summaryrefslogtreecommitdiffstats
path: root/arch/mips/lib/reloc.c
diff options
context:
space:
mode:
authorAntony Pavlov <antonynpavlov@gmail.com>2019-06-18 12:38:33 +0300
committerSascha Hauer <s.hauer@pengutronix.de>2019-06-20 16:34:00 +0200
commit2cd8bd64a360910943cf22f239cc946354b1ae47 (patch)
treef41b9cb1f557e793912c11850694c42733bc6380 /arch/mips/lib/reloc.c
parentfc650c044ce27b3b7e6b0efd9e831d64c8518b28 (diff)
downloadbarebox-2cd8bd64a360910943cf22f239cc946354b1ae47.tar.gz
MIPS: relocate_code: fix barebox image memcpy() size
In this relocate_code() piece 'length' is greater than 'barebox_image_size': #define MAX_BSS_SIZE SZ_1M ... length = barebox_image_size + MAX_BSS_SIZE; relocaddr = ALIGN_DOWN(ram_size - barebox_image_size, SZ_64K); ... memcpy((void *)relocaddr, __image_start, length); so 'ram_size' overflow occurs during memcpy(). Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com> Tested-by: Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'arch/mips/lib/reloc.c')
-rw-r--r--arch/mips/lib/reloc.c11
1 files changed, 5 insertions, 6 deletions
diff --git a/arch/mips/lib/reloc.c b/arch/mips/lib/reloc.c
index 9756d61..14ba616 100644
--- a/arch/mips/lib/reloc.c
+++ b/arch/mips/lib/reloc.c
@@ -40,8 +40,6 @@
#include <linux/sizes.h>
#include <asm-generic/memory_layout.h>
-#define MAX_BSS_SIZE SZ_1M
-
void main_entry(void *fdt, u32 fdt_size);
void relocate_code(void *fdt, u32 fdt_size, u32 relocaddr);
@@ -127,8 +125,10 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size)
unsigned int type;
long off;
- length = barebox_image_size + MAX_BSS_SIZE;
- relocaddr = ALIGN_DOWN(ram_size - barebox_image_size, SZ_64K);
+ bss_len = (unsigned long)&__bss_stop - (unsigned long)__bss_start;
+
+ length = barebox_image_size + bss_len;
+ relocaddr = ALIGN_DOWN(ram_size - length, SZ_64K);
relocaddr = KSEG0ADDR(relocaddr);
new_stack = relocaddr - MALLOC_SIZE - 16;
@@ -143,7 +143,7 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size)
panic("Mis-aligned relocation\n");
/* Copy Barebox to RAM */
- memcpy((void *)relocaddr, __image_start, length);
+ memcpy((void *)relocaddr, __image_start, barebox_image_size);
/* Now apply relocations to the copy in RAM */
buf = __rel_start;
@@ -162,7 +162,6 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size)
/* Clear the .bss section */
bss_start = (uint8_t *)((unsigned long)__bss_start + off);
- bss_len = (unsigned long)&__bss_stop - (unsigned long)__bss_start;
memset(bss_start, 0, bss_len);
__asm__ __volatile__ (