| Age | Commit message (Collapse) | Author |
|---|
|
Piyush Paliwal <[email protected]> says:
Two independent out-of-bounds reads in the SquashFS driver, both reachable
by pointing U-Boot at an attacker-supplied image (e.g. ls/load on a crafted
USB/SD/netboot rootfs). Either one crashes the bootloader (DoS); patch 2 can
also copy adjacent heap memory into the loaded file (information disclosure).
1/2 sqfs_find_inode()/sqfs_inode_size() walk the decompressed inode table
using on-disk sizes with no check that the cursor stays inside the
buffer -> wild read / SEGV, e.g. from a simple "ls".
2/2 sqfs_read_nest() uses the on-disk fragment offset as an unbounded
source index into the fragment block -> out-of-bounds heap read when
loading a fragment-backed file.
Both were found by fuzzing the sandbox build (CONFIG_ASAN) of sqfsls/sqfsload
with mutated images. With the fixes, the crashing inputs are rejected
cleanly, 2000 fuzz iterations produce no further crashes, and the valid-image
path is unchanged.
These are distinct from the 2024 SquashFS CVE cluster (CVE-2024-57254..57259,
fixed in 2025.01-rc1) and from the sqfs_frag_lookup() fix (e365a269df5): the
earlier work added NULL checks at the callers and fixed the symlink-size and
fragment-table paths, but left these inode-table-walk and fragment-data
paths unbounded.
The two patches are independent and can be applied in either order.
Link: https://lore.kernel.org/r/[email protected]
|
|
When reading a fragment-backed file, sqfs_read_nest() copies the file
data out of the fragment block with:
memcpy(buf + *actread, &fragment_block[finfo.offset],
finfo.size - *actread);
finfo.offset (the fragment's byte offset) and finfo.size come straight
from the on-disk inode and are never validated against the fragment
block length. Unlike the data-block loop above it, this path does not
clamp the source span, so a crafted inode makes the memcpy read past the
fragment buffer -> out-of-bounds heap read. The leaked bytes are copied
into the user-visible load buffer (information disclosure) or fault.
This affects both the compressed (dest_len bytes) and the uncompressed
(table_size bytes) fragment cases.
Validate finfo.offset and the copy length against the available fragment
data before each memcpy and reject malformed inodes.
Found by fuzzing the sandbox (CONFIG_ASAN) sqfsload with mutated images:
before, SEGV in sqfs_read_nest() at the fragment memcpy; after, malformed
images are rejected and valid fragmented files still load correctly.
Fixes: 0008d8086649 ("fs/squashfs: fix reading of fragmented files")
Cc: [email protected]
Signed-off-by: Piyush Paliwal <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
|
|
sqfs_find_inode() walks the decompressed inode table advancing
"offset += sqfs_inode_size(base, ...)" with no check that offset stays
within the table (metablks_count * SQFS_METADATA_BLOCK_SIZE). All sizes
come from the on-disk image, including the unbounded extended-directory
(LDIR) index walk and the regular-file block-list term in
sqfs_inode_size(). A crafted image makes base run off the end of the
buffer -> out-of-bounds read / SEGV, reachable simply by listing the
image (ls/sqfsls) or any operation that resolves a path.
The earlier fix 3fb1df1e5 ("squashfs: Check sqfs_find_inode() return
value") only added NULL checks at the call sites; it did not add the
missing internal bound, so the wild read still occurs before the
function can return. c8e929e5 fixed only the symlink case of
sqfs_inode_size(), leaving the LDIR index walk unbounded.
Thread the inode table size from sqfs_read_inode_table() through the
squashfs_dir_stream to sqfs_find_inode(), and:
- reject an inode whose base header does not fit in the table;
- pass the remaining byte count to sqfs_inode_size() and validate every
variable-length read (LDIR index list, REG/LREG block list, symlink,
device/ipc inodes) against it, with overflow-checked arithmetic;
- reject an inode whose computed size leaves the table.
