diff options
| author | Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com> | 2019-01-26 22:13:04 +0100 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2019-02-02 08:19:17 -0500 |
| commit | 9cc2323feebdde500f50f7abb855045dbde765cb (patch) | |
| tree | 7d4c0bf226c098a560620457a6e4a96321a47bee /fs/fs.c | |
| parent | e3b4fc9598388f47632a8c802aaa68b1154526f2 (diff) | |
| download | u-boot-9cc2323feebdde500f50f7abb855045dbde765cb.tar.gz u-boot-9cc2323feebdde500f50f7abb855045dbde765cb.tar.xz u-boot-9cc2323feebdde500f50f7abb855045dbde765cb.zip | |
lmb: handle more than one DRAM BANK
This fixes the automatic lmb initialization and reservation for boards
with more than one DRAM bank.
This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load
files into the firs DRAM bank from fs and via tftp.
Found-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'fs/fs.c')
| -rw-r--r-- | fs/fs.c | 3 |
1 files changed, 1 insertions, 2 deletions
@@ -454,8 +454,7 @@ static int fs_read_lmb_check(const char *filename, ulong addr, loff_t offset, if (len && len < read_len) read_len = len; - lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start, - gd->bd->bi_dram[0].size, (void *)gd->fdt_blob); + lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob); lmb_dump_all(&lmb); if (lmb_alloc_addr(&lmb, addr, read_len) == addr) |