Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-24 13:43:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

board: amlogic: fix buffler overflow in seria, mac & usid read

Browse source 
While meson_sm_read_efuse() doesn't overflow, the string is not
zero terminated and env_set*() will buffer overflow and add random
characters to environment.

Acked-by: Viacheslav Bocharov <adeep@lexina.in>
Link: https://lore.kernel.org/r/20240320-u-boot-fix-p200-serial-v2-1-972be646a301@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
This commit is contained in:
Neil Armstrong 2024-03-20 09:46:11 +01:00
parent 65d5c367b0
commit d54f87f09a
9 changed files with 30 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
board/amlogic/beelink-s922x/beelink-s922x.c
View file

@ -20,7 +20,7 @@
int misc_init_r(void)
{
u8 mac_addr[MAC_ADDR_LEN];
u8 mac_addr[MAC_ADDR_LEN + 1];
char efuse_mac_addr[EFUSE_MAC_SIZE], tmp[3];
ssize_t len;
@ -41,6 +41,7 @@ int misc_init_r(void)
tmp[2] = '\0';
mac_addr[i] = hextoul(tmp, NULL);
}
mac_addr[MAC_ADDR_LEN] = '\0';
if (is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);

3
board/amlogic/jethub-j100/jethub-j100.c
View file

@ -17,7 +17,7 @@
int misc_init_r(void)
{
u8 mac_addr[ARP_HLEN];
u8 mac_addr[ARP_HLEN + 1];
char serial[SM_SERIAL_SIZE];
u32 sid;
@ -34,6 +34,7 @@ int misc_init_r(void)
mac_addr[3] = (sid >> 16) & 0xff;
mac_addr[4] = (sid >> 8) & 0xff;
mac_addr[5] = (sid >> 0) & 0xff;
mac_addr[ARP_HLEN] = '\0';
eth_env_set_enetaddr("ethaddr", mac_addr);
}

9
board/amlogic/jethub-j80/jethub-j80.c
View file

@ -27,9 +27,9 @@
int misc_init_r(void)
{
u8 mac_addr[EFUSE_MAC_SIZE];
char serial[EFUSE_SN_SIZE];
char usid[EFUSE_USID_SIZE];
u8 mac_addr[EFUSE_MAC_SIZE + 1];
char serial[EFUSE_SN_SIZE + 1];
char usid[EFUSE_USID_SIZE + 1];
ssize_t len;
unsigned int adcval;
int ret;
@ -37,6 +37,7 @@ int misc_init_r(void)
if (!eth_env_get_enetaddr("ethaddr", mac_addr)) {
len = meson_sm_read_efuse(EFUSE_MAC_OFFSET,
mac_addr, EFUSE_MAC_SIZE);
mac_addr[len] = '\0';
if (len == EFUSE_MAC_SIZE && is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);
else
@ -46,6 +47,7 @@ int misc_init_r(void)
if (!env_get("serial")) {
len = meson_sm_read_efuse(EFUSE_SN_OFFSET, serial,
EFUSE_SN_SIZE);
serial[len] = '\0';
if (len == EFUSE_SN_SIZE)
env_set("serial", serial);
}
@ -53,6 +55,7 @@ int misc_init_r(void)
if (!env_get("usid")) {
len = meson_sm_read_efuse(EFUSE_USID_OFFSET, usid,
EFUSE_USID_SIZE);
usid[len] = '\0';
if (len == EFUSE_USID_SIZE)
env_set("usid", usid);
}

3
board/amlogic/odroid-n2/odroid-n2.c
View file

@ -107,7 +107,7 @@ static int odroid_detect_variant(void)
int misc_init_r(void)
{
u8 mac_addr[MAC_ADDR_LEN];
u8 mac_addr[MAC_ADDR_LEN + 1];
char efuse_mac_addr[EFUSE_MAC_SIZE], tmp[3];
ssize_t len;
@ -128,6 +128,7 @@ int misc_init_r(void)
tmp[2] = '\0';
mac_addr[i] = hextoul(tmp, NULL);
}
mac_addr[MAC_ADDR_LEN] = '\0';
if (is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);