Found by fuzzing the sandbox (CONFIG_ASAN) sqfsls/sqfsload with mutated
images. Before: SEGV in sqfs_find_inode (sqfs_inode.c) and in
sqfs_inode_size() LDIR walk. After: malformed images are rejected
cleanly; 2000 fuzz iterations produce no crash and the valid-image path
is unchanged.
Fixes: c51006130370 ("fs/squashfs: new filesystem")
Cc: [email protected]
Signed-off-by: Piyush Paliwal <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
|
|
Shahriyar Jalayeri <[email protected]> says:
This fixes an integer overflow in the SquashFS directory-table reader
that leads to a heap out-of-bounds write, and adds a regression test.
sqfs_read_directory_table() sizes the directory table with an int
multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
crafted image, under-allocating the buffer that the fill loop then
overruns. It is reached by listing or reading the image (sqfsls /
sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
patch 2 adds a test that a crafted image is rejected.
Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.
[trini: As part of the merge, this touches on what commit
9a9d46cb5e1a ("fs/squashfs: fix heap exhaustion during symlink resolution")
also handles, but they appear to be separate issues]
Link: https://lore.kernel.org/r/[email protected]
|
|
sqfs_read_directory_table() allocates the directory table with
malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE). metablks_count is an
int and SQFS_METADATA_BLOCK_SIZE is 8192, so the multiply is evaluated in
int and wraps for metablks_count >= 2^19. metablks_count comes from the
attacker-controlled superblock (sqfs_count_metablks() grows it by one per
2-byte metadata header), so a crafted image under-allocates the buffer
while the fill loop still writes metablks_count metadata blocks into it,
a heap out-of-bounds write. It is reached by listing or reading the image
(sqfsls / sqfsload). The position list allocation on the next line has the
same unchecked-multiply shape.
Size both allocations with __builtin_mul_overflow() and reject the image
on overflow, as the disk-read buffers earlier in the same function already
do. Set the error return when either allocation fails so the caller does
not proceed with a NULL directory table.
Fixes: c51006130370 ("fs/squashfs: new filesystem")
Signed-off-by: Shahriyar Jalayeri <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
|
|
Commit 57e0bb7bf00d ("fs/squashfs: add sqfs_dir_offset() error checks")
made sqfs_search_dir() reject negative returns from sqfs_dir_offset(),
but the positive range is still unbounded. Both parts of the returned
offset come from the image: 'offset' is a 16-bit inode field used
verbatim, and the matched metadata block index may be the last one in
m_list, in which case the returned block (j + 1) is one past the end
of the directory table.
The callers use the result to index dirs->dir_table[], which
sqfs_read_directory_table() allocates as m_count metadata blocks, and
then memcpy() a directory header out of it. A crafted image can
therefore read up to 64 KiB past the end of that allocation.
Reject an inode offset that cannot address a decompressed metadata
block, and verify that the resulting directory header lies entirely
within the directory table.
The existing 'offset < 0' test is dropped: 'offset' is assigned from
get_unaligned_le16() and so is never negative, meaning the test never
fired. The new upper bound covers what it was meant to catch.
Fixes: c51006130370 ("fs/squashfs: new filesystem")
Signed-off-by: Pranav Rajendran <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
|
|
sqfs_frag_lookup() validates its fragment index only against
sblk->fragments, which is read from the image superblock and is
therefore under the control of whoever supplies the image. Every
buffer access derived from that index is then made without checking
it against the size of the buffer actually read from the device:
- the fragment index table entry at 'table_offset + block *
sizeof(u64)' can be read past the end of 'table', as 'block' is
inode_fragment_index / SQFS_MAX_ENTRIES and has no upper bound;
- the metadata block header and payload are read from
'metadata_buffer' at 'table_offset', but that buffer is sized from
start_block, which comes from the unvalidated index table entry
above. A start_block just below sblk->fragment_table_start yields a
single-block buffer while SQFS_METADATA_SIZE(header) may be up to
SQFS_METADATA_BLOCK_SIZE, so both the decompression source and the
memcpy() source can run past the end of the buffer;
- 'entries' is allocated with SQFS_METADATA_BLOCK_SIZE bytes but only
partially filled, so entries[offset] can read uninitialised heap
memory when the metadata block holds fewer than offset + 1 entries.
