u-boot.git/net, branch v2019.04

lmb: handle more than one DRAM BANK

2019-02-02T13:19:17+00:00

This fixes the automatic lmb initialization and reservation for boards
with more than one DRAM bank.

This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load
files into the firs DRAM bank from fs and via tftp.

Found-by: Heinrich Schuchardt 
Signed-off-by: Simon Goldschmidt 
Tested-by: Heinrich Schuchardt 
Reviewed-by: Simon Glass

lib: lmb: rename lmb_get_unreserved_size to lmb_get_free_size

2019-01-26T13:13:57+00:00

As a follow-up, change the name of the newly introduced function
'lmb_get_unreserved_size' to 'lmb_get_free_size', which is more
appropriate.

Signed-off-by: Simon Goldschmidt 
[trini: Fix test/lib/lmb.c]
Signed-off-by: Tom Rini

net: remove CONFIG_MCAST_TFTP

2019-01-24T17:35:30+00:00

No mainline board enables CONFIG_MCAST_TFTP and there have been
compilation issues with the code for some time. Additionally, it has a
potential buffer underrun issue (reported as a side note in
CVE-2018-18439).

Remove the multicast TFTP code but keep the driver API for the future
addition of IPv6.

Cc: Simon Goldschmidt 
Signed-off-by: Chris Packham 
Acked-by: Joe Hershberger

net: move ether_crc to tsec driver

2019-01-24T17:35:29+00:00

ether_crc was added to the core net code in commit 53a5c424bf86
("multicast tftp: RFC2090") so that other drivers could use it. However
the only current user of it is tsec.c so move it there.

Signed-off-by: Chris Packham 
Acked-by: Joe Hershberger

net: explicitly assign errno to return code in case of network failure

2019-01-24T17:35:28+00:00

When dealing with two ethernet ports and having "netretry" set
to "once", it could occur that the connection (e.g. an ARP
request) failed, hence the status of the netloop was
"NETLOOP_FAIL". Due to the setting of "netretry", the network
logic would then switch to the other network interface,
assigning "ret" with the return value of "net_start_again()".
If this call succeeded we would return 0 (i.e. success) to
the caller when in reality the network action failed.

Signed-off-by: Thomas RIENOESSL 
Reviewed-by: Christian Gmeiner 
Acked-by: Joe Hershberger

tftp: prevent overwriting reserved memory

2019-01-17T04:15:53+00:00

This fixes CVE-2018-18439 ("insufficient boundary checks in network
image boot") by using lmb to check for a valid range to store
received blocks.

Signed-off-by: Simon Goldschmidt 
Acked-by: Joe Hershberger 
[trini: Always build lib/lmb.o on LMB and lib/fdtdec.o on OF_LIBFDT]
Signed-off-by: Tom Rini

net: Consolidate UDP header functions

2018-10-10T17:29:02+00:00

Make it possible to add TCP versions of the same, while reusing
IP portions. This patch should not change any behavior.

Signed-off-by: Duncan Hare 
Acked-by: Joe Hershberger

net: Don't overwrite waiting packets with asynchronous replies

2018-10-10T17:29:01+00:00

Peter originally sent a fix, but it breaks a number of other things.
This addresses the original reported issue in a different way.

That report was:

> U-Boot has 1 common buffer to send Ethernet frames, pointed to by
> net_tx_packet.  When sending to an IP address without knowing the MAC
> address, U-Boot makes an ARP request (using the arp_tx_packet buffer)
> to find out the MAC address of the IP addressr. When a matching ARP
> reply is received, U-Boot continues sending the frame stored in the
> net_tx_packet buffer.
>
> However, in the mean time, if U-Boot needs to send out any network
> packets (e.g. replying ping packets or ARP requests for its own IP
> address etc.), it will use the net_tx_packet buffer to prepare the
> new packet. Thus this buffer is no longer the original packet meant
> to be transmitted after the ARP reply. The original packet will be
> lost.

This instead uses the ARP tx buffer to send async replies in the case
where we are actively waiting for an ARP reply.

Signed-off-by: Joe Hershberger 

Reported-by: Tran Tien Dat 
Reviewed-by: Simon Glass 
Reviewed-by: Bin Meng 
Tested-by: Bin Meng

net: Add an accessor to know if waiting for ARP

2018-10-10T17:28:58+00:00

This single-sources the state of the ARP.

Signed-off-by: Joe Hershberger 
Reviewed-by: Simon Glass 
Reviewed-by: Bin Meng

net: eth-uclass: Fix for DM USB ethernet support

2018-08-21T14:21:37+00:00

When a USB ethernet device is halted, the device driver is removed. When
this happens the uclass private memory is freed and uclass_priv is set to
NULL. This causes a data abort when uclass_priv->state is then set to
ETH_STATE_PASSIVE.

Fix it by checking if uclass_priv is NULL before setting uclass_priv->state

Signed-off-by: Jean-Jacques Hiblot 
Acked-by: Joe Hershberger