From 9cc2323feebdde500f50f7abb855045dbde765cb Mon Sep 17 00:00:00 2001 From: Simon Goldschmidt Date: Sat, 26 Jan 2019 22:13:04 +0100 Subject: lmb: handle more than one DRAM BANK This fixes the automatic lmb initialization and reservation for boards with more than one DRAM bank. This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load files into the firs DRAM bank from fs and via tftp. Found-by: Heinrich Schuchardt Signed-off-by: Simon Goldschmidt Tested-by: Heinrich Schuchardt Reviewed-by: Simon Glass --- fs/fs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'fs/fs.c') diff --git a/fs/fs.c b/fs/fs.c index c05e6c85ed..0e9c2f1062 100644 --- a/fs/fs.c +++ b/fs/fs.c @@ -454,8 +454,7 @@ static int fs_read_lmb_check(const char *filename, ulong addr, loff_t offset, if (len && len < read_len) read_len = len; - lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start, - gd->bd->bi_dram[0].size, (void *)gd->fdt_blob); + lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob); lmb_dump_all(&lmb); if (lmb_alloc_addr(&lmb, addr, read_len) == addr) -- cgit