Compute the size of both buffers explicitly, rejecting the
multiplication overflow the way sqfs_read_directory_table() already
does, and check each access against it. Also track how much of
'entries' was populated and reject an index beyond that.
A crafted SquashFS image can trigger all three cases, either crashing
U-Boot or feeding adjacent heap contents into the fragment entry that
the following data read is based on.
Fixes: c51006130370 ("fs/squashfs: new filesystem")
Signed-off-by: Pranav Rajendran <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
|
|
btrfs_readdir() and btrfs_size() both open code the same search for an
inode item to read its size field. Move it into one helper.
Signed-off-by: Cole Munz <[email protected]>
Reviewed-by: Qu Wenruo <[email protected]>
|
|
The U-Boot copy of btrfs_search_slot() returns on error with the nodes
it has descended through still attached to the path. The kernel one
releases the path on any error unless p->skip_release_on_error is set,
and callers written against that convention treat a failed search as
owning nothing. btrfs_size() is one: it returns straight away on a
search error and never reaches its btrfs_release_path() call, so the
attached extent buffer references leak.
Route both error exits through a release of the path. The error
returns of read_node_slot() carry no extra reference, so the path is
the only thing to clean up.
Suggested-by: Qu Wenruo <[email protected]>
Signed-off-by: Cole Munz <[email protected]>
Reviewed-by: Qu Wenruo <[email protected]>
|
|
btrfs_readdir() zeroes the dirent and fills in only the name and the
type, so dent->size stays 0 and every file is listed as zero bytes:
=> ls host 0 /
0 f_192k.bin
0 small_3k.bin
Reads themselves are fine, since btrfs_read() takes the size from
btrfs_size(), which does its own inode item lookup. It affects EFI
too: dir_read() in lib/efi_loader/efi_file.c copies dent->size into
both file_size and physical_size, so an EFI application enumerating a
directory on btrfs sees every file as empty, which is the generic-code
path Alexey's readdir series moves btrfs onto.
The custom listing that fs_ls_generic() replaced looked the inode item
up and printed the real size, and every other filesystem in the tree
fills dent->size in its own readdir: ext4fs.c:327, exfat io.c:805,
erofs fs.c:186, squashfs sqfs.c:1095 and fat.c:1555.
btrfs_next_dir_entry() already has the dir item mapped, so read the
key it points at while we are there and hand it back to the caller,
and use that to reach the inode item. A subvolume entry points at a
root item instead and has no size of its own, so leave that one at 0.
=> ls host 0 /
196608 f_192k.bin
3000 small_3k.bin
Fixes: 31cf3f177823 ("fs: btrfs: use fs_ls_generic() and drop custom implementation")
Signed-off-by: Cole Munz <[email protected]>
Reviewed-by: Qu Wenruo <[email protected]>
|
|
fstypes"
Vincent Jardin <[email protected]> says:
3 commits providing documentation of impacts and testing the dispatch
for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the
generic `load <iface> ...` command.
The test does not cover ubifs, I could not make it work with
qemu. Since the code logic is there and testing with semihost
is done, it should cover the needed cases.
Link: https://lore.kernel.org/r/[email protected]
|
|
Filesystems that are null_dev_desc_ok (semihosting, ubifs) have
no UCLASS_BLK device under their ifname, so on real hardware
fs_set_blk_dev() always fails at the partition lookup.
The workaround was to add a per-filesystem
command (example cmd/ubifs.c), which duplicates the plumbing of
fstype_info.
