From patchwork Mon Sep 16 15:20:24 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 829013 Delivered-To: patch@linaro.org Received: by 2002:a05:6000:4187:b0:367:895a:4699 with SMTP id ei7csp842194wrb; Mon, 16 Sep 2024 08:20:52 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXs8yTdNgqnT28Q09lIVgjVZkhuD6+RZHmKz6KjcDSC6yYgNFa419yu/syB17eMizeMchdhnA==@linaro.org X-Google-Smtp-Source: AGHT+IGMj61GvKxVgDbPsaQ1DN2v2z3SUQnNKGFK5AfI4CwSjVKTPG4cR9rT77ITG9GN7NeviSrk X-Received: by 2002:a05:6402:1e88:b0:5c4:235a:e66 with SMTP id 4fb4d7f45d1cf-5c4235a119amr16702332a12.34.1726500052047; Mon, 16 Sep 2024 08:20:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1726500052; cv=none; d=google.com; s=arc-20240605; b=QWxrScavoeblF7TxkJSch5AFnCr7zl0lfUT2uf9BXGEerXGmImVTeThyME1KQmYUVp lHc0EdZ4fER6zI/DHCJA2xCZvKgvZXXb5sgk/me5zmmjh14z3HxVHUDWb2GD26NLBpf1 1KbYnls6/YyzATOlPeAH0O17QO8jthfhq9gR87vUFINJloZoAJd7+2RzzdXlvJpYZzho thc+8DPDI8vG4BZZPcIWySKM6B4ZQ4uoDyioQZg4C9XA0qeVVG3dtTxL1IKGfX3NuUcN 7wmTSpT7+40GYyLvzh4wBCBfFbJWYdWBtimgRzXiudDoZOXgTeGcdTQMYbMMkiwBs2at q0cA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=BZIA8fTbixBS5MlxbGh4MqRh0/j8GBDOfmIEN0TGizw=; fh=iDfksB3ocE6Tkte7gLxf0uaiVuK6gITnxGRtC8QO8Gc=; b=Eu33hXFPRir7n5D3bl+YUssCxkdz5FNkZlLll5UNw5xlvMYF/J/rLBZKVVR//1Yl9B wfH0lxBnqg2hs+bHYyiqqfXXEEDnlZiVzCAqLXLkWUuspFxyWj0vUCi6itzvRIGhtW2E itL2D0+GrZGny+RCr3BN3MKmQaRn483bB/D+MAN48yxenx9sgeYN4DwkSZ3XdUQvCpJJ msHt3xOFuWoHpIEUgZ7ZjBV2s/h1RmXWe5XymSV2Q8IYvnG1JrsvqEvbqbTYD679sE+b frnZEsozmxYy4bukokzJJZgUDfwjKVeaKVFsOb8FV7augubTwpQDT7NLATRvhZgY47R3 H/7Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-5c42bcb854asi3707340a12.629.2024.09.16.08.20.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Sep 2024 08:20:52 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6E8D788EC9; Mon, 16 Sep 2024 17:20:44 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 8EDA688EA8; Mon, 16 Sep 2024 17:20:42 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED, SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id 498FA88D53 for ; Mon, 16 Sep 2024 17:20:40 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 20B4411FB; Mon, 16 Sep 2024 08:21:09 -0700 (PDT) Received: from a079122.blr.arm.com (a079122.arm.com [10.162.17.48]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7DDDE3F66E; Mon, 16 Sep 2024 08:20:37 -0700 (PDT) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Tom Rini , Ramon Fried , Joe Hershberger , Vaishnav Achath , Sughosh Ganu Subject: [PATCH 1/2] tftp: rework the logic to validate the load address Date: Mon, 16 Sep 2024 20:50:24 +0530 Message-Id: <20240916152025.75789-2-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240916152025.75789-1-sughosh.ganu@linaro.org> References: <20240916152025.75789-1-sughosh.ganu@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Use the lmb_read_check() function to verify if it is safe to use a region of memory to load data from a tftp command. The current logic checks the amount of free memory available, starting from the 'load address'. This call fails if the same region of memory has been used earlier. This used to work earlier as the LMB memory map had a local scope and was not persistent. Fix this issue by using the lmb_read_check() call instead which only returns an error in case the memory region has been marked for not allowing re-use. Signed-off-by: Sughosh Ganu Tested-by: Vaishnav Achath --- Note: To be applied on next, on top of https://patchwork.ozlabs.org/project/uboot/patch/20240913073251.2286529-2-prasad.kummari@amd.com/ net/tftp.