summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Migrate CUSTOM_SYS_INIT_SP_ADDR to Kconfig using system-constants.hTom Rini2022-06-06895-1027/+1185
| | | | | | | | | | | | | | - Make all users of CUSTOM_SYS_INIT_SP_ADDR reference SYS_INIT_SP_ADDR - Introduce HAS_CUSTOM_SYS_INIT_SP_ADDR to allow for setting the stack pointer directly, otherwise we use the common calculation. - On some platforms that were using the standard calculation but did not set CONFIG_SYS_INIT_RAM_SIZE / CONFIG_SYS_INIT_RAM_ADDR, set them. - On a small number of platforms that were not subtracting GENERATED_GBL_DATA_SIZE do so now via the standard calculation. - CONFIG_SYS_INIT_SP_OFFSET is now widely unused, so remove it from most board config header files. Signed-off-by: Tom Rini <trini@konsulko.com>
* Introduce include/system-constants.hTom Rini2022-06-061-0/+6
| | | | | | | | | | | | | We have a number of CONFIG symbols today that are of the form: SYM1 = CONST1 + CONST2 or other static math operations (shifts, etc). The issue is that by moving these to Kconfig we no longer have the ability to calculate these values, so they become less flexible and useful. It's also the case that sometimes a platform will just define SYM1 directly or perform a slightly different set of calculations. We introduce this header now to have a place to start to handle these cases. Signed-off-by: Tom Rini <trini@konsulko.com>
* stih410-b2260: Switch to using GENERATED_GBL_DATA_SIZETom Rini2022-06-061-2/+1
| | | | | | | We have GENERATED_GBL_DATA_SIZE to tell us how large the generated global data is, so do not use a hard-coded value of 1024 for it. Signed-off-by: Tom Rini <trini@konsulko.com>
* powerpc: Switch to using CONFIG_SYS_INIT_SP_OFFSET from ↵Tom Rini2022-06-0623-71/+41
| | | | | | | | | | | | | | CONFIG_SYS_GBL_DATA_OFFSET In the places where PowerPC references CONFIG_SYS_GBL_DATA_OFFSET it does so as (CONFIG_SYS_INIT_RAM_ADDR + CONFIG_SYS_GBL_DATA_OFFSET). And it defines CONFIG_SYS_GBL_DATA_OFFSET in the same manner that other architectures define CONFIG_SYS_INIT_SP_OFFSET. Other architectures define CONFIG_SYS_INIT_SP_ADDR as (CONFIG_SYS_INIT_RAM_ADDR + CONFIG_SYS_INIT_SP_OFFSET) typically. Rename things within PowerPC for consistency with other architectures. Signed-off-by: Tom Rini <trini@konsulko.com>
* mpc85xx: Switch to setting the initial stack pointer more clearlyTom Rini2022-06-061-2/+2
| | | | | | | | | | | Currently, since we know that in the combination of CONFIG_SYS_INIT_RAM_ADDR + CONFIG_SYS_GBL_DATA_OFFSET all of the "high" bits are in CONFIG_SYS_INIT_RAM_ADDR and "low" bits are in CONFIG_SYS_GBL_DATA_OFFSET we reference this separately in start.S, but added together everywhere else. For clarity consistency, reference the combined value here instead. Signed-off-by: Tom Rini <trini@konsulko.com>
* m68k: Stop using CONFIG_SYS_GBL_DATA_OFFSETTom Rini2022-06-0615-30/+15
| | | | | | | | This value is only referenced by PowerPC code in a way other than directly as CONFIG_SYS_INIT_SP_ADDR. Switch to CONFIG_SYS_INIT_SP_ADDR directly. Signed-off-by: Tom Rini <trini@konsulko.com>
* arm: Stop using CONFIG_SYS_GBL_DATA_OFFSETTom Rini2022-06-062-4/+2
| | | | | | | | This value is only referenced by PowerPC code in a way other than directly as CONFIG_SYS_INIT_SP_ADDR. Switch to CONFIG_SYS_INIT_SP_ADDR directly. Signed-off-by: Tom Rini <trini@konsulko.com>
* arm: Use CONFIG_SPL_STACK or CONFIG_SYS_INIT_SP_ADDR directly.Tom Rini2022-06-0615-66/+14
| | | | | | | | | | In some cases, we define CONFIG_SYS_INIT_SP_ADDR differently for SPL or full U-Boot. This case should be making use of CONFIG_SPL_STACK, as that's what that variable is for. In a few other cases we define CONFIG_SPL_STACK directly to CONFIG_SYS_INIT_SP_ADDR, but do not need to as the code handles this correctly, normally. Signed-off-by: Tom Rini <trini@konsulko.com>
* mvebu: Use CONFIG_SPL_STACK + 4 directly for bootparam locationTom Rini2022-06-0614-17/+5
| | | | | | | | | | The definition of CONFIG_SPL_BOOTROM_SAVE is always a fixed CONFIG_SPL_STACK + 4, while CONFIG_SPL_STACK is not constant. This change will make it clear where the location is still, once CONFIG_SPL_STACK moves to Kconfig. Cc: Stefan Roese <sr@denx.de> Signed-off-by: Tom Rini <trini@konsulko.com>
* arm: pxa: Remove CONFIG_CPU_PXA25XTom Rini2022-06-0613-2492/+6
| | | | | | There are no platforms that set this, remove the code. Signed-off-by: Tom Rini <trini@konsulko.com>
* m68k: Remove dead codeTom Rini2022-06-068-932/+0
