Since malicious guest can write invalid addresses to the ADMASYSADDR register, we need to check whether the descriptor could be correctly filled or not.
Cc: [email protected] Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Signed-off-by: Philippe Mathieu-Daudé <[email protected]> --- hw/sd/sdhci.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 2d8fa3151a..6794ee2267 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -701,13 +701,18 @@ static void trace_adma_description(const char *type, const ADMADescr *dscr) static void get_adma_description(SDHCIState *s, ADMADescr *dscr) { hwaddr entry_addr = (hwaddr)s->admasysaddr; + MemTxResult res; + switch (SDHC_DMA_TYPE(s->hostctl1)) { case SDHC_CTRL_ADMA2_32: { uint64_t adma2 = 0; - dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), - MEMTXATTRS_UNSPECIFIED); + res = dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), + MEMTXATTRS_UNSPECIFIED); + if (res != MEMTX_OK) { + break; + } adma2 = le64_to_cpu(adma2); /* * The spec does not specify endianness of descriptor table. @@ -724,8 +729,11 @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr) { uint32_t adma1 = 0; - dma_memory_read(s->dma_as, entry_addr, &adma1, sizeof(adma1), - MEMTXATTRS_UNSPECIFIED); + res = dma_memory_read(s->dma_as, entry_addr, &adma1, sizeof(adma1), + MEMTXATTRS_UNSPECIFIED); + if (res != MEMTX_OK) { + break; + } adma1 = le32_to_cpu(adma1); dscr->addr = (hwaddr)(adma1 & ~0xfff); dscr->attr = (uint8_t)extract32(adma1, 0, 7); @@ -748,8 +756,11 @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr) } QEMU_PACKED adma2; QEMU_BUILD_BUG_ON(sizeof(adma2) != 12); - dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), - MEMTXATTRS_UNSPECIFIED); + res = dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), + MEMTXATTRS_UNSPECIFIED); + if (res != MEMTX_OK) { + break; + } dscr->length = le16_to_cpu(adma2.length); dscr->addr = le64_to_cpu(adma2.addr); dscr->attr = adma2.attr & (uint8_t) ~0xc0; -- 2.45.2