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/net/tftp.c b/net/tftp.c index b5d227d8bc..d6744bc24e 100644 --- a/net/tftp.c +++ b/net/tftp.c @@ -82,7 +82,6 @@ static ulong tftp_block_wrap; static ulong tftp_block_wrap_offset; static int tftp_state; static ulong tftp_load_addr; -static ulong tftp_load_size; #ifdef CONFIG_TFTP_TSIZE /* The file size reported by the server */ static int tftp_tsize; @@ -159,13 +158,8 @@ static inline int store_block(int block, uchar *src, unsigned int len) void *ptr; if (CONFIG_IS_ENABLED(LMB)) { - ulong end_addr = tftp_load_addr + tftp_load_size; - - if (!end_addr) - end_addr = ULONG_MAX; - if (store_addr < tftp_load_addr || - store_addr + len > end_addr) { + lmb_read_check(store_addr, len)) { puts("\nTFTP error: "); puts("trying to overwrite reserved memory...\n"); return -1; @@ -712,19 +706,8 @@ static void tftp_timeout_handler(void) } } -/* Initialize tftp_load_addr and tftp_load_size from image_load_addr and lmb */ static int tftp_init_load_addr(void) { - if (CONFIG_IS_ENABLED(LMB)) { - phys_size_t max_size; - - max_size = lmb_get_free_size(image_load_addr); - if (!max_size) - return -1; - - tftp_load_size = max_size; - } - tftp_load_addr = image_load_addr; return 0; } From patchwork Mon Sep 16 15:20:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sughosh Ganu X-Patchwork-Id: 829014 Delivered-To: patch@linaro.org Received: by 2002:a05:6000:4187:b0:367:895a:4699 with SMTP id ei7csp842282wrb; Mon, 16 Sep 2024 08:21:04 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV7uKQ4c6Fz5qcgcaKgqGnI/71LFWzCO+tKU9bKTAAmX2+52d8itEa5wdbM0aM0ihyM6950eQ==@linaro.org X-Google-Smtp-Source: AGHT+IHOto3eCNp5LrZwYefBZ8hG1uJ8PlqsmDgb6iQLKdk0ogYQUPvw+S+f0kd+eTIPhR6xuvdr X-Received: by 2002:a2e:f19:0:b0:2f3:f339:e68d with SMTP id 38308e7fff4ca-2f787dc8569mr71718741fa.15.1726500064324; Mon, 16 Sep 2024 08:21:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1726500064; cv=none; d=google.com; s=arc-20240605; b=EvnMh9nw7rD7Tvu+G5cE7T2MrjqVIxjtNYo+na3UVT4r3wb7+3F6piKzbwiZz/k9Z+ 2KoCw24IA1//bC9hdGN9CxS/ZIJpKnZ1qD/EZmH2dXY1NUATjwMk8f5hC73a3P6U4Cix jPv2zkR/hxaDD4qF4VvsXB8Dcda7rQft65WiuUPPuVsJuxJiXnZpQ9Hppy7Zt0w2/Bxy ETyhu1TlftvGmgvFnHTl0/FddpsVNtHCScMRyrPE8igXVeU/+WSnBpWOYbAo1H9ippOz 6w3ZSqf9RJcO+pwG1Uq2p7AQmhCCL6nCf8bXDkQdiFWP03FLiNWHb49h99KDMbFOj9AA AAAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=ov6AJK5ZcAXYIUZSryZB7dxM2DLAYz65G5c/mWgf+yA=; fh=iDfksB3ocE6Tkte7gLxf0uaiVuK6gITnxGRtC8QO8Gc=; b=Wo97hD86mj6lqBdv6TM44yGbb0M9mX381tSBzRNNWbNJLnRTD/k2OwM7V0X5i3JK71 gDjxkYgNZQ8LkoHbTJlzqxS4HcfTsegEB5ADXOfz0N6xxKuvrfQXAuzrBD7AVy3amI2i ed9G9VDVWP5Yp0Ko6SaqEt5YleFah70GnawERmbEXYvZcpVXkH7tSVwzIL2t+dxC1UYn Tt+C/9/e8Vtpeh4glJZzxcLBKfhbOd37PDcT81ORML5ULCGRGPcjLN0wr39EFpSmBy2r 8M/wKOV6j+82/O1L7ZwGGp/kXWeQu22VF7AvfXa3OEXTGdbW2kLtl+E/lVE+t3FEocBb SO+w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id 4fb4d7f45d1cf-5c42bc9099esi3877445a12.436.2024.09.16.08.21.