Patchwork [QEMU] m25p80.c: Return state to IDLE after COLLECTING

login
register
mail settings
Submitter Peter Crosthwaite
Date Jan. 26, 2013, 1:58 a.m.
Message ID <e65b2682-ef5b-4445-9b23-87719b2ccba6@CH1EHSMHS027.ehs.local>
Download mbox | patch
Permalink /patch/215881/
State New
Headers show

Comments

Peter Crosthwaite - Jan. 26, 2013, 1:58 a.m.
Default to moving back to the IDLE state after the COLLECTING_DATA
state. For a well behaved guest this patch has no consequence, but
A bad guest could crash QEMU by using one of the erase commands
followed by a longer than 5 byte argument (undefined behaviour).

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
---
 hw/m25p80.c | 2 ++
 1 file changed, 2 insertions(+)
Edgar Iglesias - Jan. 27, 2013, 12:08 a.m.
On Fri, Jan 25, 2013 at 05:58:38PM -0800, Peter Crosthwaite wrote:
> Default to moving back to the IDLE state after the COLLECTING_DATA
> state. For a well behaved guest this patch has no consequence, but
> A bad guest could crash QEMU by using one of the erase commands
> followed by a longer than 5 byte argument (undefined behaviour).


Applied it, thanks

> 
> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
> ---
>  hw/m25p80.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/hw/m25p80.c b/hw/m25p80.c
> index ad9e800..16d4880 100644
> --- a/hw/m25p80.c
> +++ b/hw/m25p80.c
> @@ -359,6 +359,8 @@ static void complete_collecting_data(Flash *s)
>      s->cur_addr |= s->data[1] << 8;
>      s->cur_addr |= s->data[2];
>  
> +    s->state = STATE_IDLE;
> +
>      switch (s->cmd_in_progress) {
>      case DPP:
>      case QPP:
> -- 
> 1.7.12.1.396.g16eed7c
> 
>

Patch

diff --git a/hw/m25p80.c b/hw/m25p80.c
index ad9e800..16d4880 100644
--- a/hw/m25p80.c
+++ b/hw/m25p80.c
@@ -359,6 +359,8 @@  static void complete_collecting_data(Flash *s)
     s->cur_addr |= s->data[1] << 8;
     s->cur_addr |= s->data[2];
 
+    s->state = STATE_IDLE;
+
     switch (s->cmd_in_progress) {
     case DPP:
     case QPP: