Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2023-05-29 Thread Mauro Matteo Cascella
On Sat, May 27, 2023 at 11:00 AM Michael Tokarev wrote: > > Mon, 7 Nov 2022 11:35:10 +0100, you wrote: > > Make sure to reset data_count if it's equal to (or exceeds) block_size. > > This prevents an off-by-one read / write when accessing s->fifo_buffer > > in sdhci_read_dataport / sdhci_write_

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2023-05-27 Thread Michael Tokarev
Mon, 7 Nov 2022 11:35:10 +0100, you wrote: > Make sure to reset data_count if it's equal to (or exceeds) block_size. > This prevents an off-by-one read / write when accessing s->fifo_buffer > in sdhci_read_dataport / sdhci_write_dataport, both called right after > sdhci_buff_access_is_sequential.

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-10 Thread Bin Meng
On Fri, Nov 11, 2022 at 2:51 AM Mauro Matteo Cascella wrote: > > On Wed, Nov 9, 2022 at 5:19 PM Bin Meng wrote: > > > > On Wed, Nov 9, 2022 at 6:10 PM Mauro Matteo Cascella > > wrote: > > > > > > On Wed, Nov 9, 2022 at 10:45 AM Siqi Chen wrote: > > > > > > > > Hi, > > > > > > > > >This reproduc

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-10 Thread Mauro Matteo Cascella
On Wed, Nov 9, 2022 at 5:19 PM Bin Meng wrote: > > On Wed, Nov 9, 2022 at 6:10 PM Mauro Matteo Cascella > wrote: > > > > On Wed, Nov 9, 2022 at 10:45 AM Siqi Chen wrote: > > > > > > Hi, > > > > > > >This reproducer does not crash my QEMU. Am I missing anything? > > > I submitted the reproducer.

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-09 Thread Bin Meng
On Wed, Nov 9, 2022 at 6:10 PM Mauro Matteo Cascella wrote: > > On Wed, Nov 9, 2022 at 10:45 AM Siqi Chen wrote: > > > > Hi, > > > > >This reproducer does not crash my QEMU. Am I missing anything? > > I submitted the reproducer. Because the overflow is only one byte, it may > > not be detected b

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-09 Thread Siqi Chen
Hi, >This reproducer does not crash my QEMU. Am I missing anything? I submitted the reproducer. Because the overflow is only one byte, it may not be detected by the host's heap allocator. Do you compile your qemu with sanitizer? This is my build configuration: "./configure --target-list=x86_64-s

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-09 Thread Mauro Matteo Cascella
On Wed, Nov 9, 2022 at 10:45 AM Siqi Chen wrote: > > Hi, > > >This reproducer does not crash my QEMU. Am I missing anything? > I submitted the reproducer. Because the overflow is only one byte, it may not > be detected by the host's heap allocator. Do you compile your qemu with > sanitizer? Th

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-09 Thread Bin Meng
Hi, On Mon, Nov 7, 2022 at 7:08 PM Mauro Matteo Cascella wrote: > > On Mon, Nov 7, 2022 at 11:35 AM Mauro Matteo Cascella > wrote: > > > > Make sure to reset data_count if it's equal to (or exceeds) block_size. > > This prevents an off-by-one read / write when accessing s->fifo_buffer > > in sdh

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-08 Thread Mauro Matteo Cascella
On Mon, Nov 7, 2022 at 8:12 PM Philippe Mathieu-Daudé wrote: > > On 7/11/22 11:35, Mauro Matteo Cascella wrote: > > Make sure to reset data_count if it's equal to (or exceeds) block_size. > > This prevents an off-by-one read / write when accessing s->fifo_buffer > > in sdhci_read_dataport / sdhci_

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-07 Thread Philippe Mathieu-Daudé
On 7/11/22 11:35, Mauro Matteo Cascella wrote: Make sure to reset data_count if it's equal to (or exceeds) block_size. This prevents an off-by-one read / write when accessing s->fifo_buffer in sdhci_read_dataport / sdhci_write_dataport, both called right after sdhci_buff_access_is_sequential. Fi

Re: [PATCH] hw/sd/sdhci: reset data count in sdhci_buff_access_is_sequential()

2022-11-07 Thread Mauro Matteo Cascella
On Mon, Nov 7, 2022 at 11:35 AM Mauro Matteo Cascella wrote: > > Make sure to reset data_count if it's equal to (or exceeds) block_size. > This prevents an off-by-one read / write when accessing s->fifo_buffer > in sdhci_read_dataport / sdhci_write_dataport, both called right after > sdhci_buff_ac