| | | | | | There are no mcf5227x platforms, remove the CPU code. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_COMMON_INIT_DDR to KconfigTom Rini2022-06-0647-28/+61
| | | | | | | This converts the following to Kconfig: CONFIG_SPL_COMMON_INIT_DDR Signed-off-by: Tom Rini <trini@konsulko.com>
* ppc / layerscape: Clean up CONFIG_SYS_CCSR_DO_NOT_RELOCATE usageTom Rini2022-06-0664-69/+65
| | | | | | | | | | A number of PowerPC platforms define this, for SPL. To move this to Kconfig, it needs to be CONFIG_SPL_SYS_CCSR_DO_NOT_RELOCATE, so use CONFIG_IS_ENABLED() to check for usage. A number of layerscape platforms bring this logic from PowerPC, but only need a small part of it, for the fman driver. Remove their unused portion at least. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_SYS_MALLOC_SIMPLE to KconfigTom Rini2022-06-0623-48/+14
| | | | | | | | | | | | | | | This converts the following to Kconfig: CONFIG_SPL_SYS_MALLOC_SIMPLE The problem here is that a few platforms have been doing: #ifdef CONFIG_SPL_BUILD #define CONFIG_SYS_MALLOC_SIMPLE #endif instead of defining CONFIG_SPL_SYS_MALLOC_SIMPLE directly. Correct this and update the documentation in a few places to match usage. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_BSS_MAX_SIZE et al to KconfigTom Rini2022-06-06445-182/+407
| | | | | | | | | | | This converts the following to Kconfig: CONFIG_SPL_BSS_MAX_SIZE CONFIG_SPL_MAX_FOOTPRINT Note that the da850evm platforms were violating the "only use one" rule here, and so now hard-code their BSS limit. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_PAD_TO et al to KconfigTom Rini2022-06-06536-281/+561
| | | | | | | | | | | | | This converts the following to Kconfig: CONFIG_SPL_PAD_TO CONFIG_SPL_MAX_SIZE CONFIG_TPL_PAD_TO CONFIG_TPL_MAX_SIZE Note that we need to make TPL_MAX_SIZE be hex, and so move and convert the existing places. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_FS_LOAD_PAYLOAD_NAME et al to KconfigTom Rini2022-06-0685-174/+68
| | | | | | | | | This converts the following to Kconfig: CONFIG_SPL_FS_LOAD_ARGS_NAME CONFIG_SPL_FS_LOAD_KERNEL_NAME CONFIG_SPL_FS_LOAD_PAYLOAD_NAME Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_NAND_RAW_ONLY et al to KconfigTom Rini2022-06-0615-19/+22
| | | | | | | | This converts the following to Kconfig: CONFIG_SPL_NAND_RAW_ONLY CONFIG_SPL_NAND_SOFTECC Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SPL_INIT_MINIMAL et al to KconfigTom Rini2022-06-0674-36/+115
| | | | | | | | | This converts the following to Kconfig: CONFIG_SPL_INIT_MINIMAL CONFIG_SPL_FLUSH_IMAGE CONFIG_SPL_SKIP_RELOCATE Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_CFI_FLASH_STATUS_POLL to KconfigTom Rini2022-06-0612-5/+13
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_CFI_FLASH_STATUS_POLL Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_FLASH_CFI_WIDTH to KconfigTom Rini2022-06-0664-41/+63
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_FLASH_CFI_WIDTH Signed-off-by: Tom Rini <trini@konsulko.com>
* spl: Remove CONFIG_SPL_SATA_BOOT_DEVICETom Rini2022-06-062-16/+5
| | | | | | | | This is only referenced in non-SPL_DM cases, of which there are currently none. Remove this option and slightly re-organize the code is there is now never an if/else at the start of spl_sata_load_image() Signed-off-by: Tom Rini <trini@konsulko.com>
* fsl-layerscape: Remove CONFIG_SPL_PBL_PADTom Rini2022-06-062-3/+0
| | | | | | This option is not referenced in code, remove it. Signed-off-by: Tom Rini <trini@konsulko.com>
* P1010RDB: Remove CONFIG_SPL_NAND_MINIMALTom Rini2022-06-061-1/+0
| | | | | | This symbol is not used anywhere, remove it. Signed-off-by: Tom Rini <trini@konsulko.com>
* spl: Remove CONFIG_SPL_BOARD_LOAD_IMAGETom Rini2022-06-064-8/+0
| | | | | | | This symbol has been unused in code for some time now, remove the final references. Signed-off-by: Tom Rini <trini@konsulko.com>
* arm: omap2plus: Move CONFIG_SYS_PTV out of CONFIG namespaceTom Rini2022-06-0613-15/+8
| | | | | | | | | This is always defined to 2, and referenced in two places. Move the define to <asm/omap_common.h> and make sure the code that uses this includes that file. Make <asm/arch-omap*/clock.h> not include that file, as we don't need to be doing so. Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_BOOTPARAMS_LEN to KconfigTom Rini2022-06-0688-55/+71
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_BOOTPARAMS_LEN Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_HUSH_INIT_VAR to KconfigTom Rini2022-06-063-3/+3
