ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hw/ufs: Fix mcq register range check logic 

The function ufs_is_mcq_reg() and ufs_is_mcq_op_reg() only evaluated
the range of the mcq_reg and mcq_op_reg offset, which is defined as
a constant. Therefore, it was possible for them to return true
even though the ufs device is configured to not support the mcq.
This could cause ufs_mmio_read()/ufs_mmio_write() to result in
Null-pointer-dereference.
So fix it.

Resolves: #2428
Fixes: 5c079578d2 ("hw/ufs: Add support MCQ of UFSHCI 4.0")
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
This commit is contained in:
Jeuk Kim 2024-07-09 20:53:49 +09:00
parent 37fbfda8f4
commit 50475f1511
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hw/ufs/ufs.c
View File

@ -57,14 +57,26 @@ static inline uint64_t ufs_reg_size(UfsHc *u)
static inline bool ufs_is_mcq_reg(UfsHc *u, uint64_t addr, unsigned size)
{
uint64_t mcq_reg_addr = ufs_mcq_reg_addr(u, 0);
uint64_t mcq_reg_addr;
if (!u->params.mcq) {
return false;
}
mcq_reg_addr = ufs_mcq_reg_addr(u, 0);
return (addr >= mcq_reg_addr &&
addr + size <= mcq_reg_addr + sizeof(u->mcq_reg));
}
static inline bool ufs_is_mcq_op_reg(UfsHc *u, uint64_t addr, unsigned size)
{
uint64_t mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0);
uint64_t mcq_op_reg_addr;
if (!u->params.mcq) {
return false;
}
mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0);
return (addr >= mcq_op_reg_addr &&
addr + size <= mcq_op_reg_addr + sizeof(u->mcq_op_reg));
}