Probe such entries with block_desc=NULL up front, so
load semihosting - <addr> <file>
works without a new command.
Sandbox boards that exercise the existing fallback through "host
bind" stay unchanged.
Signed-off-by: Vincent Jardin <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Allan ELKAIM <[email protected]> says:
sqfsload fails to load a file through a symlink when the squashfs
image contains a large number of inodes (e.g. a rootfs that includes
the tzdata timezone database).
Root cause: sqfs_read_nest() resolves the symlink by calling itself
recursively without first freeing the parent directory's inode and
directory table buffers. This causes a temporary double allocation
that can exhaust the U-Boot heap. When malloc() subsequently fails
inside sqfs_read_directory_table(), the error goes undetected and
sqfs_search_dir() is called with a NULL pos_list pointer, leading to:
Error: invalid inode reference to directory table.
Failed to load '/boot/Image'
Patch 1 fixes the structural problem (temporary double allocation)
and plugs the silent NULL pointer path in sqfs_read_directory_table().
Patch 2 adds the missing return-value checks on sqfs_dir_offset() that
turn any residual lookup failure into a clean error propagation.
Patch 3 (reworked in v3 following Richard Genoud's review) fixes
pre-existing leaks of dirs->entry on the error paths of
sqfs_search_dir(), by centralizing the cleanup at the 'out' label.
All patches are independent and can be reviewed separately.
The bug was first observed on U-Boot v2024.01 and is still present
on v2026.04. The patches have been tested on a Raspberry Pi CM4
running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB
squashfs rootfs containing 22 517 inodes. The symlink
/boot/Image -> Image-6.6.63-v8 now resolves successfully.
This series addresses the bug reported at:
https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html
Link: https://lore.kernel.org/r/[email protected]
|
|
Several error paths in sqfs_search_dir() return through 'goto out'
while a directory entry obtained from sqfs_readdir_nest() is still
held, leaking dirs->entry: the inode lookup failure, the symlink
nesting limit check, every allocation/tokenization failure during
symlink resolution, and the case where readdir aborts after an
entry was already read.
Instead of freeing dirs->entry at each error site, centralize the
cleanup at the 'out' label: on error, no valid entry may be handed
back to the caller, so it can be freed unconditionally there. On
success, dirs->entry is already NULL: it is freed at the end of
each token iteration and before recursing into a symlink target,
and the root directory path never allocates it.
Explicit frees remain only where a success path needs them:
between reads in the readdir loop, at the end of each token
iteration, and before the recursive call. The now-redundant frees
on individual error paths are removed.
Suggested-by: Richard Genoud <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
sqfs_dir_offset() returns a negative errno on failure, but three
call sites in sqfs_search_dir() use the return value as an array
index without checking for errors first. If the lookup fails,
dirs->table is set to an invalid address, leading to undefined
behavior.
Add negative-value guards after each sqfs_dir_offset() call so
that any lookup failure propagates cleanly as an error rather
than producing incorrect results.
Note: the corresponding sqfs_find_inode() NULL checks and the
heap exhaustion fix during symlink resolution are applied in
separate patches.
Acked-by: Miquel Raynal <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
When sqfs_read_nest() encounters a symlink it resolves it by calling
itself recursively. In the unfixed code this looks like:
// dirsp is open: inode_table + dir_table still on heap
resolved = sqfs_resolve_symlink(symlink, filename);
ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new
// inode_table + dir_table pair
free(resolved);
goto out;
// out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late
There is no permanent leak: the parent's tables are freed at the
out: label once the recursive call returns. However, for the entire
duration of the recursive call both the parent's inode_table +
dir_table and the child's inode_table + dir_table are live on the
heap simultaneously. On large squashfs images these tables can be
significant in size, and this temporary double allocation may exhaust
the heap budget.