| | | | | | | This converts the following to Kconfig: CONFIG_HUSH_INIT_VAR Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_BARGSIZE to KconfigTom Rini2022-06-0687-172/+21
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_BARGSIZE Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_CBSIZE to KconfigTom Rini2022-06-06492-291/+346
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_CBSIZE Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_PBSIZE to KconfigTom Rini2022-06-061035-113/+981
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_PBSIZE Signed-off-by: Tom Rini <trini@konsulko.com>
* Convert CONFIG_SYS_MAXARGS to KconfigTom Rini2022-06-06674-162/+562
| | | | | | | This converts the following to Kconfig: CONFIG_SYS_MAXARGS Signed-off-by: Tom Rini <trini@konsulko.com>
* Prepare v2022.07-rc4v2022.07-rc4Tom Rini2022-06-061-1/+1
| | | | Signed-off-by: Tom Rini <trini@konsulko.com>
* configs: fsl: add missing SYS_FMAN_FW_ADDR definesCamelia Groza2022-06-062-0/+2
| | | | | | | | | | | Two defconfigs were missed when transitioning the SYS_FMAN_FW_ADDR symbol to Kconfig. CONFIG_SYS_FMAN_FW_ADDR is currently initialized to 0 by default on these builds, which prevents the firmware from loading. Add the correct symbols to these defconfigs. Fixes: a97a071d10d2b ("configs: fsl: migrate FMAN/QE specific defines to Kconfig") Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
* doc: update mail author for st-dt.rstPatrick Delaunay2022-06-061-1/+1
| | | | | | | Update author email address with the one dedicated to upstream activities. Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
* Merge tag 'efi-2022-07-rc4-4' of ↵Tom Rini2022-06-046-58/+362
|\ | | | | | | | | | | | | | | | | | | | | https://source.denx.de/u-boot/custodians/u-boot-efi Pull request for efi-2022-07-rc4-4 UEFI: * Fix the implementation of the firmware management protocol * Fix the unit tests for signed update capsules
| * efi: test/py: authenticate fit capsulesVincent Stehlé2022-06-044-48/+353
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the authentication of UEFI capsules containing FIT images. The authentication code is moved out of the function handling raw images into a new function efi_firmware_capsule_authenticate(). The special case for the FMP header coming from edk2 tools is preserved. There is no functional change for capsules containing raw images. The python test for signed capsules with raw images is renamed with no functional change and a new test is added for signed capsules containing FIT images. This can be tested with sandbox64_defconfig or sandbox_flattree_defconfig, plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y. Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
| * test/py: efi_capsule: repair image authentication testVincent Stehlé2022-06-042-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Repair the python tests for authenticated EFI capsules, which can be run with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y. - Account for the reset changes done by commit 3e6f81000672 ("efi_loader: test/py: Reset system after capsule update on disk"). - Fix the capsule GUID typo introduced by commit 2e9c3c6965ba ("test: capsule: Modify the capsule tests to use GUID values for sandbox"). Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
| * EFI: Update the documentation to reflect the correct value of OsIndicationsSughosh Ganu2022-06-041-1/+1
| | | | | | | | | | | | | | | | | | The OsIndications is a 64 bit variable, and the current code expects the value of the variable to be 64 bit. Update the documentation to reflect this fact. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
| * EFI: Populate descriptor_count value only when image_info_size is not zeroSughosh Ganu2022-06-041-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | The GetImageInfo function of the Firmware Mangement Protocol(FMP) gets called initially to query the size of the image descriptor array that would have to be allocated. During this call, the rest of the function arguments, specifically pointers might be passed as NULL. Do not populate the descriptor_count value before it is known that the call to GetImageInfo has been made with the allocated buffer for the image descriptors. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
| * doc: environment: Fix typoChris Packham2022-06-041-1/+1
|/ | | | | | | | "valu" should be "value". Signed-off-by: Chris Packham <judge.packham@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
* Merge branch '2022-06-03-assorted-fixes'Tom Rini2022-06-0311-8/+28
