From nobody Tue Apr 15 15:38:59 2025 Delivered-To: importer@patchew.org Received-SPF: temperror (zoho.com: Error in retrieving data from DNS) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=temperror (zoho.com: Error in retrieving data from DNS) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507307802152874.0853587910963; Fri, 6 Oct 2017 09:36:42 -0700 (PDT) Received: from localhost ([::1]:45831 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e0Vbi-0002kS-9f for importer@patchew.org; Fri, 06 Oct 2017 12:36:14 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58188) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e0V1n-0004Gu-FD for qemu-devel@nongnu.org; Fri, 06 Oct 2017 11:59:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e0V1m-0007rU-0U for qemu-devel@nongnu.org; Fri, 06 Oct 2017 11:59:07 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:37718) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e0V1l-0007nY-MG for qemu-devel@nongnu.org; Fri, 06 Oct 2017 11:59:05 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1e0V1Y-0002rj-Nl for qemu-devel@nongnu.org; Fri, 06 Oct 2017 16:58:52 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Fri, 6 Oct 2017 16:59:27 +0100 Message-Id: <1507305585-20608-3-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1507305585-20608-1-git-send-email-peter.maydell@linaro.org> References: <1507305585-20608-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PULL 02/20] hw/sd: fix out-of-bounds check for multi block reads X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_6 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Michael Olbrich The current code checks if the next block exceeds the size of the card. This generates an error while reading the last block of the card. Do the out-of-bounds check when starting to read a new block to fix this. This issue became visible with increased error checking in Linux 4.13. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Olbrich Reviewed-by: Alistair Francis Message-id: 20170916091611.10241-1-m.olbrich@pengutronix.de Signed-off-by: Peter Maydell --- hw/sd/sd.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index ba47bff..35347a5 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -1797,8 +1797,13 @@ uint8_t sd_read_data(SDState *sd) break; =20 case 18: /* CMD18: READ_MULTIPLE_BLOCK */ - if (sd->data_offset =3D=3D 0) + if (sd->data_offset =3D=3D 0) { + if (sd->data_start + io_len > sd->size) { + sd->card_status |=3D ADDRESS_ERROR; + return 0x00; + } BLK_READ_BLOCK(sd->data_start, io_len); + } ret =3D sd->data[sd->data_offset ++]; =20 if (sd->data_offset >=3D io_len) { @@ -1812,11 +1817,6 @@ uint8_t sd_read_data(SDState *sd) break; } } - - if (sd->data_start + io_len > sd->size) { - sd->card_status |=3D ADDRESS_ERROR; - break; - } } break; =20 --=20 2.7.4