Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/814483/?format=api
{ "id": 814483, "url": "http://patchwork.ozlabs.org/api/patches/814483/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20170916091611.10241-1-m.olbrich@pengutronix.de/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20170916091611.10241-1-m.olbrich@pengutronix.de>", "list_archive_url": null, "date": "2017-09-16T09:16:11", "name": "hw/sd: fix out-of-bounds check for multi block reads", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "bdc0ae047eb048468e4a9bdf5e90c695bc324264", "submitter": { "id": 64504, "url": "http://patchwork.ozlabs.org/api/people/64504/?format=api", "name": "Michael Olbrich", "email": "m.olbrich@pengutronix.de" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20170916091611.10241-1-m.olbrich@pengutronix.de/mbox/", "series": [ { "id": 3426, "url": "http://patchwork.ozlabs.org/api/series/3426/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=3426", "date": "2017-09-16T09:16:11", "name": "hw/sd: fix out-of-bounds check for multi block reads", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/3426/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/814483/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/814483/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org", "Authentication-Results": "ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=<UNKNOWN>)", "Received": [ "from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xvRWn0VCXz9t2Q\n\tfor <incoming@patchwork.ozlabs.org>;\n\tSat, 16 Sep 2017 19:18:10 +1000 (AEST)", "from localhost ([::1]:56502 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>)\n\tid 1dt9Em-0007gg-Du\n\tfor incoming@patchwork.ozlabs.org; Sat, 16 Sep 2017 05:18:08 -0400", "from eggs.gnu.org ([2001:4830:134:3::10]:58301)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from <mol@pengutronix.de>) id 1dt9ER-0007gJ-Ij\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:48 -0400", "from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from <mol@pengutronix.de>) id 1dt9EO-0003cY-Dk\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:47 -0400", "from metis.ext.4.pengutronix.de ([92.198.50.35]:60859)\n\tby eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.71) (envelope-from <mol@pengutronix.de>) id 1dt9EO-0003bh-6x\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:44 -0400", "from dude.hi.pengutronix.de ([2001:67c:670:100:1d::7])\n\tby metis.ext.pengutronix.de with esmtps\n\t(TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2)\n\t(envelope-from <mol@pengutronix.de>)\n\tid 1dt9EE-0001b8-H6; Sat, 16 Sep 2017 11:17:34 +0200", "from mol by dude.hi.pengutronix.de with local (Exim 4.89)\n\t(envelope-from <mol@pengutronix.de>)\n\tid 1dt9EE-0002lp-1F; Sat, 16 Sep 2017 11:17:34 +0200" ], "From": "Michael Olbrich <m.olbrich@pengutronix.de>", "To": "qemu-devel@nongnu.org", "Date": "Sat, 16 Sep 2017 11:16:11 +0200", "Message-Id": "<20170916091611.10241-1-m.olbrich@pengutronix.de>", "X-Mailer": "git-send-email 2.11.0", "X-SA-Exim-Connect-IP": "2001:67c:670:100:1d::7", "X-SA-Exim-Mail-From": "mol@pengutronix.de", "X-SA-Exim-Scanned": "No (on metis.ext.pengutronix.de);\n\tSAEximRunCond expanded to false", "X-PTX-Original-Recipient": "qemu-devel@nongnu.org", "X-detected-operating-system": "by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]", "X-Received-From": "92.198.50.35", "Subject": "[Qemu-devel] [PATCH] hw/sd: fix out-of-bounds check for multi block\n\treads", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.21", "Precedence": "list", "List-Id": "<qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<http://lists.nongnu.org/archive/html/qemu-devel/>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Cc": "Michael Olbrich <m.olbrich@pengutronix.de>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "\"Qemu-devel\"\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>" }, "content": "The current code checks if the next block exceeds the size of the card.\nThis generates an error while reading the last block of the card.\nDo the out-of-bounds check when starting to read a new block to fix this.\n\nThis issue became visible with increased error checking in Linux 4.13.\n\nSigned-off-by: Michael Olbrich <m.olbrich@pengutronix.de>\n---\n hw/sd/sd.c | 12 ++++++------\n 1 file changed, 6 insertions(+), 6 deletions(-)", "diff": "diff --git a/hw/sd/sd.c b/hw/sd/sd.c\nindex ba47bff4db80..94ff52512c43 100644\n--- a/hw/sd/sd.c\n+++ b/hw/sd/sd.c\n@@ -1797,8 +1797,13 @@ uint8_t sd_read_data(SDState *sd)\n break;\n \n case 18:\t/* CMD18: READ_MULTIPLE_BLOCK */\n- if (sd->data_offset == 0)\n+ if (sd->data_offset == 0) {\n+ if (sd->data_start + io_len > sd->size) {\n+ sd->card_status |= ADDRESS_ERROR;\n+ break;\n+ }\n BLK_READ_BLOCK(sd->data_start, io_len);\n+ }\n ret = sd->data[sd->data_offset ++];\n \n if (sd->data_offset >= io_len) {\n@@ -1812,11 +1817,6 @@ uint8_t sd_read_data(SDState *sd)\n break;\n }\n }\n-\n- if (sd->data_start + io_len > sd->size) {\n- sd->card_status |= ADDRESS_ERROR;\n- break;\n- }\n }\n break;\n \n", "prefixes": [] }