|\ | | | | | | | | | | - armv8 TCR write bugfix, ubifs bugfix, imx8mq clk bugfixes, two network fixes, Add U-Boot version to chosen node, update TI AM64x board maintainers
| * board: ti: am64x: Update MAINTAINERSDave Gerlach2022-06-031-1/+1
| | | | | | | | | | | | Move maintainership of TI AM64x boards to Vignesh. Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
| * squashfs: Fix compilation on big endian systemsPali Rohár2022-06-032-4/+2
| | | | | | | | | | Signed-off-by: Pali Rohár <pali@kernel.org> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
| * imx: imx8mq: select CONFIG_CMD_CLKPeng Fan2022-06-031-0/+1
| | | | | | | | | | | | select CONFIG_CMD_CLK to enable dump clk in uboot shell Signed-off-by: Peng Fan <peng.fan@nxp.com>
| * imx: imx8mq: default select CLK_IMX8MQPeng Fan2022-06-031-0/+1
| | | | | | | | | | | | | | | | Since the power domain driver default select CONFIG_CLK, so we will meet lots failures without CLK_IMX8MQ, so default select it. Fixes: commit 4eb82c2e56a7c ("imx: power-domain: Get rid of SMCCC dependency") Signed-off-by: Peng Fan <peng.fan@nxp.com>
| * fdt: Add U-Boot version to chosen nodeFrancesco Dolcini2022-06-031-0/+10
| | | | | | | | | | | | | | | | | | | | Add a new device tree property "u-boot,version" in the chosen node to pass the U-Boot version to the operating system. This can be useful to implement a firmware upgrade procedure from the operating system. Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Reviewed-by: Tom Rini <trini@konsulko.com>
| * net: Check for the minimum IP fragmented datagram sizeFabio Estevam2022-06-032-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Nicolas Bidron and Nicolas Guigo reported the two bugs below: " ----------BUG 1---------- In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of `ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE` and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len` comprised between `0` and `7`. This will ultimately result in a truncated division by `8` resulting value of `0` forcing the hole metadata and fragment to point to the same location. The subsequent memcopy will overwrite the hole metadata with the fragment data. Through a second fragment, this can be exploited to write to an arbitrary offset controlled by that overwritten hole metadata value. This bug is only exploitable locally as it requires crafting two packets the first of which would most likely be dropped through routing due to its unexpectedly low Total Length. However, this bug can potentially be exploited to root linux based embedded devices locally. ```C static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) { static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN); static u16 first_hole, total_len; struct hole *payload, *thisfrag, *h, *newh; struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff; uchar *indata = (uchar *)ip; int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS); thisfrag = payload + offset8; start = offset8 * 8; len = ntohs(ip->ip_len) - IP_HDR_SIZE; ``` The last line of the previous excerpt from `u-boot/net/net.c` shows how the attacker can control the value of `len` to be strictly lower than `8` by issuing a packet with `ip_len` between `21` and `27` (`IP_HDR_SIZE` has a value of `20`). Also note that `offset8` here is `0` which leads to `thisfrag = payload`. ```C } else if (h >= thisfrag) { /* overlaps with initial part of the hole: move this hole */ newh = thisfrag + (len / 8); *newh = *h; h = newh; if (h->next_hole) payload[h->next_hole].prev_hole = (h - payload); if (h->prev_hole) payload[h->prev_hole].next_hole = (h - payload); else first_hole = (h - payload); } else { ``` Lower down the same function, execution reaches the above code path. Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note that `first_hole` here is `0` since `h` and `payload` point to the same location. ```C /* finally copy this fragment and possibly return whole packet */ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len); ``` Finally, in the above excerpt the `memcpy` overwrites the hole metadata since `thisfrag` and `h` both point to the same location. The hole metadata is effectively overwritten with arbitrary data from the fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`, `next_hole`, and `prev_hole` of the `first_hole` can be controlled by the attacker. Finally the arbitrary offset write occurs through a second fragment that only needs to be crafted to write data in the hole pointed to by the previously controlled hole metadata (`next_hole`) from the first packet. ### Recommendation Handle cases