ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
xemu/hw
History
Bin Meng 8be45cc947 hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress 
Per "SD Host Controller Standard Specification Version 7.00"
chapter 2.2.1 SDMA System Address Register:

This register can be accessed only if no transaction is executing
(i.e., after a transaction has stopped).

With this fix, the following reproducer:

outl 0xcf8 0x80001010
outl 0xcfc 0xfbefff00
outl 0xcf8 0x80001001
outl 0xcfc 0x06000000
write 0xfbefff2c 0x1 0x05
write 0xfbefff0f 0x1 0x37
write 0xfbefff0a 0x1 0x01
write 0xfbefff0f 0x1 0x29
write 0xfbefff0f 0x1 0x02
write 0xfbefff0f 0x1 0x03
write 0xfbefff04 0x1 0x01
write 0xfbefff05 0x1 0x01
write 0xfbefff07 0x1 0x02
write 0xfbefff0c 0x1 0x33
write 0xfbefff0e 0x1 0x20
write 0xfbefff0f 0x1 0x00
write 0xfbefff2a 0x1 0x01
write 0xfbefff0c 0x1 0x00
write 0xfbefff03 0x1 0x00
write 0xfbefff05 0x1 0x00
write 0xfbefff2a 0x1 0x02
write 0xfbefff0c 0x1 0x32
write 0xfbefff01 0x1 0x01
write 0xfbefff02 0x1 0x01
write 0xfbefff03 0x1 0x01

cannot be reproduced with the following QEMU command line:

$ qemu-system-x86_64 -nographic -machine accel=qtest -m 512M \
       -nodefaults -device sdhci-pci,sd-spec-version=3 \
       -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive \
       -device sd-card,drive=mydrive -qtest stdio

