qemu-block
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH-for-9.0? 3/3] hw/block/nand: Fix out-of-bound access in NAND


From: Philippe Mathieu-Daudé
Subject: Re: [PATCH-for-9.0? 3/3] hw/block/nand: Fix out-of-bound access in NAND block buffer
Date: Tue, 9 Apr 2024 00:05:16 +0200
User-agent: Mozilla Thunderbird

On 8/4/24 18:39, Richard Henderson wrote:
On 4/7/24 22:36, Philippe Mathieu-Daudé wrote:
nand_command() and nand_getio() don't check @offset points
into the block, nor the available data length (s->iolen) is
not negative.

In order to fix:

- check the offset is in range in nand_blk_load_NAND_PAGE_SIZE(),
- do not set @iolen if blk_load() failed.

Do not set, or do not set to non-zero?  I had been wondering if the

Oh, "do not set to non-zero", thanks :)

final assignment to s->iolen should go into nand_load_block as well...

For the next tag I rather keep it this way which seems more
explicit to me.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Thanks!




reply via email to

[Prev in Thread] Current Thread [Next in Thread]