Only move the state machine to ReceivingData if there is no pending error. This avoids later OOB access while processing commands queued. "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01" 4.3.3 Data Read Read command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. 4.3.4 Data Write Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. WP_VIOLATION errors are not modified: the error bit is set, we stay in receive-data state, wait for a stop command. All further data transfer is ignored. See the check on sd->card_status at the beginning of sd_read_data() and sd_write_data(). Fixes: CVE-2020-13253 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Buglink: https://bugs.launchpad.net/qemu/+bug/1880822 Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-6-f4bug@amsat.org> |
||
---|---|---|
.. | ||
allwinner-sdhost.c | ||
aspeed_sdhci.c | ||
bcm2835_sdhost.c | ||
core.c | ||
Kconfig | ||
Makefile.objs | ||
milkymist-memcard.c | ||
omap_mmc.c | ||
pl181.c | ||
pxa2xx_mmci.c | ||
sd.c | ||
sdhci-internal.h | ||
sdhci-pci.c | ||
sdhci.c | ||
sdmmc-internal.c | ||
sdmmc-internal.h | ||
ssi-sd.c | ||
trace-events |