6
board/amlogic/p200/p200.c
View file

@ -21,13 +21,14 @@
int misc_init_r(void)
{
u8 mac_addr[EFUSE_MAC_SIZE];
char serial[EFUSE_SN_SIZE];
u8 mac_addr[EFUSE_MAC_SIZE + 1];
char serial[EFUSE_SN_SIZE + 1];
ssize_t len;
if (!eth_env_get_enetaddr("ethaddr", mac_addr)) {
len = meson_sm_read_efuse(EFUSE_MAC_OFFSET,
mac_addr, EFUSE_MAC_SIZE);
mac_addr[len] = '\0';
if (len == EFUSE_MAC_SIZE && is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);
else
@ -37,6 +38,7 @@ int misc_init_r(void)
if (!env_get("serial#")) {
len = meson_sm_read_efuse(EFUSE_SN_OFFSET, serial,
EFUSE_SN_SIZE);
serial[len] = '\0';
if (len == EFUSE_SN_SIZE)
env_set("serial#", serial);
}

6
board/amlogic/p201/p201.c
View file

@ -21,13 +21,14 @@
int misc_init_r(void)
{
u8 mac_addr[EFUSE_MAC_SIZE];
char serial[EFUSE_SN_SIZE];
u8 mac_addr[EFUSE_MAC_SIZE + 1];
char serial[EFUSE_SN_SIZE + 1];
ssize_t len;
if (!eth_env_get_enetaddr("ethaddr", mac_addr)) {
len = meson_sm_read_efuse(EFUSE_MAC_OFFSET,
mac_addr, EFUSE_MAC_SIZE);
mac_addr[len] = '\0';
if (len == EFUSE_MAC_SIZE && is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);
}
@ -35,6 +36,7 @@ int misc_init_r(void)
if (!env_get("serial#")) {
len = meson_sm_read_efuse(EFUSE_SN_OFFSET, serial,
EFUSE_SN_SIZE);
serial[len] = '\0';
if (len == EFUSE_SN_SIZE)
env_set("serial#", serial);
}

6
board/amlogic/p212/p212.c
View file

@ -22,13 +22,14 @@
int misc_init_r(void)
{
u8 mac_addr[EFUSE_MAC_SIZE];
char serial[EFUSE_SN_SIZE];
u8 mac_addr[EFUSE_MAC_SIZE + 1];
char serial[EFUSE_SN_SIZE + 1];
ssize_t len;
if (!eth_env_get_enetaddr("ethaddr", mac_addr)) {
len = meson_sm_read_efuse(EFUSE_MAC_OFFSET,
mac_addr, EFUSE_MAC_SIZE);
mac_addr[len] = '\0';
if (len == EFUSE_MAC_SIZE && is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);
else
@ -38,6 +39,7 @@ int misc_init_r(void)
if (!env_get("serial#")) {
len = meson_sm_read_efuse(EFUSE_SN_OFFSET, serial,
EFUSE_SN_SIZE);
serial[len] = '\0';
if (len == EFUSE_SN_SIZE)
env_set("serial#", serial);
}

6
board/amlogic/q200/q200.c
View file

@ -22,13 +22,14 @@
int misc_init_r(void)
{
u8 mac_addr[EFUSE_MAC_SIZE];
char serial[EFUSE_SN_SIZE];
u8 mac_addr[EFUSE_MAC_SIZE + 1];
char serial[EFUSE_SN_SIZE + 1];
ssize_t len;
if (!eth_env_get_enetaddr("ethaddr", mac_addr)) {
len = meson_sm_read_efuse(EFUSE_MAC_OFFSET,
mac_addr, EFUSE_MAC_SIZE);
mac_addr[len] = '\0';
if (len == EFUSE_MAC_SIZE && is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);
else
@ -38,6 +39,7 @@ int misc_init_r(void)
if (!env_get("serial#")) {
len = meson_sm_read_efuse(EFUSE_SN_OFFSET, serial,
EFUSE_SN_SIZE);
serial[len] = '\0';
if (len == EFUSE_SN_SIZE)
env_set("serial#", serial);
}

3
board/amlogic/vim3/vim3.c
View file

@ -151,7 +151,7 @@ int meson_ft_board_setup(void *blob, struct bd_info *bd)
int misc_init_r(void)
{
u8 mac_addr[MAC_ADDR_LEN];
u8 mac_addr[MAC_ADDR_LEN + 1];
char efuse_mac_addr[EFUSE_MAC_SIZE], tmp[3];
char serial_string[EFUSE_MAC_SIZE + 1];
ssize_t len;
@ -169,6 +169,7 @@ int misc_init_r(void)
tmp[2] = '\0';
mac_addr[i] = hextoul(tmp, NULL);
}
mac_addr[MAC_ADDR_LEN] = '\0';
if (is_valid_ethaddr(mac_addr))
eth_env_set_enetaddr("ethaddr", mac_addr);