where `len` is strictly lower than 8 by preventing the overwrite of the hole metadata during the memcpy of the fragment. This could be achieved by either: * Moving the location where the hole metadata is stored when `len` is lower than `8`. * Or outright rejecting fragmented IP datagram with a Total Length (`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP datagram size (as defined as the minimum fragment of 8 octets in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25). ----------BUG 2---------- In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of `ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE` will lead to a negative value for `len` which will ultimately result in a buffer overflow during the subsequent `memcpy` that uses `len` as it's `count` parameter. This bug is only exploitable on local ethernet as it requires crafting an invalid packet to include an unexpected `ip_len` value in the IP UDP header that's lower than the minimum accepted Total Length of a packet (21 as defined in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet would in all likelihood be dropped while being routed to its final destination through most routing equipment and as such requires the attacker to be in a local position in order to be exploited. ```C static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp) { static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN); static u16 first_hole, total_len; struct hole *payload, *thisfrag, *h, *newh; struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff; uchar *indata = (uchar *)ip; int offset8, start, len, done = 0; u16 ip_off = ntohs(ip->ip_off); /* payload starts after IP header, this fragment is in there */ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE); offset8 = (ip_off & IP_OFFS); thisfrag = payload + offset8; start = offset8 * 8; len = ntohs(ip->ip_len) - IP_HDR_SIZE; ``` The last line of the previous excerpt from `u-boot/net/net.c` shows where the underflow to a negative `len` value occurs if `ip_len` is set to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note that in the above excerpt the `pkt_buff` buffer has a size of `CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to 64 KB depending on configurations. ```C /* finally copy this fragment and possibly return whole packet */ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len); ``` In the above excerpt the `memcpy` overflows the destination by attempting to make a copy of nearly 4 gigabytes in a buffer that's designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS. ### Recommendation Stop processing of the packet if `ip_len` is lower than 21 (as defined by the minimum length of a data carrying datagram in the IP Specification Document: [RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)." Add a check for ip_len lesser than 28 and stop processing the packet in this case. Such a check covers the two reported bugs. Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com> Signed-off-by: Fabio Estevam <festevam@denx.de>
| * armv8: Fix TCR 64-bit writesAndre Przywara2022-06-031-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The AArch64 TCR_ELx register is a 64-bit register, and many newer architecture features use bits in the upper half. So far U-Boot was igorant of those bits, trying to leave them alone. However, in an effort to set bit 31 to 1, it failed doing so, because the compiler sign-extended "1 << 31", so that all bits[63:31] got set. Older ARMv8.0 cores don't define anything dangerous up there, but newer architecture revisions do, and setting all those bits will end badly: ================= $ qemu-system-aarch64 -cpu max .... U-Boot 2022.07-rc1 (May 09 2022 - 15:21:00 +0100) DRAM: 1.5 GiB ================= (hangs here) Defining TCR_ELx_RSVD to "1U << 31" avoids the sign-extension, so all upper bits stay at a safe 0 value. This means no more surprises when U-Boot runs on a more capable CPU core. Reported-by: Balaji Anandapadmanaban <Balaji.Anandapadmanaban@arm.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Tested-by: Peter Collingbourne <pcc@google.com> Reviewed-by: Peter Collingbourne <pcc@google.com>
| * net: enetc: unregister mdiobusMichael Walle2022-06-031-0/+3
| | | | | | | | | | | | | | | | | | If the device fails to probe - for example, when there is no ethaddr set - then the private data is automatically freed but the mdiobus remains registered. Fixes: 1e354cb39314 ("drivers: net: fsl_enetc: register internal MDIO bus") Signed-off-by: Michael Walle <michael@walle.cc>
View Lorry Controller Status