Cc: qemu-stable@nongnu.org
Fixes: CVE-2020-17380
Fixes: CVE-2020-25085
Fixes: CVE-2021-3409
Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cornelius Aschermann (Ruhr-Universität Bochum)
Reported-by: Sergej Schumilo (Ruhr-Universität Bochum)
Reported-by: Simon Wörner (Ruhr-Universität Bochum)
Buglink: https://bugs.launchpad.net/qemu/+bug/1892960
Buglink: https://bugs.launchpad.net/qemu/+bug/1909418
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1928146
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20210303122639.20004-3-bmeng.cn@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 		2021-03-22 16:56:07 +01:00
..
9pfs hw/9pfs/9p-synth: Replaced qemu_mutex_lock with QEMU_LOCK_GUARD 2021-03-16 11:41:49 +01:00
acpi acpi/core: always set SCI_EN when SMM isn't supported 2021-02-23 10:58:42 -05:00
adc clock: Add ClockEvent parameter to callbacks 2021-03-08 17:20:01 +00:00
alpha vl: extract softmmu/datadir.c 2020-12-10 12:15:18 -05:00
arm hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
audio hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
avr hw/avr/arduino: List board schematic links 2021-03-15 00:39:52 +01:00
block hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
char hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
core Remove many old deprecated features 2021-03-18 19:00:50 +00:00
cpu cpu/core: Register core-id and nr-threads as class properties 2020-09-22 16:48:29 -04:00
cris hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
display hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
dma target-arm queue: 2021-03-10 13:57:31 +00:00
gpio hw: gpio: implement gpio-pwr driver for qemu reset/poweroff 2021-01-29 10:47:28 +00:00
hppa hw: Use the PCI_SLOT() macro from 'hw/pci/pci.h' 2021-01-04 23:24:44 +01:00
hyperv qdev: Move softmmu properties to qdev-properties-system.h 2020-12-18 15:20:17 -05:00
i2c hw/i2c/npcm7xx_smbus: Simplify npcm7xx_smbus_init() 2021-03-05 15:17:34 +00:00
i386 hw/scsi: remove 'scsi-disk' device 2021-03-18 09:22:55 +00:00
ide hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
input Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
intc * fixes for i386 TCG paging 2021-03-19 18:01:17 +00:00
ipack Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ipmi Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
isa hw/southbridge: Add missing Kconfig dependency VT82C686 on USB_UHCI 2021-03-15 17:00:59 +01:00
lm32 hw/lm32/Kconfig: Have MILKYMIST select LM32_DEVICES 2021-03-09 22:37:08 +01:00
m68k m68k: add Virtual M68k Machine 2021-03-15 21:03:06 +01:00
mem memory: add a sparse memory device for fuzzing 2021-03-16 14:30:30 -04:00
microblaze hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
mips hw/mips/gt64xxx: Trace accesses to ISD registers 2021-03-13 20:29:36 +01:00
misc hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
moxie moxie: do not use ram_size global 2020-12-10 12:15:08 -05:00
net hw/net: virtio-net: Initialize nc->do_not_pad to true 2021-03-22 17:34:31 +08:00
nios2 * New -action option and set-action QMP command (Alejandro) 2020-12-15 21:24:31 +00:00
nubus meson: convert hw/nubus 2020-08-21 06:30:25 -04:00
nvram sysemu: Let VMChangeStateHandler take boolean 'running' argument 2021-03-09 23:13:57 +01:00
openrisc target/openrisc: Move pic_cpu code into CPU object proper 2020-12-15 12:04:30 +00:00
pci hw/pci: Have safer pcie_bus_realize() by checking error path 2021-03-02 09:16:18 -05:00
pci-bridge Kconfig: Compile PXB for ARM_VIRT 2021-01-17 06:42:54 -05:00
pci-host hw/pci-host: Introduce SH_PCI Kconfig entry 2021-03-06 16:18:42 +01:00
pcmcia pxa2xx: Move QOM macros to header 2020-08-27 14:04:55 -04:00
ppc hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
rdma pvrdma: wean code off pvrdma_ring.h kernel header 2021-03-15 16:41:22 +08:00
remote multi-process: perform device reset in the remote process 2021-02-10 09:23:28 +00:00
riscv Testing, guest-loader and other misc tweaks 2021-03-11 16:20:58 +00:00
rtc goldfish_rtc: re-arm the alarm after migration 2021-03-04 09:43:29 -05:00
rx qtest: delete superfluous inclusions of qtest.h 2021-03-09 06:03:53 +01:00
s390x s390x/pci: Add missing initialization for g_autofree variables 2021-03-15 15:47:18 +01:00
scsi hw/scsi: remove 'scsi-disk' device 2021-03-18 09:22:55 +00:00
sd hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress 2021-03-22 16:56:07 +01:00
sh4 hw/sh4/sh7750_regs: Replace link to license by its full content 2021-03-06 16:19:03 +01:00
smbios i386: do not use ram_size global 2020-12-10 12:15:08 -05:00
sparc hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
sparc64 hw/ide: remove 'ide-drive' device 2021-03-18 09:22:55 +00:00
ssi hw/ssi: xilinx_spips: Remove DMA related dead codes from zynqmp_spips 2021-03-10 13:54:51 +00:00
timer hw: Replace anti-social QOM type names 2021-03-19 15:18:43 +01:00
tpm tpm: put some tpm devices into the correct category 2021-02-20 12:36:19 +01:00
tricore tricore: added triboard with tc27x_soc 2021-03-14 14:41:55 +01:00
unicore32 meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
usb usb/storage: clear csw on reset 2021-03-15 17:01:17 +01:00
vfio vfio/migrate: Move switch of dirty tracking into vfio_memory_listener 2021-03-16 10:06:44 -06:00
virtio virtio-net: calculating proper msix vectors on init 2021-03-15 16:41:22 +08:00
watchdog clock: Add ClockEvent parameter to callbacks 2021-03-08 17:20:01 +00:00
xen pci: add romsize property 2021-02-05 08:52:58 -05:00
xenpv meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
xtensa vl: make qemu_get_machine_opts static 2020-12-15 12:51:55 -05:00
Kconfig semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00
meson.build semihosting: Move hw/semihosting/ -> semihosting/ 2021-03-10 15:34:12 +00:00