[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-9.0.3 40/69] hw/sd/sdhci: Reset @data_count index on invalid ADM
From: |
Michael Tokarev |
Subject: |
[Stable-9.0.3 40/69] hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers |
Date: |
Fri, 6 Sep 2024 14:12:49 +0300 |
From: Philippe Mathieu-Daudé <philmd@linaro.org>
We neglected to clear the @data_count index on ADMA error,
allowing to trigger assertion in sdhci_read_dataport() or
sdhci_write_dataport().
Cc: qemu-stable@nongnu.org
Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2455
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240730092138.32443-4-philmd@linaro.org>
(cherry picked from commit ed5a159c3de48a581f46de4c8c02b4b295e6c52d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 27673e1c70..8c5eab1b83 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -846,6 +846,7 @@ static void sdhci_do_adma(SDHCIState *s)
}
}
if (res != MEMTX_OK) {
+ s->data_count = 0;
if (s->errintstsen & SDHC_EISEN_ADMAERR) {
trace_sdhci_error("Set ADMA error flag");
s->errintsts |= SDHC_EIS_ADMAERR;
--
2.39.2
- [Stable-9.0.3 29/69] docs/sphinx/depfile.py: Handle env.doc2path() returning a Path not a str, (continued)
- [Stable-9.0.3 29/69] docs/sphinx/depfile.py: Handle env.doc2path() returning a Path not a str, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 34/69] virtio-net: Fix network stall at the host side waiting for kick, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 36/69] migration/multifd: Fix multifd_send_setup cleanup when channel creation fails, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 37/69] linux-user/elfload: Fix pr_pid values in core files, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 38/69] target/i386: Fix VSIB decode, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 32/69] target/arm: Handle denormals correctly for FMOPA (widening), Michael Tokarev, 2024/09/06
- [Stable-9.0.3 33/69] virtio-net: Ensure queue index fits with RSS, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 35/69] net: Reinstate '-net nic, model=help' output as documented in man page, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 41/69] vvfat: Fix bug in writing to middle of file, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 39/69] tcg/ppc: Sync tcg_out_test and constraints, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 40/69] hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers,
Michael Tokarev <=
- [Stable-9.0.3 43/69] vvfat: Fix wrong checks for cluster mappings invariant, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 42/69] vvfat: Fix usage of `info.file.offset`, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 46/69] nbd/server: Plumb in new args to nbd_client_add(), Michael Tokarev, 2024/09/06
- [Stable-9.0.3 45/69] iotests: Add `vvfat` tests, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 47/69] nbd/server: CVE-2024-7409: Cap default max-connections to 100, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 44/69] vvfat: Fix reading files with non-continuous clusters, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 48/69] nbd/server: CVE-2024-7409: Drop non-negotiating clients, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 49/69] nbd/server: CVE-2024-7409: Close stray clients at server-stop, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 50/69] nbd/server: CVE-2024-7409: Avoid use-after-free when closing server, Michael Tokarev, 2024/09/06
- [Stable-9.0.3 51/69] net: Fix '-net nic, model=' for non-help arguments, Michael Tokarev, 2024/09/06