{"id":814483,"url":"http://patchwork.ozlabs.org/api/patches/814483/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20170916091611.10241-1-m.olbrich@pengutronix.de/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20170916091611.10241-1-m.olbrich@pengutronix.de>","list_archive_url":null,"date":"2017-09-16T09:16:11","name":"hw/sd: fix out-of-bounds check for multi block reads","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"bdc0ae047eb048468e4a9bdf5e90c695bc324264","submitter":{"id":64504,"url":"http://patchwork.ozlabs.org/api/people/64504/?format=json","name":"Michael Olbrich","email":"m.olbrich@pengutronix.de"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20170916091611.10241-1-m.olbrich@pengutronix.de/mbox/","series":[{"id":3426,"url":"http://patchwork.ozlabs.org/api/series/3426/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=3426","date":"2017-09-16T09:16:11","name":"hw/sd: fix out-of-bounds check for multi block reads","version":1,"mbox":"http://patchwork.ozlabs.org/series/3426/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/814483/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/814483/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=)","Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xvRWn0VCXz9t2Q\n\tfor ;\n\tSat, 16 Sep 2017 19:18:10 +1000 (AEST)","from localhost ([::1]:56502 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t)\n\tid 1dt9Em-0007gg-Du\n\tfor incoming@patchwork.ozlabs.org; Sat, 16 Sep 2017 05:18:08 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:58301)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from ) id 1dt9ER-0007gJ-Ij\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:48 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from ) id 1dt9EO-0003cY-Dk\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:47 -0400","from metis.ext.4.pengutronix.de ([92.198.50.35]:60859)\n\tby eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.71) (envelope-from ) id 1dt9EO-0003bh-6x\n\tfor qemu-devel@nongnu.org; Sat, 16 Sep 2017 05:17:44 -0400","from dude.hi.pengutronix.de ([2001:67c:670:100:1d::7])\n\tby metis.ext.pengutronix.de with esmtps\n\t(TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2)\n\t(envelope-from )\n\tid 1dt9EE-0001b8-H6; Sat, 16 Sep 2017 11:17:34 +0200","from mol by dude.hi.pengutronix.de with local (Exim 4.89)\n\t(envelope-from )\n\tid 1dt9EE-0002lp-1F; Sat, 16 Sep 2017 11:17:34 +0200"],"From":"Michael Olbrich ","To":"qemu-devel@nongnu.org","Date":"Sat, 16 Sep 2017 11:16:11 +0200","Message-Id":"<20170916091611.10241-1-m.olbrich@pengutronix.de>","X-Mailer":"git-send-email 2.11.0","X-SA-Exim-Connect-IP":"2001:67c:670:100:1d::7","X-SA-Exim-Mail-From":"mol@pengutronix.de","X-SA-Exim-Scanned":"No (on metis.ext.pengutronix.de);\n\tSAEximRunCond expanded to false","X-PTX-Original-Recipient":"qemu-devel@nongnu.org","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"92.198.50.35","Subject":"[Qemu-devel] [PATCH] hw/sd: fix out-of-bounds check for multi block\n\treads","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"Michael Olbrich ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t"},"content":"The current code checks if the next block exceeds the size of the card.\nThis generates an error while reading the last block of the card.\nDo the out-of-bounds check when starting to read a new block to fix this.\n\nThis issue became visible with increased error checking in Linux 4.13.\n\nSigned-off-by: Michael Olbrich \n---\n hw/sd/sd.c | 12 ++++++------\n 1 file changed, 6 insertions(+), 6 deletions(-)","diff":"diff --git a/hw/sd/sd.c b/hw/sd/sd.c\nindex ba47bff4db80..94ff52512c43 100644\n--- a/hw/sd/sd.c\n+++ b/hw/sd/sd.c\n@@ -1797,8 +1797,13 @@ uint8_t sd_read_data(SDState *sd)\n break;\n \n case 18:\t/* CMD18: READ_MULTIPLE_BLOCK */\n- if (sd->data_offset == 0)\n+ if (sd->data_offset == 0) {\n+ if (sd->data_start + io_len > sd->size) {\n+ sd->card_status |= ADDRESS_ERROR;\n+ break;\n+ }\n BLK_READ_BLOCK(sd->data_start, io_len);\n+ }\n ret = sd->data[sd->data_offset ++];\n \n if (sd->data_offset >= io_len) {\n@@ -1812,11 +1817,6 @@ uint8_t sd_read_data(SDState *sd)\n break;\n }\n }\n-\n- if (sd->data_start + io_len > sd->size) {\n- sd->card_status |= ADDRESS_ERROR;\n- break;\n- }\n }\n break;\n \n","prefixes":[]}