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Sep 2024 08:21:04 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id D528388EE8; Mon, 16 Sep 2024 17:20:45 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 1E69988EE0; Mon, 16 Sep 2024 17:20:45 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00, RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED, SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.2 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by phobos.denx.de (Postfix) with ESMTP id C6AB388D53 for ; Mon, 16 Sep 2024 17:20:42 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=fail smtp.mailfrom=sughosh.ganu@linaro.org Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id AF75211FB; Mon, 16 Sep 2024 08:21:11 -0700 (PDT) Received: from a079122.blr.arm.com (a079122.arm.com [10.162.17.48]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 2C2B63F66E; Mon, 16 Sep 2024 08:20:39 -0700 (PDT) From: Sughosh Ganu To: u-boot@lists.denx.de Cc: Tom Rini , Ramon Fried , Joe Hershberger , Vaishnav Achath , Sughosh Ganu Subject: [PATCH 2/2] wget: rework the logic to validate the load address Date: Mon, 16 Sep 2024 20:50:25 +0530 Message-Id: <20240916152025.75789-3-sughosh.ganu@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240916152025.75789-1-sughosh.ganu@linaro.org> References: <20240916152025.75789-1-sughosh.ganu@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Use the lmb_read_check() function to verify if it is safe to use a region of memory to load data from the wget command. The current logic checks the amount of free memory available, starting from the 'load address'. This call fails if the same region of memory has been used earlier. This used to work earlier as the LMB memory map had a local scope and was not persistent. Fix this issue by using the lmb_read_check() call instead which only returns an error in case the memory region has been marked for not allowing re-use. Signed-off-by: Sughosh Ganu Tested-by: Vaishnav Achath Reviewed-by: Caleb Connolly --- Note: To be applied on next, on top of https://patchwork.ozlabs.org/project/uboot/patch/20240913073251.2286529-2-prasad.kummari@amd.com/ net/wget.c | 36 +----------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/net/wget.c b/net/wget.c index 4a168641c6..a88c31f236 100644 --- a/net/wget.c +++ b/net/wget.c @@ -64,26 +64,6 @@ static unsigned int retry_tcp_ack_num; /* TCP retry acknowledge number*/ static unsigned int retry_tcp_seq_num; /* TCP retry sequence number */ static int retry_len; /* TCP retry length */ -static ulong wget_load_size; - -/** - * wget_init_max_size() - initialize maximum load size - * - * Return: 0 if success, -1 if fails - */ -static int wget_init_load_size(void) -{ - phys_size_t max_size; - - max_size = lmb_get_free_size(image_load_addr); - if (!max_size) - return -1; - - wget_load_size = max_size; - - return 0; -} - /** * store_block() - store block in memory * @src: source of data @@ -97,13 +77,8 @@ static inline int store_block(uchar *src, unsigned int offset, unsigned int len) uchar *ptr; if (CONFIG_IS_ENABLED(LMB)) { - ulong end_addr = image_load_addr + wget_load_size; - - if (!end_addr) - end_addr = ULONG_MAX; - if (store_addr < image_load_addr || - store_addr + len > end_addr) { + lmb_read_check(store_addr, len)) { printf("\nwget error: "); printf("trying to overwrite reserved memory...\n"); return -1; @@ -493,15 +468,6 @@ void wget_start(void) debug_cond(DEBUG_WGET, "\nwget:Load address: 0x%lx\nLoading: *\b", image_load_addr); - if (CONFIG_IS_ENABLED(LMB)) { - if (wget_init_load_size()) { - printf("\nwget error: "); - printf("trying to overwrite reserved memory...\n"); - net_set_state(NETLOOP_FAIL); - return; - } - } - net_set_timeout_handler(wget_timeout, wget_timeout_handler); tcp_set_tcp_handler(wget_handler);