Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2233302/?format=api
{ "id": 2233302, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2233302/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/23d46a0e034b9420125dfe40bffba445fc4ee19f.1778053560.git.jeuk20.kim@samsung.com/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/1.2/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<23d46a0e034b9420125dfe40bffba445fc4ee19f.1778053560.git.jeuk20.kim@samsung.com>", "list_archive_url": null, "date": "2026-05-06T07:54:28", "name": "[1/4] hw/ufs: Validate MCQ SQ references before use", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "c12c523a5432ea22f9632ebf2f2b329c10715b87", "submitter": { "id": 86755, "url": "http://patchwork.ozlabs.org/api/1.2/people/86755/?format=api", "name": "Jeuk Kim", "email": "jeuk20.kim@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/23d46a0e034b9420125dfe40bffba445fc4ee19f.1778053560.git.jeuk20.kim@samsung.com/mbox/", "series": [ { "id": 502929, "url": "http://patchwork.ozlabs.org/api/1.2/series/502929/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=502929", "date": "2026-05-06T07:54:27", "name": "hw/ufs: Fix guest-triggerable MCQ crashes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502929/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2233302/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2233302/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=FbSuGjbF;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g9SQ62ZC0z1yJq\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 06 May 2026 17:56:46 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wKX6N-0002hG-Im; Wed, 06 May 2026 03:55:27 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <jeuk20.kim@gmail.com>)\n id 1wKX66-0002ck-V8\n for qemu-devel@nongnu.org; Wed, 06 May 2026 03:55:11 -0400", "from mail-pj1-x102c.google.com ([2607:f8b0:4864:20::102c])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from <jeuk20.kim@gmail.com>)\n id 1wKX65-00081G-1j\n for qemu-devel@nongnu.org; Wed, 06 May 2026 03:55:10 -0400", "by mail-pj1-x102c.google.com with SMTP id\n 98e67ed59e1d1-35fb7c1a455so2250428a91.3\n for <qemu-devel@nongnu.org>; Wed, 06 May 2026 00:55:08 -0700 (PDT)", "from jeuk-MS-7D42.. ([211.226.54.223])\n by smtp.gmail.com with ESMTPSA id\n 98e67ed59e1d1-365b4bcaa49sm1380997a91.1.2026.05.06.00.55.05\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 06 May 2026 00:55:06 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1778054107; x=1778658907; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Vpz2GXMM6c2b9OSumI0x/yIWAjgMb6Nrdlpfn8YZXuI=;\n b=FbSuGjbFA0sdDBbhrrbR9flYCcYaab3Vve9TSIRAl7g6JTWSMody97Z6ToKSu9VJTY\n D7vDPEpHwJhq7QCdwMzoZ+5X/8cr7EyZIpetjHFcy300aJ9mvPx6MblE5HCHN95Cda5A\n fC1FjKkRLd29MtBK6IMnogmecPO+/nnIatGN9LVlS81X66f1k6O284Qp9CBM91Q/0uG6\n 42I+u/kT5PF8UwRsJ/NvJ6iTcATcG8Nr2AifGoc2cnah5zvsSwJhP31bl/HNNyabW3yZ\n yo4RAHpic65aoH+A6k2qaxb+0FqxzlKn2KDaLbpMfn96GsFv2/gQXntbdeAjGuAci9Nr\n F6tA==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1778054107; x=1778658907;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=Vpz2GXMM6c2b9OSumI0x/yIWAjgMb6Nrdlpfn8YZXuI=;\n b=Xkt1j7hXozEnuObUxDwzdZhKK0GPZWy3SFNZPdtSxlUPQCjxF6JBTW/kd0iETMwD7J\n nNim759UbMAnvmff3rA00Tuu2qB8SWF/NiebZvGz6uEpcTokjX68246konvnQlqVc8qF\n wnOzwbu372i+aN7vlznOO+DD50zNmb4JrAFX84GvzSfRY4dYe2Wb1WKxLcak2JgRV5ks\n SqKpN6oe3pM/tc1s6dW846a+uM4uY7+Ydpzc1jgWSTcYfKYNnNjDRzjY82FxCbW5iut2\n 51VQZwSoEZuruNIVOHm/JkHvM9//bg35V3+QP5TbihWukTqyIXBIVdFH36N+T5a1DUE1\n qgCw==", "X-Gm-Message-State": "AOJu0YwwKnwdrMOndnVIKompKMLxh6a/zp4vE7VgTyGduzp5uuhkGRIU\n