From patchwork Mon Sep 16 15:20:24 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 829013 Delivered-To: patch@linaro.org Received: by 2002:a05:6000:4187:b0:367:895a:4699 with SMTP id ei7csp842194wrb; Mon, 16 Sep 2024 08:20:52 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXs8yTdNgqnT28Q09lIVgjVZkhuD6+RZHmKz6KjcDSC6yYgNFa419yu/syB17eMizeMchdhnA==@linaro.org X-Google-Smtp-Source: AGHT+IGMj61GvKxVgDbPsaQ1DN2v2z3SUQnNKGFK5AfI4CwSjVKTPG4cR9rT77ITG9GN7NeviSrk X-Received: by 2002:a05:6402:1e88:b0:5c4:235a:e66 with SMTP id 4fb4d7f45d1cf-5c4235a119amr16702332a12.34.1726500052047; Mon, 16 Sep 2024 08:20:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1726500052; cv=none; d=google.com; s=arc-20240605; b=QWxrScavoeblF7TxkJSch5AFnCr7zl0lfUT2uf9BXGEerXGmImVTeThyME1KQmYUVp lHc0EdZ4fER6zI/DHCJA2xCZvKgvZXXb5sgk/me5zmmjh14z3HxVHUDWb2GD26NLBpf1 1KbYnls6/YyzATOlPeAH0O17QO8jthfhq9gR87vUFINJloZoAJd7+2RzzdXlvJpYZzho thc+8DPDI8vG4BZZPcIWySKM6B4ZQ4uoDyioQZg4C9XA0qeVVG3dtTxL1IKGfX3NuUcN 7wmTSpT7+40GYyLvzh4wBCBfFbJWYdWBtimgRzXiudDoZOXgTeGcdTQMYbMMkiwBs2at q0cA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=BZIA8fTbixBS5MlxbGh4MqRh0/j8GBDOfmIEN0TGizw=; fh=iDfksB3ocE6Tkte7gLxf0uaiVuK6gITnxGRtC8QO8Gc=; b=Eu33hXFPRir7n5D3bl+YUssCxkdz5FNkZlLll5UNw5xlvMYF/J/rLBZKVVR//1Yl9B wfH0lxBnqg2hs+bHYyiqqfXXEEDnlZiVzCAqLXLkWUuspFxyWj0vUCi6itzvRIGhtW2E itL2D0+GrZGny+RCr3BN3MKmQaRn483bB/D+MAN48yxenx9sgeYN4DwkSZ3XdUQvCpJJ msHt3xOFuWoHpIEUgZ7ZjBV2s/h1RmXWe5XymSV2Q8IYvnG1JrsvqEvbqbTYD679sE+b frnZEsozmxYy4bukokzJJZgUDfwjKVeaKVFsOb8FV7augubTwpQDT7NLATRvhZgY47R3 H/7Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-5c42bcb854asi3707340a12.629.2024.09.16.08.20.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Sep 2024 08:20:52 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6E8D788EC9; Mon, 16 Sep 2024 17:20:44 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 8EDA688EA8; Mon, 16 Sep 2024 17:20:42 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED, SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id 498FA88D53 for ; Mon, 16 Sep 2024 17:20:40 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 20B4411FB; Mon, 16 Sep 2024 08:21:09 -0700 (PDT) Received: from a079122.blr.arm.com (a079122.arm.com [10.162.17.48]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7DDDE3F66E; Mon, 16 Sep 2024 08:20:37 -0700 (PDT) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Tom Rini , Ramon Fried , Joe Hershberger , Vaishnav Achath , Sughosh Ganu Subject: [PATCH 1/2] tftp: rework the logic to validate the load address Date: Mon, 16 Sep 2024 20:50:24 +0530 Message-Id: <20240916152025.75789-2-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240916152025.75789-1-sughosh.ganu@linaro.org> References: <20240916152025.75789-1-sughosh.ganu@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Use the lmb_read_check() function to verify if it is safe to use a region of memory to load data from a tftp command. The current logic checks the amount of free memory available, starting from the 'load address'. This call fails if the same region of memory has been used earlier. This used to work earlier as the LMB memory map had a local scope and was not persistent. Fix this issue by using the lmb_read_check() call instead which only returns an error in case the memory region has been marked for not allowing re-use. Signed-off-by: Sughosh Ganu Tested-by: Vaishnav Achath --- Note: To be applied on next, on top of https://patchwork.ozlabs.org/project/uboot/patch/20240913073251.2286529-2-prasad.kummari@amd.com/ net/tftp.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/net/tftp.c b/net/tftp.c index b5d227d8bc..d6744bc24e 100644 --- a/net/tftp.c +++ b/net/tftp.c @@ -82,7 +82,6 @@ static ulong tftp_block_wrap; static ulong tftp_block_wrap_offset; static int tftp_state; static ulong tftp_load_addr; -static ulong tftp_load_size; #ifdef CONFIG_TFTP_TSIZE /* The file size reported by the server */ static int tftp_tsize; @@ -159,13 +158,8 @@ static inline int store_block(int block, uchar *src, unsigned int len) void *ptr; if (CONFIG_IS_ENABLED(LMB)) { - ulong end_addr = tftp_load_addr + tftp_load_size; - - if (!end_addr) - end_addr = ULONG_MAX; - if (store_addr < tftp_load_addr || - store_addr + len > end_addr) { + lmb_read_check(store_addr, len)) { puts("\nTFTP error: "); puts("trying to overwrite reserved memory...\n"); return -1; @@ -712,19 +706,8 @@ static void tftp_timeout_handler(void) } } -/* Initialize tftp_load_addr and tftp_load_size from image_load_addr and lmb */ static int tftp_init_load_addr(void) { - if (CONFIG_IS_ENABLED(LMB)) { - phys_size_t max_size; - - max_size = lmb_get_free_size(image_load_addr); - if (!max_size) - return -1; - - tftp_load_size = max_size; - } - tftp_load_addr = image_load_addr; return 0; }