| Message ID | 20200901140411.112150-4-f4bug@amsat.org |
|---|---|
| State | New |
| Headers | show |
| Series | hw/sd/sdhci: Fix DMA Transfer Block Size field width | expand |
+-- On Tue, 1 Sep 2020, Philippe Mathieu-Daudé wrote --+
| The 'Transfer Block Size' field is 12-bit wide.
| See section '2.2.2. Block Size Register (Offset 004h)' in datasheet.
|
| Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
+ https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Fsdhci_oob_write1
| diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
| index 60f083b84c1..ecbf84e9d3f 100644
| --- a/hw/sd/sdhci.c
| +++ b/hw/sd/sdhci.c
| @@ -1104,7 +1104,7 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
| break;
| case SDHC_BLKSIZE:
| if (!TRANSFERRING_DATA(s->prnsts)) {
| - MASKED_WRITE(s->blksize, mask, value);
| + MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
| MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
It helps to fix above issues.
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 60f083b84c1..ecbf84e9d3f 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1104,7 +1104,7 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) break; case SDHC_BLKSIZE: if (!TRANSFERRING_DATA(s->prnsts)) { - MASKED_WRITE(s->blksize, mask, value); + MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12)); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); }
The 'Transfer Block Size' field is 12-bit wide. See section '2.2.2. Block Size Register (Offset 004h)' in datasheet. Cc: qemu-stable@nongnu.org Cc: Igor Mitsyanko <i.mitsyanko@gmail.com> Buglink: https://bugs.launchpad.net/qemu/+bug/1892960 Fixes: d7dfca0807a ("hw/sdhci: introduce standard SD host controller") Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- Cc: 1892960@bugs.launchpad.net --- hw/sd/sdhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)