[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v7 10/17] hw/sd/sdcard: Check address is in range
From: |
Philippe Mathieu-Daudé |
Subject: |
[PATCH v7 10/17] hw/sd/sdcard: Check address is in range |
Date: |
Tue, 30 Jun 2020 15:39:04 +0200 |
As a defense, assert if the requested address is out of the card area.
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
hw/sd/sd.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 548745614e..5d1b314a32 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -537,8 +537,10 @@ static void sd_response_r7_make(SDState *sd, uint8_t
*response)
stl_be_p(response, sd->vhs);
}
-static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
+static uint64_t sd_addr_to_wpnum(SDState *sd, uint64_t addr)
{
+ assert(addr < sd->size);
+
return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
}
@@ -773,8 +775,8 @@ static void sd_erase(SDState *sd)
erase_end *= HWBLOCK_SIZE;
}
- erase_start = sd_addr_to_wpnum(erase_start);
- erase_end = sd_addr_to_wpnum(erase_end);
+ erase_start = sd_addr_to_wpnum(sd, erase_start);
+ erase_end = sd_addr_to_wpnum(sd, erase_end);
sd->erase_start = 0;
sd->erase_end = 0;
sd->csd[14] |= 0x40;
@@ -791,7 +793,7 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
uint32_t i, wpnum;
uint32_t ret = 0;
- wpnum = sd_addr_to_wpnum(addr);
+ wpnum = sd_addr_to_wpnum(sd, addr);
for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
@@ -833,7 +835,7 @@ static void sd_function_switch(SDState *sd, uint32_t arg)
static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
{
- return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
+ return test_bit(sd_addr_to_wpnum(sd, addr), sd->wp_groups);
}
static void sd_lock_command(SDState *sd)
@@ -1345,7 +1347,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
SDRequest req)
}
sd->state = sd_programming_state;
- set_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
+ set_bit(sd_addr_to_wpnum(sd, addr), sd->wp_groups);
/* Bzzzzzzztt .... Operation complete. */
sd->state = sd_transfer_state;
return sd_r1b;
@@ -1364,7 +1366,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
SDRequest req)
}
sd->state = sd_programming_state;
- clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
+ clear_bit(sd_addr_to_wpnum(sd, addr), sd->wp_groups);
/* Bzzzzzzztt .... Operation complete. */
sd->state = sd_transfer_state;
return sd_r1b;
--
2.21.3
- [PATCH v7 00/17] hw/sd/sdcard: Fix CVE-2020-13253 & cleanups, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 01/17] MAINTAINERS: Cc qemu-block mailing list, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 02/17] hw/sd/sdcard: Update coding style to make checkpatch.pl happy, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 03/17] hw/sd/sdcard: Move some definitions to use them earlier, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 04/17] hw/sd/sdcard: Use the HWBLOCK_SIZE definition, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 05/17] hw/sd/sdcard: Do not switch to ReceivingData if address is invalid, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 06/17] hw/sd/sdcard: Restrict Class 6 commands to SCSD cards, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 07/17] hw/sd/sdcard: Move sd->size initialization, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 08/17] hw/sd/sdcard: Call sd_addr_to_wpnum where it is used, consider zero size, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 09/17] hw/sd/sdcard: Special case the -ENOMEDIUM error, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 10/17] hw/sd/sdcard: Check address is in range,
Philippe Mathieu-Daudé <=
- [PATCH v7 14/17] hw/sd/sdcard: Make iolen unsigned, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 11/17] hw/sd/sdcard: Update the SDState documentation, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 12/17] hw/sd/sdcard: Simplify cmd_valid_while_locked(), Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 13/17] hw/sd/sdcard: Constify sd_crc*()'s message argument, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 17/17] hw/sd/sdcard: Simplify realize() a bit, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 16/17] hw/sd/sdcard: Display offset in read/write_data() trace events, Philippe Mathieu-Daudé, 2020/06/30
- [PATCH v7 15/17] hw/sd/sdcard: Correctly display the command name in trace events, Philippe Mathieu-Daudé, 2020/06/30