[qemu-xen staging] Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request' into staging

[patchbot@xxxxxxx]

commit 3a9163af4e3dd61795a35d47b702e302f98f81d6
Merge: c920fdba39480989cb5f1af3cc63acccef021b54 
790762e5487114341cccc5bffcec4cb3c022c3cd
Author:     Peter Maydell <peter.maydell@xxxxxxxxxx>
AuthorDate: Wed Jul 15 09:06:55 2020 +0100
Commit:     Peter Maydell <peter.maydell@xxxxxxxxxx>
CommitDate: Wed Jul 15 09:06:55 2020 +0100

    Merge remote-tracking branch 
'remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request' into staging
    
    Fix CVE-2020-13253
    
    By using invalidated address, guest can do out-of-bounds accesses.
    These patches fix the issue by only allowing SD card image sizes
    power of 2, and not switching to SEND_DATA state when the address
    is invalid (out of range).
    
    This issue was found using QEMU fuzzing mode (using --enable-fuzzing,
    see docs/devel/fuzzing.txt) and reported by Alexander Bulekov.
    
    Reproducer:
      https://bugs.launchpad.net/qemu/+bug/1880822/comments/1
    
    CI jobs results:
    . https://cirrus-ci.com/build/5157142548185088
    . https://gitlab.com/philmd/qemu/-/pipelines/166381731
    . https://travis-ci.org/github/philmd/qemu/builds/707956535
    
    # gpg: Signature made Tue 14 Jul 2020 14:54:44 BST
    # gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
    # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) 
<f4bug@xxxxxxxxx>" [full]
    # Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD 
C0DE
    
    * remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request:
      hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
      hw/sd/sdcard: Update coding style to make checkpatch.pl happy
      hw/sd/sdcard: Do not allow invalid SD card sizes
      hw/sd/sdcard: Simplify realize() a bit
      hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
      tests/acceptance/boot_linux: Expand SD card image to power of 2
      tests/acceptance/boot_linux: Tag tests using a SD card with 'device:sd'
      docs/orangepi: Add instructions for resizing SD image to power of two
      MAINTAINERS: Cc qemu-block mailing list
    
    Signed-off-by: Peter Maydell <peter.maydell@xxxxxxxxxx>

 MAINTAINERS                            |  1 +
 docs/system/arm/orangepi.rst           | 16 +++++--
 hw/sd/sd.c                             | 86 ++++++++++++++++++++++++++--------
 tests/acceptance/boot_linux_console.py | 34 ++++++++++----
 4 files changed, 106 insertions(+), 31 deletions(-)

--
generated by git-patchbot for /home/xen/git/qemu-xen.git#staging