Re: [PATCH] hw/sd/sdhci: Do not modify BlockSizeRegister if transaction in progress

[Philippe Mathieu-Daudé]

On Mon, Feb 8, 2021 at 8:59 PM Mauro Matteo Cascella
<mcascell@redhat.com> wrote:
> On Mon, Feb 8, 2021 at 8:35 PM Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
> >
> > Per the "SD Host Controller Simplified Specification Version 2.00"
> > spec. 'Table 2-4 : Block Size Register':
> >
> >   Transfer Block Size [...] can be accessed only if no
> >   transaction is executing (i.e., after a transaction has stopped).
> >   Read operations during transfers may return an invalid value,
> >   and write operations shall be ignored.
> >
...
> >
> > Fixes: CVE-2020-17380
> > Fixes: CVE-2020-25085
> > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> > ---
> > Cc: Mauro Matteo Cascella <mcascell@redhat.com>
> > Cc: Alexander Bulekov <alxndr@bu.edu>
> > Cc: Alistair Francis <alistair.francis@wdc.com>
> > Cc: Prasad J Pandit <ppandit@redhat.com>
> > Cc: Bandan Das <bsd@redhat.com>
> >
> > RFC because missing Reported-by tags, launchpad/bugzilla links and
> > qtest reproducer. Sending for review meanwhile.
...
> For the above CVEs:
> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com>

Thanks Mauro for testing. Do you know what tags I should add for the credits?

Phil.