A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN,
but that wastes memory on all boards and does not address the
structural problem. The correct fix is to change the freeing order:
release the parent directory's resources before recursing. This way
only one set of inode and directory tables is live at any given time,
halving the peak heap usage during symlink resolution.
When heap exhaustion does occur and malloc returns NULL for dir_table
or pos_list inside sqfs_read_directory_table(), the failure is
currently silent and cascading:
- metablks_count is not reset to -1 before the goto out, so the
function returns a positive block count alongside a NULL pointer.
- sqfs_opendir_nest() does not detect the failure (it only checks
metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL.
- sqfs_dir_offset() iterates over m_list[0..n], reading from
addresses 0x0, 0x4, 0x8, ... None of those values match the
inode's start_block, so the function returns -EINVAL.
- The error propagates up as a load failure with no indication
that the root cause was heap exhaustion:
Error: invalid inode reference to directory table.
Failed to load '<symlink path>'
Two fixes:
1. In sqfs_read_directory_table(), set metablks_count = -1 whenever
malloc fails after sqfs_count_metablks() returns a positive value,
so that the caller's "metablks_count < 1" check correctly detects
the failure and avoids calling sqfs_search_dir() with a NULL
pos_list.
2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on
the parent dirsp before the recursive call so that the parent's
inode and directory tables are freed before the child allocates
its own. Only one set of tables is then live at any given time,
halving peak heap usage during symlink resolution.
Link: https://lists.denx.de/pipermail/u-boot/2026-May/618533.html
Reviewed-by: Richard Genoud <[email protected]>
Acked-by: Miquel Raynal <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
Alexey Charkov <[email protected]> says:
Btrfs in U-boot currently uses a custom callback for ls and doesn't
expose the standard opendir/readdir/closedir interface, making it harder
to use in generic code. One area where this would be useful is in
discovering BLS type 1 entries [1] on a Btrfs filesystem.
Add support for the standard interface, and implement ls in terms of it.
[1] https://lore.kernel.org/u-boot/[email protected]/
Link: https://lore.kernel.org/r/[email protected]
|
|
Now that generic callbacks for opendir/readdir/closedir are implemented,
the custom btrfs_ls() implementation is no longer needed, along with the
btrfs_iter_dir() callback iterator.
Use fs_ls_generic() instead.
Signed-off-by: Alexey Charkov <[email protected]>
Reviewed-by: Qu Wenruo <[email protected]>
|
|
Add support for generic directory iteration with opendir(), readdir() and
closedir() in the btrfs filesystem driver.
Signed-off-by: Alexey Charkov <[email protected]>
Reviewed-by: Qu Wenruo <[email protected]>
|
|
File name and volume name should be const as they will not be modified in
these functions.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Weijie Gao <[email protected]>
|
|
ubifs_finddir() can return a negative error code (-ENOMEM or
PTR_ERR(dent)) and returns 1 when the name is found in the directory.
Fix the result check accordingly.
This fixes file existence detection (for "test -e") when U-Boot uses
UBIFS through ops ubifs_exists(). Since this function is also called
before other file operations, commands such as "load" could be executed
on a non-existing file without reporting an error.
Fixes: 0cab29ff467e ("fs: ubifs: Fix and rework error handling in ubifs_finddir")
Signed-off-by: Patrick Delaunay <[email protected]>
|
|
Restyle all Kconfigs for "fs":
Menu entries : no space left
Menu attributes: 1 TAB
Help text : 1 TAB + 2 spaces
Replace '---help---' by 'help'
Signed-off-by: Johan Jonker <[email protected]>
|
|
The FAT time format stores seconds/2 in bits 4:0. The expression
'tm.tm_sec > 1' is a boolean comparison (yields 0 or 1) where a
right-shift 'tm.tm_sec >> 1' was intended. As a result every
file timestamp written by U-Boot has its seconds field set to
either 0 or 1, depending on whether tm_sec is greater than 1.
Also fix the indentation of the tm_hour line.
