cn@gmail.com> (raw)
In-Reply-To: <1613447214-81951-1-git-send-email-bmeng.cn@gmail.com>

The codes to limit the maximum block size is only necessary when
SDHC_BLKSIZE register is writable.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>

---

Changes in v2:
- new patch: sdhci: Limit block size only when SDHC_BLKSIZE register is writable

 hw/sd/sdhci.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 7a2003b..d0c8e29 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1142,15 +1142,15 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         if (!TRANSFERRING_DATA(s->prnsts)) {
             MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
             MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
-        }
 
-        /* Limit block size to the maximum buffer size */
-        if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than "
-                          "the maximum buffer 0x%x\n", __func__, s->blksize,
-                          s->buf_maxsz);
+            /* Limit block size to the maximum buffer size */
+            if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than "
+                              "the maximum buffer 0x%x\n", __func__, s->blksize,
+                              s->buf_maxsz);
 
-            s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
+                s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
+            }
         }
 
         break;
-- 
2.7.4



  parent reply	other threads:[~2021-02-16  3:52 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-16  3:46 [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 Bin Meng
2021-02-16  3:46 ` [PATCH v2 1/6] hw/sd: sdhci: Don't transfer any data when command time out Bin Meng
2021-02-18 16:25   ` Philippe Mathieu-Daudé
2021-02-18 16:46     ` Philippe Mathieu-Daudé
2021-02-18 23:33     ` Bin Meng
2021-02-16  3:46 ` [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress Bin Meng
2021-02-18 16:33   ` Philippe Mathieu-Daudé
2021-02-18 18:23   ` Philippe Mathieu-Daudé
2021-02-18 20:31     ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` [PATCH v2 3/6] hw/sd: sdhci: Correctly set the controller status for ADMA Bin Meng
2021-02-18 16:50   ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` [PATCH v2 4/6] hw/sd: sdhci: Simplify updating s->prnsts in sdhci_sdma_transfer_multi_blocks() Bin Meng
2021-02-17 15:39   ` Alexander Bulekov
2021-02-18 16:51   ` Philippe Mathieu-Daudé
2021-02-19 23:15   ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` Bin Meng [this message]
2021-02-18 17:09   ` [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable Philippe Mathieu-Daudé
2021-02-18 18:03     ` Philippe Mathieu-Daudé
2021-02-20  6:55       ` Bin Meng
2021-02-16  3:46 ` [PATCH v2 6/6] hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed Bin Meng
2021-02-18 18:06   ` Philippe Mathieu-Daudé
2021-02-20  3:28     ` Bin Meng
2021-02-16 16:13 ` [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 Alexander Bulekov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1613447214-81951-6-git-send-email-bmeng.cn@gmail.com \
    --to=bmeng.cn@gmail.com \
    --cc=alistair.francis@wdc.com \
    --cc=alxndr@bu.edu \
    --cc=bsd@redhat.com \
    --cc=f4bug@amsat.org \
    --cc=liq3ea@163.com \
    --cc=mcascell@redhat.com \
    --cc=ppandit@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.