* [PATCH] hw/ufs: Fix mcq register range determination logic @ 2024-07-03 8:54 ` Jeuk Kim 2024-07-04 20:54 ` Minwoo Im 0 siblings, 1 reply; 2+ messages in thread From: Jeuk Kim @ 2024-07-03 8:54 UTC (permalink / raw) To: qemu-devel; +Cc: jeuk20.kim, qemu-block, j-young.choi, minwoo.im The function ufs_is_mcq_reg() only evaluated the range of the mcq_op_reg offset, which is defined as a constant. Therefore, it was possible for ufs_is_mcq_reg() to return true despite ufs device is configured to not support the mcq. This could cause ufs_mmio_read()/ufs_mmio_write() to overflow the buffer. So fix it. Fixes: 5c079578d2e4 ("hw/ufs: Add support MCQ of UFSHCI 4.0") Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com> --- hw/ufs/ufs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c index 683fff5840..cf0edd281c 100644 --- a/hw/ufs/ufs.c +++ b/hw/ufs/ufs.c @@ -57,7 +57,13 @@ static inline uint64_t ufs_reg_size(UfsHc *u) static inline bool ufs_is_mcq_reg(UfsHc *u, uint64_t addr, unsigned size) { - uint64_t mcq_reg_addr = ufs_mcq_reg_addr(u, 0); + uint64_t mcq_reg_addr; + + if (!u->params.mcq) { + return false; + } + + mcq_reg_addr = ufs_mcq_reg_addr(u, 0); return (addr >= mcq_reg_addr && addr + size <= mcq_reg_addr + sizeof(u->mcq_reg)); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] hw/ufs: Fix mcq register range determination logic 2024-07-03 8:54 ` [PATCH] hw/ufs: Fix mcq register range determination logic Jeuk Kim @ 2024-07-04 20:54 ` Minwoo Im 0 siblings, 0 replies; 2+ messages in thread From: Minwoo Im @ 2024-07-04 20:54 UTC (permalink / raw) To: Jeuk Kim; +Cc: qemu-devel, jeuk20.kim, qemu-block, j-young.choi, minwoo.im [-- Attachment #1: Type: text/plain, Size: 534 bytes --] On 24-07-03 17:54:10, Jeuk Kim wrote: > The function ufs_is_mcq_reg() only evaluated the range of the > mcq_op_reg offset, which is defined as a constant. > Therefore, it was possible for ufs_is_mcq_reg() to return true > despite ufs device is configured to not support the mcq. > This could cause ufs_mmio_read()/ufs_mmio_write() to overflow the > buffer. So fix it. > > Fixes: 5c079578d2e4 ("hw/ufs: Add support MCQ of UFSHCI 4.0") > Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com> Reviewed-by: Minwoo Im <minwoo.im@samsung.com> [-- Attachment #2: Type: text/plain, Size: 0 bytes --] ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-07-04 21:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20240703085445epcas2p46c71128d3bbd516d3779781c6e2b2f58@epcas2p4.samsung.com>
2024-07-03 8:54 ` [PATCH] hw/ufs: Fix mcq register range determination logic Jeuk Kim
2024-07-04 20:54 ` Minwoo Im
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).