From: "Philippe Mathieu-Daudé" <philmd@linaro.org>
To: Richard Henderson <richard.henderson@linaro.org>, qemu-devel@nongnu.org
Cc: Qiang Liu <cyruscyliu@gmail.com>,
Mauro Matteo Cascella <mcascell@redhat.com>,
Kevin Wolf <kwolf@redhat.com>, Alexander Bulekov <alxndr@bu.edu>,
Hanna Reitz <hreitz@redhat.com>,
qemu-block@nongnu.org
Subject: Re: [PATCH-for-9.0? 3/3] hw/block/nand: Fix out-of-bound access in NAND block buffer
Date: Tue, 9 Apr 2024 00:05:16 +0200 [thread overview]
Message-ID: <ee492ca9-4d79-4de1-98da-8df9230ca5af@linaro.org> (raw)
In-Reply-To: <d610c2d2-3576-4ca2-a2b9-4f9a5390e3d3@linaro.org>
On 8/4/24 18:39, Richard Henderson wrote:
> On 4/7/24 22:36, Philippe Mathieu-Daudé wrote:
>> nand_command() and nand_getio() don't check @offset points
>> into the block, nor the available data length (s->iolen) is
>> not negative.
>>
>> In order to fix:
>>
>> - check the offset is in range in nand_blk_load_NAND_PAGE_SIZE(),
>> - do not set @iolen if blk_load() failed.
>
> Do not set, or do not set to non-zero? I had been wondering if the
Oh, "do not set to non-zero", thanks :)
> final assignment to s->iolen should go into nand_load_block as well...
For the next tag I rather keep it this way which seems more
explicit to me.
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Thanks!
next prev parent reply other threads:[~2024-04-08 22:06 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-08 8:36 [PATCH-for-9.0? 0/3] hw/block/nand: Fix out-of-bound access in NAND block buffer Philippe Mathieu-Daudé
2024-04-08 8:36 ` [PATCH-for-9.0? 1/3] hw/block/nand: Factor nand_load_iolen() method out Philippe Mathieu-Daudé
2024-04-08 16:35 ` Richard Henderson
2024-04-09 10:48 ` Kevin Wolf
2024-04-08 8:36 ` [PATCH-for-9.0? 2/3] hw/block/nand: Have blk_load() return boolean indicating success Philippe Mathieu-Daudé
2024-04-08 16:36 ` Richard Henderson
2024-04-08 8:36 ` [PATCH-for-9.0? 3/3] hw/block/nand: Fix out-of-bound access in NAND block buffer Philippe Mathieu-Daudé
2024-04-08 8:43 ` Philippe Mathieu-Daudé
2024-04-08 16:39 ` Richard Henderson
2024-04-08 22:05 ` Philippe Mathieu-Daudé [this message]
2024-04-08 15:45 ` [PATCH-for-9.0? 0/3] " Mauro Matteo Cascella
2024-04-09 13:57 ` Philippe Mathieu-Daudé
2024-04-09 10:55 ` Kevin Wolf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ee492ca9-4d79-4de1-98da-8df9230ca5af@linaro.org \
--to=philmd@linaro.org \
--cc=alxndr@bu.edu \
--cc=cyruscyliu@gmail.com \
--cc=hreitz@redhat.com \
--cc=kwolf@redhat.com \
--cc=mcascell@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).