Re: [PATCH-for-9.0? 3/3] hw/block/nand: Fix out-of-bound access in NAND block buffer

[Philippe Mathieu-Daudé]

On 8/4/24 18:39, Richard Henderson wrote:
> On 4/7/24 22:36, Philippe Mathieu-Daudé wrote:
> > nand_command() and nand_getio() don't check @offset points
> > into the block, nor the available data length (s->iolen) is
> > not negative.
> >
> > In order to fix:
> >
> > - check the offset is in range in nand_blk_load_NAND_PAGE_SIZE(),
> > - do not set @iolen if blk_load() failed.
>
> Do not set, or do not set to non-zero?  I had been wondering if the 

Oh, "do not set to non-zero", thanks :)

> final assignment to s->iolen should go into nand_load_block as well...

For the next tag I rather keep it this way which seems more
explicit to me.

> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Thanks!