Fixes: ba23c378c544 ("fs: fat: fill creation and change date")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
This code is dead because it appears after an infinite loop; remove it.
Fixes: d5888d509cc4 ("fs: ubifs: fix bugs involving symlinks in ubifs_findfile")
Signed-off-by: Peter Collingbourne <[email protected]>
Reviewed-by: Heiko Schocher <[email protected]>
hs: corrected the commit ID
|
|
When encountering a symlink pointing to an absolute path, ubifs_findfile
would return the target of the symlink as the result instead of resolving
any following components in the original path. Fix it by following the
same code path that is used for relative paths except that we set the
next inode to the root if we see a leading slash.
The existing code used memcpy and sprintf to copy the symlink target
into a fixed size stack buffer and was therefore vulnerable to buffer
overflows with a sufficiently long symlink target. Fix it by using a
heap buffer for the temporary path during path resolution.
Signed-off-by: Peter Collingbourne <[email protected]>
Fixes: 9d7952e4c636 ("ubifs: Add support for looking up directory and relative symlinks")
|
|
If fat_sect_size = 0 and nr_sect = 0, the value of ret is never initialized.
A random return value is returned.
Initialize ret to 0.
Addresses-Coverity-ID: - 645495 Uninitialized scalar variable
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
It might still be a positive number due to the call to sqfs_disk_read.
This only happens when reading a file from an uncompressed squashfs.
I found this by trying to boot using the extlinux bootmethod, where
positive values are treated as errors.
Signed-off-by: Michael Zimmermann <[email protected]>
Acked-by: Richard Genoud <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Refactor the dirty flag handling a little bit so an inline
function is called instead of directly stuffing a value into
the variable.
This allows variable that holds the flag to be completely removed
if its not used i.e. CONFIG_FAT_WIRTE=n
Signed-off-by: Daniel Palmer <[email protected]>
|
|
Richard Genoud <[email protected]> says:
SquashFS has support in U-Boot, but not in SPL.
This series adds the possibility for the SPL to load files from SquashFS
partitions.
This is useful, for instance, when there's a SquashFS rootfs containing
U-Boot binary.
NB: falcon mode is not supported yet.
Link: https://lore.kernel.org/r/[email protected]
|
|
Implement spl_load_image_sqfs() in spl code.
This will be used in MMC to read a file from a squashfs partition.
Also, loosen squashfs read checks on file size by not failing when a
bigger size than the actual file size is requested. (Just read the file)
This is needed for FIT loading, because the length is ALIGNed.
Signed-off-by: Richard Genoud <[email protected]>
Reviewed-by: Miquel Raynal <[email protected]>
Reviewed-by: João Marcos Costa <[email protected]>
|
|
Switch to if (CONFIG_IS_ENABLED()) instead of #if when possible and
remove unnecessary cases.
Signed-off-by: Richard Genoud <[email protected]>
Reviewed-by: Miquel Raynal <[email protected]>
Reviewed-by: João Marcos Costa <[email protected]>
|
|
CONFIG_IS_ENABLED() must be used in place of IS_ENABLED() for config
options that have a _SPL_ counterpart.
Signed-off-by: Richard Genoud <[email protected]>
Reviewed-by: Miquel Raynal <[email protected]>
Reviewed-by: João Marcos Costa <[email protected]>
|
|
Varadarajan Narayanan <[email protected]> says:
The disk_read() and disk_write() functions of the FAT driver use the
blk_dread() and blk_dwrite() respectively. The blk_* APIs read and write
to the devices in terms of the device block size. However, the FAT
driver reads in terms of the device block size (from fat_set_blk_dev and
read_bootsectandvi) and sector size in the rest of the places.
This causes buffer overflows or partial reads when the FAT sector size
is not equal to device block size. Fix this by using blk_dread in
fat_set_blk_dev and read_bootsectandvi instead of disk_read. And update
disk_read/disk_write to handle FAT sector size and block size mismatch.
