diff mbox series

[01/15] spl: nand: Fix NULL-pointer dereference

Message ID 20231029034845.1169614-2-seanga2@gmail.com
State Superseded
Delegated to: Dario Binacchi
Headers show
Series nand: Add sandbox tests | expand

Commit Message

Sean Anderson Oct. 29, 2023, 3:48 a.m. UTC
spl_nand_fit_read unconditionally accesses load->priv. Ensure it is set.

Fixes: 00e180cc513 ("spl: nand: support loading i.MX container format file")
Fixes: 4620e8aabc1 ("spl: nand: support loading legacy image with payload compressed")
Signed-off-by: Sean Anderson <seanga2@gmail.com>
---

 common/spl/spl_nand.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Sean Anderson Oct. 29, 2023, 2:15 p.m. UTC | #1
On 10/28/23 23:48, Sean Anderson wrote:
> spl_nand_fit_read unconditionally accesses load->priv. Ensure it is set.
> 
> Fixes: 00e180cc513 ("spl: nand: support loading i.MX container format file")
> Fixes: 4620e8aabc1 ("spl: nand: support loading legacy image with payload compressed")
> Signed-off-by: Sean Anderson <seanga2@gmail.com>
> ---
> 
>   common/spl/spl_nand.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/common/spl/spl_nand.c b/common/spl/spl_nand.c
> index 07916bedbb9..a19236d9e6d 100644
> --- a/common/spl/spl_nand.c
> +++ b/common/spl/spl_nand.c
> @@ -105,7 +105,7 @@ static int spl_nand_load_element(struct spl_image_info *spl_image,
>   		struct spl_load_info load;
>   
>   		load.dev = NULL;
> -		load.priv = NULL;
> +		load.priv = &offset;
>   		load.filename = NULL;
>   		load.bl_len = bl_len;
>   		load.read = spl_nand_fit_read;
> @@ -116,7 +116,7 @@ static int spl_nand_load_element(struct spl_image_info *spl_image,
>   
>   		debug("Found legacy image\n");
>   		load.dev = NULL;
> -		load.priv = NULL;
> +		load.priv = &offset;
>   		load.filename = NULL;
>   		load.bl_len = 1;
>   		load.read = spl_nand_legacy_read;

Actually, since spl_nand_legacy_read doesn't reference priv, this second hunk is
unnecessary. Actually, spl_nand_legacy_read and spl_load_legacy_img are technically buggy
since size/offset are supposed to be in units of bl_len. However, this basically just
results in extra multiplies and divides, so I don't think it's desirable. I actually have
a patch to convert everything to bytes (keeping alignment), so "fixing" this is not
necessary for the moment.

--Sean
diff mbox series

Patch

diff --git a/common/spl/spl_nand.c b/common/spl/spl_nand.c
index 07916bedbb9..a19236d9e6d 100644
--- a/common/spl/spl_nand.c
+++ b/common/spl/spl_nand.c
@@ -105,7 +105,7 @@  static int spl_nand_load_element(struct spl_image_info *spl_image,
 		struct spl_load_info load;
 
 		load.dev = NULL;
-		load.priv = NULL;
+		load.priv = &offset;
 		load.filename = NULL;
 		load.bl_len = bl_len;
 		load.read = spl_nand_fit_read;
@@ -116,7 +116,7 @@  static int spl_nand_load_element(struct spl_image_info *spl_image,
 
 		debug("Found legacy image\n");
 		load.dev = NULL;
-		load.priv = NULL;
+		load.priv = &offset;
 		load.filename = NULL;
 		load.bl_len = 1;
 		load.read = spl_nand_legacy_read;