gaZ8VbGxNAACJrRc18T4YsLI2tvDJaAl7aJ3FcljKwoA6OtXCzYgJYOZan+89g==", "X-Gm-Gg": "AeBDieuMqCbtz/bHs81J/S0cL2+16x9vQKkwIdDfINS6tulzA9Zf36k/F1q88Xb3j5A\n Vtm5IRJl/WByCSfbiWgMcyI2hxrmo2slofL6zCu0KAfOGQc2Qrcs8NgFUkZE6Aq7lIER+bX9Lz+\n DrQcZ/wdvgVpnmS/UumhUB5ef1tpOS8RwmjIvfCcMwDa9lCuVtYv61ysj9EKVXF6K0bINcd81fD\n 0Y2cos2B04I5RfWK3J5KSQ6Z+afBXTijTYsz6TurZK6hDEY9W7+CCbUdQJ8sF/ckKCoAolsup6c\n LHcBthxKxpoK6ncDYv5orJ42M3WqHMSIhEHy29Qjwd7lYM9Zv60V85FgnTtWnFeQKB4rod2/qDS\n dbotQA3aEVJ/bZH5Pcv8RddNBLTtU8QYuVkxvGNsfwkjMsoPr8Rl4POuIX5xV0ns+eRzfxhr5zX\n ElwlSKYScWk49ViI8U+tTYG+qNGOjaXVvqIhkmestfdSXL2g3+gVoj", "X-Received": "by 2002:a17:90b:4b87:b0:361:45df:114 with SMTP id\n 98e67ed59e1d1-365ac2751c7mr2067483a91.19.1778054107042;\n Wed, 06 May 2026 00:55:07 -0700 (PDT)", "From": "Jeuk Kim <jeuk20.kim@gmail.com>", "X-Google-Original-From": "Jeuk Kim <jeuk20.kim@samsung.com>", "To": "qemu-devel@nongnu.org", "Cc": "jeuk20.kim@samsung.com, qemu-block@nongnu.org, qemu-stable@nongnu.org,\n j-young.choi@samsung.com,\n Rayhan Ramdhany Hanaputra <hanaputrarayhan@gmail.com>", "Subject": "[PATCH 1/4] hw/ufs: Validate MCQ SQ references before use", "Date": "Wed, 6 May 2026 16:54:28 +0900", "Message-ID": "\n <23d46a0e034b9420125dfe40bffba445fc4ee19f.1778053560.git.jeuk20.kim@samsung.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<cover.1778053560.git.jeuk20.kim@samsung.com>", "References": "<cover.1778053560.git.jeuk20.kim@samsung.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=2607:f8b0:4864:20::102c;\n envelope-from=jeuk20.kim@gmail.com; helo=mail-pj1-x102c.google.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "A guest can program an out-of-range SQATTR.CQID value, or ring an\nMCQ SQ doorbell before the submission queue exists.\n\nReject SQ creation when the referenced CQ is invalid, and ignore SQ\ndoorbells for queues that have not been created. This prevents a\nguest-triggerable out-of-bounds read and NULL pointer dereference.\n\nFixes: 5c079578d2e (\"hw/ufs: Add support MCQ of UFSHCI 4.0\")\nReported-by: Rayhan Ramdhany Hanaputra <hanaputrarayhan@gmail.com>\nCc: qemu-stable@nongnu.org\nSigned-off-by: Jeuk Kim <jeuk20.kim@samsung.com>\n---\n hw/ufs/ufs.c | 21 +++++++++++++++++++--\n 1 file changed, 19 insertions(+), 2 deletions(-)", "diff": "diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c\nindex cb74cb56bc..d5fba15e2a 100644\n--- a/hw/ufs/ufs.c\n+++ b/hw/ufs/ufs.c\n@@ -517,8 +517,13 @@ static bool ufs_mcq_create_sq(UfsHc *u, uint8_t qid, uint32_t attr)\n return false;\n }\n \n+ if (cqid >= u->params.mcq_maxq) {\n+ trace_ufs_err_mcq_create_sq_invalid_cqid(cqid);\n+ return false;\n+ }\n+\n if (!u->cq[cqid]) {\n- trace_ufs_err_mcq_create_sq_invalid_cqid(qid);\n+ trace_ufs_err_mcq_create_sq_invalid_cqid(cqid);\n return false;\n }\n \n@@ -775,6 +780,11 @@ static void ufs_mcq_process_db(UfsHc *u, uint8_t qid, uint32_t db)\n }\n \n sq = u->sq[qid];\n+ if (!sq) {\n+ trace_ufs_err_mcq_db_wr_invalid_sqid(qid);\n+ return;\n+ }\n+\n if (sq->size * sizeof(UfsSqEntry) <= db) {\n trace_ufs_err_mcq_db_wr_invalid_db(qid, db);\n return;\n@@ -788,7 +798,14 @@ static void ufs_write_mcq_op_reg(UfsHc *u, hwaddr offset, uint32_t data,\n unsigned size)\n {\n int qid = offset / sizeof(UfsMcqOpReg);\n- UfsMcqOpReg *opr = &u->mcq_op_reg[qid];\n+ UfsMcqOpReg *opr;\n+\n+ if (qid >= u->params.mcq_maxq) {\n+ trace_ufs_err_invalid_register_offset(offset);\n+ return;\n+ }\n+\n+ opr = &u->mcq_op_reg[qid];\n \n switch (offset % sizeof(UfsMcqOpReg)) {\n case offsetof(UfsMcqOpReg, sq.tp):\n", "prefixes": [ "1/4" ] }