diff options
author | Jeuk Kim <jeuk20.kim@samsung.com> | 2024-07-09 20:53:49 +0900 |
---|---|---|
committer | Jeuk Kim <jeuk20.kim@samsung.com> | 2024-07-14 17:11:21 +0900 |
commit | 50475f1511964775ff73c2b07239c3ff571f75cd (patch) | |
tree | 58a7d2bd4cd31aa0ba4959a006c09b1da2cb2f14 | |
parent | 37fbfda8f4145ba1700f63f0cb7be4c108d545de (diff) | |
download | qemu-50475f1511964775ff73c2b07239c3ff571f75cd.zip qemu-50475f1511964775ff73c2b07239c3ff571f75cd.tar.gz qemu-50475f1511964775ff73c2b07239c3ff571f75cd.tar.bz2 |
hw/ufs: Fix mcq register range check logic
The function ufs_is_mcq_reg() and ufs_is_mcq_op_reg() only evaluated
the range of the mcq_reg and mcq_op_reg offset, which is defined as
a constant. Therefore, it was possible for them to return true
even though the ufs device is configured to not support the mcq.
This could cause ufs_mmio_read()/ufs_mmio_write() to result in
Null-pointer-dereference.
So fix it.
Resolves: #2428
Fixes: 5c079578d2e4 ("hw/ufs: Add support MCQ of UFSHCI 4.0")
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
-rw-r--r-- | hw/ufs/ufs.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c index 683fff5..945a0ea 100644 --- a/hw/ufs/ufs.c +++ b/hw/ufs/ufs.c @@ -57,14 +57,26 @@ static inline uint64_t ufs_reg_size(UfsHc *u) static inline bool ufs_is_mcq_reg(UfsHc *u, uint64_t addr, unsigned size) { - uint64_t mcq_reg_addr = ufs_mcq_reg_addr(u, 0); + uint64_t mcq_reg_addr; + + if (!u->params.mcq) { + return false; + } + + mcq_reg_addr = ufs_mcq_reg_addr(u, 0); return (addr >= mcq_reg_addr && addr + size <= mcq_reg_addr + sizeof(u->mcq_reg)); } static inline bool ufs_is_mcq_op_reg(UfsHc *u, uint64_t addr, unsigned size) { - uint64_t mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0); + uint64_t mcq_op_reg_addr; + + if (!u->params.mcq) { + return false; + } + + mcq_op_reg_addr = ufs_mcq_op_reg_addr(u, 0); return (addr >= mcq_op_reg_addr && addr + size <= mcq_op_reg_addr + sizeof(u->mcq_op_reg)); } |