From c01ae9a35b3c6b4a8e1f1bfa0a0caafe394f8b5c Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Tue, 16 Feb 2021 11:46:52 +0800 Subject: [PATCH 1/6] hw/sd: sdhci: Simplify updating s->prnsts in sdhci_sdma_transfer_multi_blocks() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit s->prnsts is updated in both branches of the if () else () statement. Move the common bits outside so that it is cleaner. Signed-off-by: Bin Meng Tested-by: Alexander Bulekov Reviewed-by: Alexander Bulekov Reviewed-by: Philippe Mathieu-Daudé Message-Id: <1613447214-81951-5-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Philippe Mathieu-Daudé Upstream-Status: Backport [8bc1f1aa51d32c3184e7b19d5b94c35ecc06f056] CVE: CVE-2021-3409 Signed-off-by: Sakib Sajal --- hw/sd/sdhci.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 2f8b74a84..f83c5e295 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -596,9 +596,9 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) page_aligned = true; } + s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE; if (s->trnmod & SDHC_TRNS_READ) { - s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT | - SDHC_DAT_LINE_ACTIVE; + s->prnsts |= SDHC_DOING_READ; while (s->blkcnt) { if (s->data_count == 0) { sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size); @@ -625,8 +625,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) } } } else { - s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT | - SDHC_DAT_LINE_ACTIVE; + s->prnsts |= SDHC_DOING_WRITE; while (s->blkcnt) { begin = s->data_count; if (((boundary_count + begin) < block_size) && page_aligned) { -- 2.29.2