OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

SD/MMC patches queue 

- sdcard: Fix assertion accessing out-of-range addresses
   with SEND_WRITE_PROT (CMD30)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmEJfvsACgkQ4+MsLN6t
 wN5eKRAA0dWxmsr4eZGHQababmorVWs46T1IXW+slmSQL781+KMBme0XiKS0o7y/
 +1TlL2KWyvx8davAnW2eVYbhwEo5j48gWWxSNPcvKj5gAy9Hd6/NOPTMT7XTHYNI
 zhhk1+Gjvrlg4KIoJoBECDBh/9fy/pmgENow3wnbkbDj55RQq6XT1us0ypVlWwCp
 ug57g3vyYDPTPNdzdgyQsikgiyLqsk2CVhet2c+1IuBrCwdA5ZgflsxNmAH+hsHX
 okHK8FreFKcyscj38vXP8tZi7GHj+hJE3EBL0Fz16gTWLkxONc3DYYxzhtvXRE8l
 ANSslmWNQw+TLverT+a/0I1QKFO27q7MoXBs08Wf4YdB3Pgsx+y9FXzuPMbauK5T
 Z8RNSKU3CoAtcOD1TOyItH0fZaaYuVcprsKLR6ZsSIs2rIoeUNfd7pUjxAs7rZvC
 fAbYJrFjxYlrSxZT+jEAMZFE4PzH8Hb/+NeOk8xfI5+uNdr2UgGvcZdXZQPfQEPK
 lRQSwoHOlPy+UYMzVwJP9YsRiUNcZr082cif3d7BBcymeJ//SFusdQSj5jktkszq
 Dn5SL6Up86UmU3QCMgtFURKavashUZ+SnBJ+GdJpXCz16sBfHY70gPpfDhm9+vOy
 pf/7S4fA64EHvV6rfVH6sqeqnV5YAc+1ubEHK5vP3w3FOzFJ06c=
 =EaXR
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/philmd/tags/sdmmc-20210803' into staging

SD/MMC patches queue

- sdcard: Fix assertion accessing out-of-range addresses
  with SEND_WRITE_PROT (CMD30)

# gpg: Signature made Tue 03 Aug 2021 18:38:03 BST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd/tags/sdmmc-20210803:
  hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30
  hw/sd/sdcard: Document out-of-range addresses for SEND_WRITE_PROT

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2021-08-04 11:40:27 +01:00
parent ef6607edf0 4ac0b72bae
commit 700d82c9bc
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hw/sd/sd.c
View File

@ -821,8 +821,15 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
wpnum = sd_addr_to_wpnum(addr);
for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
if (addr >= sd->size) {
/*
* If the addresses of the last groups are outside the valid range,
* then the corresponding write protection bits shall be set to 0.
*/
continue;
}
assert(wpnum < sd->wpgrps_size);
if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
if (test_bit(wpnum, sd->wp_groups)) {
ret |= (1 << i);
}
}

36
tests/qtest/fuzz-sdcard-test.c
View File

@ -52,6 +52,41 @@ static void oss_fuzz_29225(void)
qtest_quit(s);
}
/*
* https://gitlab.com/qemu-project/qemu/-/issues/495
* Used to trigger:
* Assertion `wpnum < sd->wpgrps_size' failed.
*/
static void oss_fuzz_36217(void)
{
QTestState *s;
s = qtest_init(" -display none -m 32 -nodefaults -nographic"
" -device sdhci-pci,sd-spec-version=3 "
"-device sd-card,drive=d0 "
"-drive if=none,index=0,file=null-co://,format=raw,id=d0");
qtest_outl(s, 0xcf8, 0x80001010);
qtest_outl(s, 0xcfc, 0xe0000000);
qtest_outl(s, 0xcf8, 0x80001004);
qtest_outw(s, 0xcfc, 0x02);
qtest_bufwrite(s, 0xe000002c, "\x05", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x37", 0x1);
qtest_bufwrite(s, 0xe000000a, "\x01", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x29", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x02", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x03", 0x1);
qtest_bufwrite(s, 0xe0000005, "\x01", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x06", 0x1);
qtest_bufwrite(s, 0xe000000c, "\x05", 0x1);
qtest_bufwrite(s, 0xe000000e, "\x20", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x08", 0x1);
qtest_bufwrite(s, 0xe000000b, "\x3d", 0x1);
qtest_bufwrite(s, 0xe000000f, "\x1e", 0x1);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
@ -60,6 +95,7 @@ int main(int argc, char **argv)
if (strcmp(arch, "i386") == 0) {
qtest_add_func("fuzz/sdcard/oss_fuzz_29225", oss_fuzz_29225);
qtest_add_func("fuzz/sdcard/oss_fuzz_36217", oss_fuzz_36217);
}
return g_test_run();