All of lore.kernel.org
 help / color / mirror / Atom feed
From: P J P <ppandit@redhat.com>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: qemu-block@nongnu.org, "Alexander Bulekov" <alxndr@bu.edu>,
	"Igor Mitsyanko" <i.mitsyanko@gmail.com>,
	qemu-devel@nongnu.org, qemu-stable@nongnu.org,
	1892960@bugs.launchpad.net, bugs-syssec@rub.de,
	"Philippe Mathieu-Daudé" <philmd@redhat.com>
Subject: Re: [PATCH v2 3/3] hw/sd/sdhci: Fix DMA Transfer Block Size field
Date: Wed, 2 Sep 2020 16:09:23 +0530 (IST)	[thread overview]
Message-ID: <nycvar.YSQ.7.78.906.2009021519400.2047119@xnncv> (raw)
In-Reply-To: <20200901140411.112150-4-f4bug@amsat.org>

[-- Attachment #1: Type: text/plain, Size: 1022 bytes --]

+-- On Tue, 1 Sep 2020, Philippe Mathieu-Daudé wrote --+
| The 'Transfer Block Size' field is 12-bit wide.
| See section '2.2.2. Block Size Register (Offset 004h)' in datasheet.
| 
| Buglink: https://bugs.launchpad.net/qemu/+bug/1892960

+ https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fsdhci_oob_write1

| diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
| index 60f083b84c1..ecbf84e9d3f 100644
| --- a/hw/sd/sdhci.c
| +++ b/hw/sd/sdhci.c
| @@ -1104,7 +1104,7 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
|          break;
|      case SDHC_BLKSIZE:
|          if (!TRANSFERRING_DATA(s->prnsts)) {
| -            MASKED_WRITE(s->blksize, mask, value);
| +            MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
|              MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);

It helps to fix above issues.

Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D

  reply	other threads:[~2020-09-02 10:40 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-01 14:04 [PATCH v2 0/3] hw/sd/sdhci: Fix DMA Transfer Block Size field width Philippe Mathieu-Daudé
2020-09-01 14:04 ` [PATCH v2 1/3] hw/sd/sdhci: Fix qemu_log_mask() format string Philippe Mathieu-Daudé
2020-09-01 17:51   ` Richard Henderson
2020-09-01 14:04 ` [PATCH v2 2/3] hw/sd/sdhci: Document the datasheet used Philippe Mathieu-Daudé
2020-09-01 17:51   ` Richard Henderson
2020-09-01 14:04 ` [PATCH v2 3/3] hw/sd/sdhci: Fix DMA Transfer Block Size field Philippe Mathieu-Daudé
2020-09-01 14:04   ` [Bug 1892960] " Philippe Mathieu-Daudé
2020-09-02 10:39   ` P J P [this message]
2020-09-10 14:49 ` [PATCH v2 0/3] hw/sd/sdhci: Fix DMA Transfer Block Size field width Alexander Bulekov
2020-09-18  8:27 ` Philippe Mathieu-Daudé
  -- strict thread matches above, loose matches on Subject: below --
2020-09-01 14:01 [PATCH " Philippe Mathieu-Daudé
2020-09-01 14:01 ` [PATCH 1/3] hw/sd/sdhci: Fix qemu_log_mask() format string Philippe Mathieu-Daudé
2020-09-01 14:01 ` [PATCH 2/3] hw/sd/sdhci: Document the datasheet used Philippe Mathieu-Daudé
2020-09-01 14:01 ` [PATCH 3/3] hw/sd/sdhci: Fix DMA Transfer Block Size field Philippe Mathieu-Daudé
2020-09-01 14:01   ` [Bug 1892960] " Philippe Mathieu-Daudé
2020-09-01 14:03   ` Philippe Mathieu-Daudé
2020-09-01 14:03     ` [Bug 1892960] " Philippe Mathieu-Daudé
2020-08-26  1:25 [Bug 1892960] [NEW] Heap-overflow in flatview_read through sdhci_data_transfer Alexander Bulekov
2020-09-01 12:01 ` [Bug 1892960] " P J P
2020-10-22 14:00 ` Philippe Mathieu-Daudé
2020-12-10  9:04 ` Thomas Huth

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=nycvar.YSQ.7.78.906.2009021519400.2047119@xnncv \
    --to=ppandit@redhat.com \
    --cc=1892960@bugs.launchpad.net \
    --cc=alxndr@bu.edu \
    --cc=bugs-syssec@rub.de \
    --cc=f4bug@amsat.org \
    --cc=i.mitsyanko@gmail.com \
    --cc=philmd@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.