From 1bd6fd8ed5933bfba53e5f5eadebd845094c3707 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 13 Sep 2020 13:18:52 +0200 Subject: [PATCH] hw/sd/sdcard: Do not attempt to erase out of range addresses MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit While the Spec v3 is not very clear, v6 states: If the host provides an out of range address as an argument to CMD32 or CMD33, the card shall indicate OUT_OF_RANGE error in R1 (ERX) for CMD38. If an address is out of range, do not attempt to erase it: return R1 with the error bit set. Buglink: https://bugs.launchpad.net/qemu/+bug/1895310 Reported-by: Alexander Bulekov Signed-off-by: Philippe Mathieu-Daudé Tested-by: Alexander Bulekov Message-Id: <20201015063824.212980-6-f4bug@amsat.org> --- hw/sd/sd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index ee7b64023a..4454d168e2 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -766,6 +766,13 @@ static void sd_erase(SDState *sd) erase_end *= 512; } + if (sd->erase_start > sd->size || sd->erase_end > sd->size) { + sd->card_status |= OUT_OF_RANGE; + sd->erase_start = INVALID_ADDRESS; + sd->erase_end = INVALID_ADDRESS; + return; + } + erase_start = sd_addr_to_wpnum(erase_start); erase_end = sd_addr_to_wpnum(erase_end); sd->erase_start = INVALID_ADDRESS; -- 2.11.4.GIT