Cover Letter Detail
Show a cover letter.
GET /api/1.2/covers/2233298/?format=api
{ "id": 2233298, "url": "http://patchwork.ozlabs.org/api/1.2/covers/2233298/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/cover/cover.1778053560.git.jeuk20.kim@samsung.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/1.2/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<cover.1778053560.git.jeuk20.kim@samsung.com>", "list_archive_url": null, "date": "2026-05-06T07:54:27", "name": "[0/4] hw/ufs: Fix guest-triggerable MCQ crashes", "submitter": { "id": 86755, "url": "http://patchwork.ozlabs.org/api/1.2/people/86755/?format=api", "name": "Jeuk Kim", "email": "jeuk20.kim@gmail.com" }, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/cover/cover.1778053560.git.jeuk20.kim@samsung.com/mbox/", "series": [ { "id": 502929, "url": "http://patchwork.ozlabs.org/api/1.2/series/502929/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=502929", "date": "2026-05-06T07:54:27", "name": "hw/ufs: Fix guest-triggerable MCQ crashes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502929/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/covers/2233298/comments/", "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=fEx7Wuy8;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g9SPh6JMZz1yJq\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 06 May 2026 17:56:23 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wKX6N-0002gq-2U; Wed, 06 May 2026 03:55:27 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jeuk20.kim@gmail.com>)\n id 1wKX66-0002ca-65\n for qemu-devel@nongnu.org; Wed, 06 May 2026 03:55:11 -0400", "from mail-pj1-x102d.google.com ([2607:f8b0:4864:20::102d])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from <jeuk20.kim@gmail.com>)\n id 1wKX63-00080P-MO\n for qemu-devel@nongnu.org; Wed, 06 May 2026 03:55:09 -0400", "by mail-pj1-x102d.google.com with SMTP id\n 98e67ed59e1d1-36528851d7dso1684951a91.1\n for <qemu-devel@nongnu.org>; Wed, 06 May 2026 00:55:06 -0700 (PDT)", "from jeuk-MS-7D42.. ([211.226.54.223])\n by smtp.gmail.com with ESMTPSA id\n 98e67ed59e1d1-365b4bcaa49sm1380997a91.1.2026.05.06.00.55.03\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 06 May 2026 00:55:04 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1778054105; x=1778658905; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=Asx/ohujR/GO4GjyTC7aX5UXRfMNDErHMFNUp4fn1WI=;\n b=fEx7Wuy8d2yfFZEMCVjtptr82+rPS3R7jsFevWd33ppHRpZbIhE1cv+xkPvEfil6Nw\n P8kWLfBiQ4PcUaXBjIY7ZikwFFb3sKPSOI6wzp13jj5nI94rMf5JNPCy6GfPmrmQSrU5\n HaBXTlkRoEys2hsLqrc2vFvsus3ZDpGn7sUqVZKEJGRreWMDppCdQs2MzGGWU9ocZn1H\n DOPfV9n3tPQQ+qWC4Fj55BxkdAlWcNNOnsAXjJTzLCG9aWydcaZI0vQZgH6dM3QS4ku9\n CEroL4xCmJXVDLc0s3aSfPyEQA6Y3W3e/VDRJJHwF+FAronLleulB5YUEhaqFJy+ZQIq\n jaBg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1778054105; x=1778658905;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Asx/ohujR/GO4GjyTC7aX5UXRfMNDErHMFNUp4fn1WI=;\n b=pwL8LiW+nwemdqbvXl8N/uNs1NyUFMKgvBlB/ySf36UX/eBs7HXKwyPpBF1n2QWtD6\n /S1ZccxnP2vg9zTjcchdyb7T6UQ9Unz/jblP4Vj93opkcjb6q69X44fXvdKqKJeQ2Uw2\n rW3O9xDuoTOj+PHDle67mi5Mcl4CzrfqsWibZrPuuzPRSVZa5L+uBFS2lGUjFYwganWk\n s+Wa4N8yoYKd0ZtpHHtbZKRq4wcylrtyuzxwoIkf29qW2K6hh0PCh63WvelpvKxxFSxw\n rPXM67Jd6eGp/QtwkIld9VYyiL9AJIywqf/ahUXy0LiZMFDuHwQzlnf+BsEJyakKDIqM\n SH4A==", "X-Gm-Message-State": "AOJu0YxMb31CPjTzsNfHPHmIx2AJHnvt6iYZQmlSB6AK9QbmDYuesi7A\n Ei0iUIOoOx3LUK2TyVMcUr35lLBTGu6ZgQ3PgmkFwmNR9nDWM9M5hxeCBwXZNg==", "X-Gm-Gg": "AeBDievxTWwvtI+FUT0KlfEFQWol0ADJI9WTsky6VolRALfR9DlnwA5gqLUWsZdGqPZ\n iraBY/KsaLbLr1r5/MJ5nD4KQGrdS0lkJphmYAoJ6sRCeNvx+7xpBQlKBSeyQvjl5wwDqTUf3UF\n ey8Bqk6L0ba/Yd7N/UYVrL3pUXyVFIR7dU32CfUmVWFXWNA3ATQqi5vvooOwM17dg35VtNppbdQ\n nyq/K96O15rcOvyPg8xzo4DpTsCLWY3t2J+X+5eTIpC9tsJpVGqtjx+q5KV5Nhi0s3U+/N3ISXo\n TluSX3WcQAAEsCq5dS/KPg2M6jDLDLuv1b3DDSWYUOSjFWCTxxz5xRFgd0AtnR0VQCeEpbNYh3Z\n L8/TEZaLSQY3FlXNVkY3OTqGzqUEVB4bihSJ+JaGKxWAlJ5exsIjP1LsR04fBqsIV3hpI3l6iHD\n 2ylGxRQUuGM0Ezl4VbSYSmitT7GrcWvmLbysDpKsweZQ==", "X-Received": "by 2002:a17:90b:5683:b0:35e:576e:5bc with SMTP id\n 98e67ed59e1d1-365ac79c531mr2199710a91.25.1778054105037;\n Wed, 06 May 2026 00:55:05 -0700 (PDT)", "From": "Jeuk Kim <jeuk20.kim@gmail.com>", "X-Google-Original-From": "Jeuk Kim <jeuk20.kim@samsung.com>", "To": "qemu-devel@nongnu.org", "Cc": "jeuk20.kim@samsung.com, qemu-block@nongnu.org, qemu-stable@nongnu.org,\n j-young.choi@samsung.com", "Subject": "[PATCH 0/4] hw/ufs: Fix guest-triggerable MCQ crashes", "Date": "Wed, 6 May 2026 16:54:27 +0900", "Message-ID": "<cover.1778053560.git.jeuk20.kim@samsung.com>", "X-Mailer": "git-send-email 2.43.0", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=2607:f8b0:4864:20::102d;\n envelope-from=jeuk20.kim@gmail.com; helo=mail-pj1-x102d.google.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "This series fixes four guest-triggerable bugs in the UFS MCQ emulation,\nall reachable via MMIO writes to the UFS PCI BAR with mcq=on.\n\nPatches 1-2 fix bugs reported by Rayhan Ramdhany Hanaputra:\n\n - Out-of-bounds array read: SQATTR.CQID is not checked against\n mcq_maxq before indexing u->cq[].\n - NULL dereference: SQ doorbell is processed without checking whether\n the SQ exists.\n - NULL dereference: CQ head doorbell is processed without checking\n whether the CQ exists.\n\nPatches 3-4 fix additional bugs found during review:\n\n - Divide-by-zero: a small SQATTR.SIZE or CQATTR.SIZE produces a\n zero-depth queue that crashes when its pointers are advanced.\n - Use-after-free: disabling an SQ while requests are still in flight\n on the CQ list or in the SCSI layer frees memory that is still\n referenced by the completion paths.\n\nJeuk Kim (4):\n hw/ufs: Validate MCQ SQ references before use\n hw/ufs: Guard MCQ CQ accesses against missing queues\n hw/ufs: Reject zero-depth MCQ queues\n hw/ufs: Keep MCQ SQs alive while requests are outstanding\n\n hw/ufs/trace-events | 3 ++\n hw/ufs/ufs.c | 92 +++++++++++++++++++++++++++++++++++++++------\n hw/ufs/ufs.h | 9 ++++-\n 3 files changed, 92 insertions(+), 12 deletions(-)" }