Tested on
blksz | FAT sector size
------+----------------
4096 | 4096
512 | 512
4096 | 512
512 | 4096
CI test results
---------------
https://github.com/u-boot/u-boot/pull/871
All checks have passed
93 successful checks
No conflicts with base branch
Code size change info
---------------------
arm: (for 1/1 boards) all +32.0 text +32.0
qemu_arm : all +32 text +32
u-boot: add: 0/0, grow: 2/0 bytes: 24/0 (24)
function old new delta
read_bootsectandvi 420 432 +12
fat_set_blk_dev 204 216 +12
aarch64: (for 1/1 boards) all +12.0 rodata -8.0 text +20.0
qemu_arm64 : all +12 rodata -8 text +20
u-boot: add: 0/0, grow: 2/0 bytes: 20/0 (20)
function old new delta
read_bootsectandvi 408 420 +12
fat_set_blk_dev 204 212 +8
aarch64: (for 1/1 boards) all -2.0 data -8.0 rodata +6.0
qcom_qcs9100 : all -2 data -8 rodata +6
u-boot: add: 1/-1, grow: 8/-1 bytes: 708/-224 (484)
function old new delta
disk_rw - 628 +628
read_bootsectandvi 408 428 +20
fat_itr_root 500 520 +20
get_cluster 376 388 +12
set_contents 2076 2084 +8
fat_set_blk_dev 204 212 +8
static.set_fatent_value 536 540 +4
get_fatent 420 424 +4
fat_next_cluster 368 372 +4
disk_read 100 - -100
disk_write 132 8 -124
Link: https://lore.kernel.org/r/[email protected]
|
|
The disk_read() and disk_write() functions of the FAT driver use the
blk_dread() and blk_dwrite() respectively. The blk_* APIs read and write
to the devices in terms of the device block size. However, the FAT
driver reads in terms of the device block size (from fat_set_blk_dev and
read_bootsectandvi) and sector size in the rest of the places.
This causes buffer overflows or partial reads when the FAT sector size
is not equal to device block size. Fix this by using blk_dread in
fat_set_blk_dev and read_bootsectandvi instead of disk_read. And update
disk_read/disk_write to handle FAT sector size and block size mismatch.
Tested on
blksz | FAT sector size
------+----------------
4096 | 4096
512 | 512
4096 | 512
512 | 4096
Signed-off-by: Varadarajan Narayanan <[email protected]>
|
|
Prepare v2026.04-rc3
|
|
sqfs_frag_lookup() reads a 16-bit metadata block header whose lower
15 bits encode the data size. Unlike sqfs_read_metablock() in
sqfs_inode.c, this function does not validate that the decoded size is
within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can
set the size field to any value up to 32767, causing memcpy to write
past the 8192-byte 'entries' heap buffer.
Add the same bounds check used by sqfs_read_metablock(): reject any
metadata block header with SQFS_METADATA_SIZE(header) exceeding
SQFS_METADATA_BLOCK_SIZE.
Found by fuzzing with libFuzzer + AddressSanitizer.
Signed-off-by: Eric Kilmer <[email protected]>
Reviewed-by: Miquel Raynal <[email protected]>
|
|
Remove DECLARE_GLOBAL_DATA_PTR from files where gd is not used, and
drop the unnecessary inclusion of asm/global_data.h.
Headers should be included directly by the files that need them,
rather than indirectly via global_data.h.
Reviewed-by: Patrice Chotard <[email protected]> #STMicroelectronics boards and STM32MP1 ram test driver
Tested-by: Anshul Dalal <[email protected]> #TI boards
Acked-by: Yao Zi <[email protected]> #TH1520
Signed-off-by: Peng Fan <[email protected]>
|
|
This series from Timo tp Preißl <[email protected]> fixes some
(potential) interger overflows in some filesystems by using
__builtin_XXX_overflow helps to catch issues.
Link: https://lore.kernel.org/r/[email protected]
|
|
An integer overflow in gdsize_total calculation could lead
to under-allocation and heap buffer overflow.
