hw/ufs: Fix buffer overflow bug
authorJeuk Kim <jeuk20.kim@samsung.com>
Mon, 5 Feb 2024 03:20:15 +0000 (12:20 +0900)
committerJeuk Kim <jeuk20.kim@samsung.com>
Mon, 29 Apr 2024 03:13:35 +0000 (12:13 +0900)
commitf2c8aeb1afefcda92054c448b21fc59cdd99db30
treec2f6ffb7b1e5b311f5761da54b50694dd0681844
parentfd87be1dada5672f877e03c2ca8504458292c479
hw/ufs: Fix buffer overflow bug

It fixes the buffer overflow vulnerability in the ufs device.
The bug was detected by sanitizers.

You can reproduce it by:

cat << EOF |\
qemu-system-x86_64 \
-display none -machine accel=qtest -m 512M -M q35 -nodefaults -drive \
file=null-co://,if=none,id=disk0 -device ufs,id=ufs_bus -device \
ufs-lu,drive=disk0,bus=ufs_bus -qtest stdio
outl 0xcf8 0x80000810
outl 0xcfc 0xe0000000
outl 0xcf8 0x80000804
outw 0xcfc 0x06
write 0xe0000058 0x1 0xa7
write 0xa 0x1 0x50
EOF

Resolves: #2299
Fixes: 329f16624499 ("hw/ufs: Support for Query Transfer Requests")
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
hw/ufs/ufs.c