From nobody Thu Aug 27 11:14:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1779487085; cv=none; d=zohomail.com; s=zohoarc; b=ACoB1IxKvoedUlMqHsNMQ2vjre4qwpCXq4sT58qLSRwV9Ui2mOB5mCYZGBihyHWRjk2FPtEXvAEcbHCjCJdiMNMGZFHuddYPpVRJsUSYEUzwKZ7sXfTXHCFsnbbhSz1z4Xu39LPj9C8n3dgjgbtZ29Ws5oyflNYz8j3az4jkK0w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779487085; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PkyMLOptGwTwBpNi2laREHa2SFhIKRf3ytAC8PWhlVE=; b=nILy962ugqrS9RCWEaNtaR0gMTveaBKfeps+qcAo3iPfUjiMRgQDe9ABS6rEQnyDWysYnk0WWs1lYgtWX3E0bGZGH53bkzjJRhjNtm3yKTs1SgvsHFN5L77rOfJJz4l7o8EZKp5mP42Oy6MrX6g36WLLTeBdX9vxPu9LZvwcHg8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779487085602179.54833446629425; Fri, 22 May 2026 14:58:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQXm5-00023k-4A; Fri, 22 May 2026 17:51:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXlv-0001mm-Ro; Fri, 22 May 2026 17:51:12 -0400 Received: from isrv.corpit.ru ([212.248.84.144]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQXlt-0003bd-NZ; Fri, 22 May 2026 17:51:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7945F1AFB6F; Sat, 23 May 2026 00:49:20 +0300 (MSK) Received: from think4mjt.tls.msk.ru (mjtthink.wg.tls.msk.ru [192.168.177.146]) by tsrv.corpit.ru (Postfix) with ESMTP id A3B733B71BE; Sat, 23 May 2026 00:49:24 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tls.msk.ru; s=202602; t=1779486560; bh=oeIl4T4LEBNfxxFNGKktvougbNt4aFA2iEAi4mg1xaA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UC4a5VQ7Tp6jeQz5ZSjsea3wEogxjwP4IyWywICkcFXvEmk7JagR1eMTi8Nt4KOZ0 XeKKW3ppSPjONUrIcx5nSaJMsy9Db0+oBqX/0IFyLey8DETXWIBDXvNwq9aFjjee7k u0Bp7aLkbjQ6InoMCdDncalKS70RVkqDO1VBWRa3CjxHs2ZyWJB0hbHEQnRhjEUQbt 3LF6YUcLHd0iDTgXxIPZvWwHewaDowEPL2qVK2qoQFBuUTVGMJJdbIXQg/+CzZfqz2 pDSlvd5M2SUEdVxMOGgJCOo7vXlfP130/irZf5jyUSoOxhHFEKAKY9issehovK4mz9 rbqMyMfstz4fQ== From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Jeuk Kim , Michael Tokarev Subject: [Stable-10.2.3 121/149] hw/ufs: Reject zero-depth MCQ queues Date: Sat, 23 May 2026 00:48:53 +0300 Message-ID: <20260522214923.807017-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=212.248.84.144; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -19 X-Spam_score: -2.0 X-Spam_bar: -- X-Spam_report: (-2.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @tls.msk.ru) X-ZM-MESSAGEID: 1779487087160158500 Content-Type: text/plain; charset="utf-8" From: Jeuk Kim Reject SQATTR.SIZE and CQATTR.SIZE values that produce zero-entry MCQ queues. Such queues can later trigger a divide-by-zero while advancing queue pointers. Fixes: 5c079578d2e ("hw/ufs: Add support MCQ of UFSHCI 4.0") Cc: qemu-stable@nongnu.org Signed-off-by: Jeuk Kim (cherry picked from commit 4a909c00b9e18478e67a792c7f7cfae62cb6c865) Signed-off-by: Michael Tokarev diff --git a/hw/ufs/trace-events b/hw/ufs/trace-events index 531dcfc686..7734b35f08 100644 --- a/hw/ufs/trace-events +++ b/hw/ufs/trace-events @@ -40,10 +40,12 @@ ufs_err_mcq_db_wr_invalid_sqid(uint8_t qid) "invalid mc= q sqid %"PRIu8"" ufs_err_mcq_db_wr_invalid_db(uint8_t qid, uint32_t db) "invalid mcq doorbe= ll sqid %"PRIu8", db %"PRIu32"" ufs_err_mcq_create_sq_invalid_sqid(uint8_t qid) "invalid mcq sqid %"PRIu8"" ufs_err_mcq_create_sq_invalid_cqid(uint8_t qid) "invalid mcq cqid %"PRIu8"" +ufs_err_mcq_create_sq_invalid_size(uint8_t qid) "invalid mcq sq size for s= qid %"PRIu8"" ufs_err_mcq_create_sq_already_exists(uint8_t qid) "mcq sqid %"PRIu8 "alrea= dy exists" ufs_err_mcq_delete_sq_invalid_sqid(uint8_t qid) "invalid mcq sqid %"PRIu8"" ufs_err_mcq_delete_sq_not_exists(uint8_t qid) "mcq sqid %"PRIu8 "not exist= s" ufs_err_mcq_create_cq_invalid_cqid(uint8_t qid) "invalid mcq cqid %"PRIu8"" +ufs_err_mcq_create_cq_invalid_size(uint8_t qid) "invalid mcq cq size for c= qid %"PRIu8"" ufs_err_mcq_create_cq_already_exists(uint8_t qid) "mcq cqid %"PRIu8 "alrea= dy exists" ufs_err_mcq_delete_cq_invalid_cqid(uint8_t qid) "invalid mcq cqid %"PRIu8"" ufs_err_mcq_delete_cq_not_exists(uint8_t qid) "mcq cqid %"PRIu8 "not exist= s" diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c index e01fc730fd..66f4031852 100644 --- a/hw/ufs/ufs.c +++ b/hw/ufs/ufs.c @@ -506,6 +506,8 @@ static bool ufs_mcq_create_sq(UfsHc *u, uint8_t qid, ui= nt32_t attr) UfsMcqReg *reg =3D &u->mcq_reg[qid]; UfsSq *sq; uint8_t cqid =3D FIELD_EX32(attr, SQATTR, CQID); + uint16_t qsize =3D + ((FIELD_EX32(attr, SQATTR, SIZE) + 1) << 2) / sizeof(UfsSqEntry); =20 if (qid >=3D u->params.mcq_maxq) { trace_ufs_err_mcq_create_sq_invalid_sqid(qid); @@ -527,12 +529,17 @@ static bool ufs_mcq_create_sq(UfsHc *u, uint8_t qid, = uint32_t attr) return false; } =20 + if (!qsize) { + trace_ufs_err_mcq_create_sq_invalid_size(qid); + return false; + } + sq =3D g_malloc0(sizeof(*sq)); sq->u =3D u; sq->sqid =3D qid; sq->cq =3D u->cq[cqid]; sq->addr =3D ((uint64_t)reg->squba << 32) | reg->sqlba; - sq->size =3D ((FIELD_EX32(attr, SQATTR, SIZE) + 1) << 2) / sizeof(UfsS= qEntry); + sq->size =3D qsize; =20 sq->bh =3D qemu_bh_new_guarded(ufs_mcq_process_sq, sq, &DEVICE(u)->mem_reentrancy_guard); @@ -576,6 +583,8 @@ static bool ufs_mcq_create_cq(UfsHc *u, uint8_t qid, ui= nt32_t attr) { UfsMcqReg *reg =3D &u->mcq_reg[qid]; UfsCq *cq; + uint16_t qsize =3D + ((FIELD_EX32(attr, CQATTR, SIZE) + 1) << 2) / sizeof(UfsCqEntry); =20 if (qid >=3D u->params.mcq_maxq) { trace_ufs_err_mcq_create_cq_invalid_cqid(qid); @@ -587,11 +596,16 @@ static bool ufs_mcq_create_cq(UfsHc *u, uint8_t qid, = uint32_t attr) return false; } =20 + if (!qsize) { + trace_ufs_err_mcq_create_cq_invalid_size(qid); + return false; + } + cq =3D g_malloc0(sizeof(*cq)); cq->u =3D u; cq->cqid =3D qid; cq->addr =3D ((uint64_t)reg->cquba << 32) | reg->cqlba; - cq->size =3D ((FIELD_EX32(attr, CQATTR, SIZE) + 1) << 2) / sizeof(UfsC= qEntry); + cq->size =3D qsize; =20 cq->bh =3D qemu_bh_new_guarded(ufs_mcq_process_cq, cq, &DEVICE(u)->mem_reentrancy_guard); --=20 2.47.3