[PATCH v5 1/7] net: wget: prevent overwriting reserved memory
Ramon Fried
rfried.dev at gmail.com
Fri Oct 6 22:36:21 CEST 2023
On Wed, Sep 27, 2023 at 12:37 PM Masahisa Kojima
<masahisa.kojima at linaro.org> wrote:
>
> This introduces the valid range check to store the received
> blocks using lmb. The same logic is implemented in tftp.
>
> Signed-off-by: Masahisa Kojima <masahisa.kojima at linaro.org>
> Acked-by: Ilias Apalodimas <ilias.apalodimas at linaro.org>
> Reviewed-by: Simon Glass <sjg at chromium.org>
> ---
> net/wget.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 73 insertions(+), 7 deletions(-)
>
> diff --git a/net/wget.c b/net/wget.c
> index 2dbfeb1a1d..a48a8cb624 100644
> --- a/net/wget.c
> +++ b/net/wget.c
> @@ -4,16 +4,20 @@
> * Copyright Duncan Hare <dh at synoia.com> 2017
> */
>
> +#include <asm/global_data.h>
> #include <command.h>
> #include <common.h>
> #include <display_options.h>
> #include <env.h>
> #include <image.h>
> +#include <lmb.h>
> #include <mapmem.h>
> #include <net.h>
> #include <net/tcp.h>
> #include <net/wget.h>
>
> +DECLARE_GLOBAL_DATA_PTR;
> +
> static const char bootfile1[] = "GET ";
> static const char bootfile3[] = " HTTP/1.0\r\n\r\n";
> static const char http_eom[] = "\r\n\r\n";
> @@ -55,6 +59,29 @@ static unsigned int retry_tcp_ack_num; /* TCP retry acknowledge number*/
> static unsigned int retry_tcp_seq_num; /* TCP retry sequence number */
> static int retry_len; /* TCP retry length */
>
> +static ulong wget_load_size;
> +
> +/**
> + * wget_init_max_size() - initialize maximum load size
> + *
> + * Return: 0 if success, -1 if fails
> + */
> +static int wget_init_load_size(void)
> +{
> + struct lmb lmb;
> + phys_size_t max_size;
> +
> + lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob);
> +
> + max_size = lmb_get_free_size(&lmb, image_load_addr);
> + if (!max_size)
> + return -1;
> +
> + wget_load_size = max_size;
> +
> + return 0;
> +}
> +
> /**
> * store_block() - store block in memory
> * @src: source of data
> @@ -63,10 +90,25 @@ static int retry_len; /* TCP retry length */
> */
> static inline int store_block(uchar *src, unsigned int offset, unsigned int len)
> {
> + ulong store_addr = image_load_addr + offset;
> ulong newsize = offset + len;
> uchar *ptr;
>
> - ptr = map_sysmem(image_load_addr + offset, len);
> + if (IS_ENABLED(CONFIG_LMB)) {
> + ulong end_addr = image_load_addr + wget_load_size;
> +
> + if (!end_addr)
> + end_addr = ULONG_MAX;
> +
> + if (store_addr < image_load_addr ||
> + store_addr + len > end_addr) {
> + printf("\nwget error: ");
> + printf("trying to overwrite reserved memory...\n");
> + return -1;
> + }
> + }
> +
> + ptr = map_sysmem(store_addr, len);
> memcpy(ptr, src, len);
> unmap_sysmem(ptr);
>
> @@ -240,25 +282,39 @@ static void wget_connected(uchar *pkt, unsigned int tcp_seq_num,
>
> net_boot_file_size = 0;
>
> - if (len > hlen)
> - store_block(pkt + hlen, 0, len - hlen);
> + if (len > hlen) {
> + if (store_block(pkt + hlen, 0, len - hlen) != 0) {
> + wget_loop_state = NETLOOP_FAIL;
> + wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
> + net_set_state(NETLOOP_FAIL);
> + return;
> + }
> + }
>
> debug_cond(DEBUG_WGET,
> "wget: Connected Pkt %p hlen %x\n",
> pkt, hlen);
>
> for (i = 0; i < pkt_q_idx; i++) {
> + int err;
> +
> ptr1 = map_sysmem(
> (phys_addr_t)(pkt_q[i].pkt),
> pkt_q[i].len);
> - store_block(ptr1,
> - pkt_q[i].tcp_seq_num -
> - initial_data_seq_num,
> - pkt_q[i].len);
> + err = store_block(ptr1,
> + pkt_q[i].tcp_seq_num -
> + initial_data_seq_num,
> + pkt_q[i].len);
> unmap_sysmem(ptr1);
> debug_cond(DEBUG_WGET,
> "wget: Connctd pkt Q %p len %x\n",
> pkt_q[i].pkt, pkt_q[i].len);
> + if (err) {
> + wget_loop_state = NETLOOP_FAIL;
> + wget_fail("wget: store error\n", tcp_seq_num, tcp_ack_num, action);
> + net_set_state(NETLOOP_FAIL);
> + return;
> + }
> }
> }
> }
> @@ -330,6 +386,7 @@ static void wget_handler(uchar *pkt, u16 dport,
> len) != 0) {
> wget_fail("wget: store error\n",
> tcp_seq_num, tcp_ack_num, action);
> + net_set_state(NETLOOP_FAIL);
> return;
> }
>
> @@ -420,6 +477,15 @@ void wget_start(void)
> debug_cond(DEBUG_WGET,
> "\nwget:Load address: 0x%lx\nLoading: *\b", image_load_addr);
>
> + if (IS_ENABLED(CONFIG_LMB)) {
> + if (wget_init_load_size()) {
> + printf("\nwget error: ");
> + printf("trying to overwrite reserved memory...\n");
> + net_set_state(NETLOOP_FAIL);
> + return;
> + }
> + }
> +
> net_set_timeout_handler(wget_timeout, wget_timeout_handler);
> tcp_set_tcp_handler(wget_handler);
>
> --
> 2.34.1
>
Reviewed-by: Ramon Fried <rfried.dev at gmail.com>
More information about the U-Boot
mailing list