From patchwork Mon Dec 17 20:08:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Goldschmidt X-Patchwork-Id: 1015534 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="MSwafDGN"; dkim-atps=neutral Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 43K5bT1WMvz9s0n for ; Wed, 19 Dec 2018 05:07:44 +1100 (AEDT) Received: by lists.denx.de (Postfix, from userid 105) id 594BEC2205E; Tue, 18 Dec 2018 18:07:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=FREEMAIL_FROM, RCVD_IN_DNSWL_BLOCKED, RCVD_IN_MSPIKE_H2, T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id B1C93C21DDC; Tue, 18 Dec 2018 18:07:35 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id 5D463C21FD2; Mon, 17 Dec 2018 20:08:38 +0000 (UTC) Received: from mail-wm1-f65.google.com (mail-wm1-f65.google.com [209.85.128.65]) by lists.denx.de (Postfix) with ESMTPS id 25F00C21E96 for ; Mon, 17 Dec 2018 20:08:37 +0000 (UTC) Received: by mail-wm1-f65.google.com with SMTP id q26so472402wmf.5 for ; Mon, 17 Dec 2018 12:08:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=HP/44I8anEeUkN/DEgYiEVRdzCwCfNP6O+B/Ehw14fM=; b=MSwafDGNXIGJRiZOsU6d2J4VyRmW/vzHocQ7irh9FsS1+A1tRL2FNq6ON7nvnkoNYo 6ewgB3omaPYAfVQgfp7mEVZ4OfX8G/f3ugrfLCMNfj+Lux2vzhyk415fCWY9ucnE3Ohz nRW6WFtGqsaMpJTHa/RBmTPAy1PA+3GLz8oTA024ddCItK8Y50r7iiQ/Jq7UtOzBeoM9 e6y1zQALixFSk76rm+FcG22FQA2xRL0YyVomPBWkQAX2okTZHRd0uJoHB2Sl0YGqLO7f yQg+Z+NiMMU1/j3igzTLgmOcycIPgeC2sxSYPGBN5ERhpUNWEAzHvQM8deA+hQ4yLINQ fOAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=HP/44I8anEeUkN/DEgYiEVRdzCwCfNP6O+B/Ehw14fM=; b=tZeJUgQ6p+k27hI5HOyZPE/9zipHBDCqhPtTECFUnvNXMKOKIJChVLFXJwYrLPkbSP +U/ZbELD7LlfSdyTjqC0cnCkFEgf1LjJjI5bilSzR60OW8Q4WIv711DQdcXn0ZW8vHOD zQb0S6fzdR1C1ER1qI8LJf0QSERNtbPf2fW2uLAAPcl+SxGT9Arvg/uFYW//xs0XxFv4 wQ/8Ry6FyR+ZqVVO8f3+0AvuB00WLevouMA47RRL3YBpa8+aL4FeCpqECD/yrvNnHVYf vA4/maTJz111Pvi+W/86fO2izHLxZdm6sMt8ng/5d2OX5+ziQPCdDIJyQiilqEO+gdFW dWrg== X-Gm-Message-State: AA+aEWbEC1F9jOZaSlVTTyYRBWHBzdHILBcuhXPSg3n6Ts2hXKPbYbzA OWsuZMaUwE0X2upnLhtCuqc= X-Google-Smtp-Source: AFSGD/WGNp4Hu5xqkcAYqWZ+0xTCTKJ0RrIQ/fcyUroltMRk19XweZuwRSe3nHDD1jKNNmWv7YhBvA== X-Received: by 2002:a1c:c707:: with SMTP id x7mr68248wmf.120.1545077316757; Mon, 17 Dec 2018 12:08:36 -0800 (PST) Received: from ubuntu.home ([2a02:8071:6a3:700:80b1:ba3d:111a:23c5]) by smtp.gmail.com with ESMTPSA id q9sm1066472wrv.26.2018.12.17.12.08.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 17 Dec 2018 12:08:35 -0800 (PST) From: Simon Goldschmidt To: Tom Rini , u-boot@lists.denx.de, Joe Hershberger Date: Mon, 17 Dec 2018 21:08:20 +0100 Message-Id: <20181217200830.32585-1-simon.k.r.goldschmidt@gmail.com> X-Mailer: git-send-email 2.17.1 X-Mailman-Approved-At: Tue, 18 Dec 2018 18:07:34 +0000 Cc: Alexey Brodkin , Miquel Raynal , Stephen Warren , Heinrich Schuchardt , Alexander Graf , Andrea Barisani , Tom Warren Subject: [U-Boot] [PATCH v8 00/10] Fix CVE-2018-18440 and CVE-2018-18439 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" This series fixes CVE-2018-18440 ("insufficient boundary checks in filesystem image load") by adding restrictions to the 'load' command and fixes CVE-2018-18439 ("insufficient boundary checks in network image boot") by adding restrictions to the tftp code. The functions from lmb.c are used to setup regions of allowed and reserved memory. Then, the file size to load is checked against these addresses and loading the file is aborted if it would overwrite reserved memory. The memory reservation code is reused from bootm/image. Changes in v8: - fix address overflow in 'arch_lmb_reserve' for ARM Changes in v7: - add braces around if/else with macros accross more than one line - fix compiling without CONFIG_FIT - fix compiling without CONFIG_LMB Changes in v6: - fix size of allocated regions that need alignment padding - fix compiling without OF_CONTROL - fixed NULL pointer access in 'fdt_blob' passed to 'boot_fdt_add_mem_rsv_regions' Changes in v5: - added tests for lib/lmb.c - fixed bug in lmb.c when ram is at the end of 32-bit address range - fixed a bug in lmb_alloc_addr when resulting reserved ranges get combined Changes in v4: - fixed invalid 'if' statement without braces in boot_fdt_reserve_region - removed patch 7 ("net: remove CONFIG_MCAST_TFTP), adapted patch 8 Changes in v3: - No patch changes, but needed to resend since patman added too many cc addresses that gmail seemed to detect as spam :-( Changes in v2: - added code to reserve devicetree reserved-memory in lmb - added tftp fixes (patches 7 and 8) - fixed a bug in new function lmb_alloc_addr Simon Goldschmidt (10): test: add test for lib/lmb.c lmb: fix allocation at end of address range lib: lmb: reserving overlapping regions should fail fdt: parse "reserved-memory" for memory reservation lib: lmb: extend lmb for checks at load time fs: prevent overwriting reserved memory bootm: use new common function lmb_init_and_reserve lmb: remove unused extern declaration tftp: prevent overwriting reserved memory arm: bootm: fix sp detection at end of address range arch/arm/lib/bootm.c | 9 +- common/bootm.c | 8 +- common/image-fdt.c | 53 +++- fs/fs.c | 56 +++- include/lmb.h | 7 +- lib/Makefile | 1 + lib/lmb.c | 106 ++++++-- net/tftp.c | 73 +++++- test/lib/Makefile | 1 + test/lib/lmb.c | 601 +++++++++++++++++++++++++++++++++++++++++++ 10 files changed, 858 insertions(+), 57 deletions(-) create mode 100644 test/lib/lmb.c