riscv/qemu: QEMU main repository: Please see https://www.qemu.org/docs/master/devel/submitting-a-patch.html for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website. http://www.qemu.org - qemu

QEMU main repository: Please see https://www.qemu.org/docs/master/devel/submitting-a-patch.html for how to submit changes to QEMU. Pull Requests are ignored. Please only use release tarballs from the QEMU website. http://www.qemu.org

emulation kvm qemu virtualization

History

Philippe Mathieu-Daudé 4ac0b72bae hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30 OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers the assertion added in commit `84816fb63e` ("hw/sd/sdcard: Assert if accessing an illegal group"): qemu-fuzz-i386-target-generic-fuzz-sdhci-v3: ../hw/sd/sd.c:824: uint32_t sd_wpbits(SDState , uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. #3 0x7f62a8b22c91 in __assert_fail #4 0x5569adcec405 in sd_wpbits hw/sd/sd.c:824:9 #5 0x5569adce5f6d in sd_normal_command hw/sd/sd.c:1389:38 #6 0x5569adce3870 in sd_do_command hw/sd/sd.c:1737:17 #7 0x5569adcf1566 in sdbus_do_command hw/sd/core.c💯16 #8 0x5569adcfc192 in sdhci_send_command hw/sd/sdhci.c:337:12 #9 0x5569adcfa3a3 in sdhci_write hw/sd/sdhci.c:1186:9 #10 0x5569adfb3447 in memory_region_write_accessor softmmu/memory.c:492:5 It is legal for the CMD30 to query for out-of-range addresses. Such invalid addresses are simply ignored in the response (write protection bits set to 0). In commit `84816fb63e` ("hw/sd/sdcard: Assert if accessing an illegal group") we misplaced the assertion before* we test the address is in range. Move it after. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Cc: qemu-stable@nongnu.org Reported-by: OSS-Fuzz (Issue 29225) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: `84816fb63e` ("hw/sd/sdcard: Assert if accessing an illegal group") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/495 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-3-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>		5 years ago
..
Kconfig	hw/sd: Add Cadence SDHCI emulation	6 years ago
allwinner-sdhost.c	Use DECLARE_CHECKER when possible (--force mode)	6 years ago
aspeed_sdhci.c	Fix SPDX-License-Identifier typos	6 years ago
bcm2835_sdhost.c	Use DECLARE_CHECKER when possible (--force mode)	6 years ago
cadence_sdhci.c	hw: Do not include qemu/log.h if it is not necessary	5 years ago
core.c	hw/sd: Introduce receive_ready() callback	6 years ago
meson.build	Drop the deprecated lm32 target	5 years ago
omap_mmc.c	hw/sd/omap_mmc: Use device_cold_reset() instead of device_legacy_reset()	5 years ago
pl181.c	Use OBJECT_DECLARE_SIMPLE_TYPE when possible	6 years ago
pxa2xx_mmci.c	Use DECLARE_CHECKER when possible (--force mode)	6 years ago
sd.c	hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30	5 years ago
sdhci-internal.h	sd: sdhci: Implement basic vendor specific register support	6 years ago
sdhci-pci.c	sd: Use ERRP_GUARD()	6 years ago
sdhci.c	hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed	5 years ago
sdmmc-internal.c	sdcard: Display command name when tracing CMD/ACMD	9 years ago
sdmmc-internal.h	Clean up header guards that don't match their file name	7 years ago
ssi-sd.c	hw/sd: ssi-sd: Handle the rest commands with R1b response type	6 years ago
trace-events	docs: fix references to docs/devel/tracing.rst	5 years ago
trace.h	trace: switch position of headers to what Meson requires	6 years ago