Signed-off-by: Timo tp Preißl <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
An integer overflow in length calculation could lead to
under-allocation and buffer overcopy.
Signed-off-by: Timo tp Preißl <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: João Marcos Costa <[email protected]>
|
|
An integer overflow in nvlist size calculation could lead
to under-allocation and heap buffer overflow.
Signed-off-by: Timo tp Preißl <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
An integer overflow in size calculations could lead to
under-allocation and potential heap buffer overflow.
Signed-off-by: Timo tp Preißl <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
If zalloc fails, one needs to free memory previously
allocated in the function. This commit makes sure that
we do not leak any memory.
Signed-off-by: Francois Berder <[email protected]>
Fixes: ed34f34dbaf2 ("ext4fs write support")
Acked-by: Quentin Schulz <[email protected]>
|
|
https://source.denx.de/u-boot/custodians/u-boot-socfpga into next
This pull request brings together a set of fixes and enhancements across
the SoCFPGA platform family, with a focus on MMC/SPL robustness, EFI
boot enablement, and Agilex5 SD/eMMC support.
CI: https://source.denx.de/u-boot/custodians/u-boot-socfpga/-/pipelines/28776
Highlights:
*
SPL / MMC:
o
Fix Kconfig handling for
SYS_MMCSD_RAW_MODE_U_BOOT_USE_PARTITION_TYPE
o
Correct raw sector calculations and respect explicit sector values
when loading U-Boot from MMC in SPL
o
Adjust raw MMC loading logic for SoCFPGA platforms
*
EFI boot:
o
Permit EFI booting on SoCFPGA platforms
o
Disable mkeficapsule tool build for Arria 10 where unsupported
*
Agilex5:
o
Upgrade SDHCI controller from SD4HC to SD6HC
o
Enable MMC and Cadence SDHCI support in defconfig
o
Add dedicated eMMC device tree and defconfig for Agilex5 SoCDK
o
Revert incorrect GPIO configuration for SDIO_SEL
o
Refine U-Boot DT handling for SD and eMMC boot variants
*
SPI:
o
Allow disabling the DesignWare SPI driver in SPL via Kconfig
*
Board / configuration fixes:
o
Enable random MAC address generation for Cyclone V
o
Fix DE0-Nano-SoC boot configuration
o
Remove obsolete or conflicting options from multiple legacy
SoCFPGA defconfigs
|
|
We do not perform a check on the value of getsize in get_fatent to
ensure that it will fit within the allocated buffer. For safety sake,
add a check now and if the value exceeds FATBUFBLOCKS use that value
instead. While not currently actively exploitable, it was in the past so
adding this check is worthwhile.
This addresses CVE-2025-24857 and was originally reported by Harvey
Phillips of Amazon Element55.
Signed-off-by: Tom Rini <[email protected]>
|
|
Building this code on 64bit platforms leads to warnings (and so errors
in CI). Rather than rework the code, as this is a deprecated filesystem,
don't try and disallow building on 64bit hosts.
Signed-off-by: Tom Rini <[email protected]>
|
|
If realloc failed, raw was not freed and thus memory
was leaked.
Signed-off-by: Francois Berder <[email protected]>
|
|
After calling a function that can return an error, the test to detect
that error should use the return value not a different variable. Fix it.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Reviewed-by: Sean Anderson <[email protected]>
Fixes: f676b45151c3 ("fs: Add semihosting filesystem")
|
|
Testing an unsigned variable to be >= 0 will always be true so remove
this redundant test.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Returning immediately from sqfs_read_nest is not consistent with other
error checks in this function and can lead to memory leaks. Instead use
the unwind goto used elsewhere to ensure that the memory is freed.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Acked-by: Quentin Schulz <[email protected]>
Reviewed-by: Joao Marcos Costa <[email protected]>
|
