Merge tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu into staging

* Fix stack-overflow due to recursive DMA in intel-hda (CVE-2021-3611)
* Fix heap overflow due to recursive DMA in sdhci code

# gpg: Signature made Mon 21 Mar 2022 16:14:36 GMT
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu:
  tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225)
  hw/sd/sdhci: Prohibit DMA accesses to devices
  hw/sd/sdhci: Honor failed DMA transactions
  tests/qtest/intel-hda-test: Add reproducer for issue #542
  hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices)
  hw/audio/intel-hda: Do not ignore DMA overrun errors
  softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR
  softmmu/physmem: Simplify flatview_write and address_space_access_valid

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --combined hw/audio/intel-hda.c
index 686fb94d5ca1f000da0c24980aeea197546aea18,78a47bc08c15825abdf27625b3eab424b48fd7e0..bc77e3d8c9dccc16e902e9e0328d127470f0ebe6
--- 1/hw/audio/intel-hda.c
--- 2/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@@ -345,11 -345,12 +345,12 @@@ static void intel_hda_corb_run(IntelHDA
  
  static void intel_hda_response(HDACodecDevice *dev, bool solicited, uint32_t response)
  {
-     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+     const MemTxAttrs attrs = { .memory = true };
      HDACodecBus *bus = HDA_BUS(dev->qdev.parent_bus);
      IntelHDAState *d = container_of(bus, IntelHDAState, codecs);
      hwaddr addr;
      uint32_t wp, ex;
+     MemTxResult res = MEMTX_OK;
  
      if (d->ics & ICH6_IRS_BUSY) {
          dprint(d, 2, "%s: [irr] response 0x%x, cad 0x%x\n",
@@@ -368,8 -369,12 +369,12 @@@
      ex = (solicited ? 0 : (1 << 4)) | dev->cad;
      wp = (d->rirb_wp + 1) & 0xff;
      addr = intel_hda_addr(d->rirb_lbase, d->rirb_ubase);
-     stl_le_pci_dma(&d->pci, addr + 8 * wp, response, attrs);
-     stl_le_pci_dma(&d->pci, addr + 8 * wp + 4, ex, attrs);
+     res |= stl_le_pci_dma(&d->pci, addr + 8 * wp, response, attrs);
+     res |= stl_le_pci_dma(&d->pci, addr + 8 * wp + 4, ex, attrs);
+     if (res != MEMTX_OK && (d->rirb_ctl & ICH6_RBCTL_OVERRUN_EN)) {
+         d->rirb_sts |= ICH6_RBSTS_OVERRUN;
+         intel_hda_update_irq(d);
+     }
      d->rirb_wp = wp;
  
      dprint(d, 2, "%s: [wp 0x%x] response 0x%x, extra 0x%x\n",
@@@ -473,7 -478,7 +478,7 @@@ static void intel_hda_parse_bdl(IntelHD
      addr = intel_hda_addr(st->bdlp_lbase, st->bdlp_ubase);
      st->bentries = st->lvi +1;
      g_free(st->bpl);
 -    st->bpl = g_malloc(sizeof(bpl) * st->bentries);
 +    st->bpl = g_new(bpl, st->bentries);
      for (i = 0; i < st->bentries; i++, addr += 16) {
          pci_dma_read(&d->pci, addr, buf, 16);
          st->bpl[i].addr  = le64_to_cpu(*(uint64_t *)buf);