| Message ID | 1613447214-81951-5-git-send-email-bmeng.cn@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 | expand |
On 210216 1146, Bin Meng wrote: > s->prnsts is updated in both branches of the if () else () statement. > Move the common bits outside so that it is cleaner. > > Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> > --- > > (no changes since v1) > > hw/sd/sdhci.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > > diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c > index 0b0ca6f..7a2003b 100644 > --- a/hw/sd/sdhci.c > +++ b/hw/sd/sdhci.c > @@ -598,9 +598,9 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) > page_aligned = true; > } > > + s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE; > if (s->trnmod & SDHC_TRNS_READ) { > - s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT | > - SDHC_DAT_LINE_ACTIVE; > + s->prnsts |= SDHC_DOING_READ; > while (s->blkcnt) { > if (s->data_count == 0) { > sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size); > @@ -627,8 +627,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) > } > } > } else { > - s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT | > - SDHC_DAT_LINE_ACTIVE; > + s->prnsts |= SDHC_DOING_WRITE; > while (s->blkcnt) { > begin = s->data_count; > if (((boundary_count + begin) < block_size) && page_aligned) { > -- > 2.7.4 >
On 2/16/21 4:46 AM, Bin Meng wrote: > s->prnsts is updated in both branches of the if () else () statement. > Move the common bits outside so that it is cleaner. > > Signed-off-by: Bin Meng <bmeng.cn@gmail.com> > --- > > (no changes since v1) > > hw/sd/sdhci.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
On 2/16/21 4:46 AM, Bin Meng wrote: > s->prnsts is updated in both branches of the if () else () statement. > Move the common bits outside so that it is cleaner. > > Signed-off-by: Bin Meng <bmeng.cn@gmail.com> > --- > > (no changes since v1) > > hw/sd/sdhci.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) As there are some questions in this series and it makes sense to merge all patches at once to help downstream distributions track the CVE fixes, I'm queuing this single patch to sdmmc-next tree. Thanks, Phil.
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 0b0ca6f..7a2003b 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -598,9 +598,9 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) page_aligned = true; } + s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE; if (s->trnmod & SDHC_TRNS_READ) { - s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT | - SDHC_DAT_LINE_ACTIVE; + s->prnsts |= SDHC_DOING_READ; while (s->blkcnt) { if (s->data_count == 0) { sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size); @@ -627,8 +627,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) } } } else { - s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT | - SDHC_DAT_LINE_ACTIVE; + s->prnsts |= SDHC_DOING_WRITE; while (s->blkcnt) { begin = s->data_count; if (((boundary_count + begin) < block_size) && page_aligned) {
s->prnsts is updated in both branches of the if () else () statement. Move the common bits outside so that it is cleaner. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> --- (no changes since v1) hw/sd/sdhci.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)