qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH] hw/sd: fix out-of-bounds check for multi block reads
@ 2017-09-16  9:16 Michael Olbrich
  2017-09-16  9:21 ` no-reply
  0 siblings, 1 reply; 12+ messages in thread
From: Michael Olbrich @ 2017-09-16  9:16 UTC (permalink / raw)
  To: qemu-devel; +Cc: Michael Olbrich

The current code checks if the next block exceeds the size of the card.
This generates an error while reading the last block of the card.
Do the out-of-bounds check when starting to read a new block to fix this.

This issue became visible with increased error checking in Linux 4.13.

Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
---
 hw/sd/sd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index ba47bff4db80..94ff52512c43 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1797,8 +1797,13 @@ uint8_t sd_read_data(SDState *sd)
         break;
 
     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */
-        if (sd->data_offset == 0)
+        if (sd->data_offset == 0) {
+            if (sd->data_start + io_len > sd->size) {
+                sd->card_status |= ADDRESS_ERROR;
+                break;
+            }
             BLK_READ_BLOCK(sd->data_start, io_len);
+        }
         ret = sd->data[sd->data_offset ++];
 
         if (sd->data_offset >= io_len) {
@@ -1812,11 +1817,6 @@ uint8_t sd_read_data(SDState *sd)
                     break;
                 }
             }
-
-            if (sd->data_start + io_len > sd->size) {
-                sd->card_status |= ADDRESS_ERROR;
-                break;
-            }
         }
         break;
 
-- 
2.14.1

^ permalink raw reply related	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2017-09-25 23:07 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-16  9:16 [Qemu-devel] [PATCH] hw/sd: fix out-of-bounds check for multi block reads Michael Olbrich
2017-09-16  9:21 ` no-reply
2017-09-16 10:35   ` [Qemu-devel] [PATCH v2] " Michael Olbrich
2017-09-18 21:28     ` Alistair Francis
2017-09-19  8:23       ` Michael Olbrich
2017-09-20  0:09         ` Alistair Francis
2017-09-20  6:19           ` Michael Olbrich
2017-09-25 19:27             ` Peter Maydell
2017-09-25 21:16               ` Alistair Francis
2017-09-25 22:38                 ` Peter Maydell
2017-09-25 22:53                   ` Alistair Francis
2017-09-25 23:07                     ` Peter Maydell

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).