diff options
| author | Antony Pavlov <antonynpavlov@gmail.com> | 2019-06-18 12:38:33 +0300 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2019-06-20 16:34:00 +0200 |
| commit | 2cd8bd64a360910943cf22f239cc946354b1ae47 (patch) | |
| tree | f41b9cb1f557e793912c11850694c42733bc6380 /arch | |
| parent | fc650c044ce27b3b7e6b0efd9e831d64c8518b28 (diff) | |
| download | barebox-2cd8bd64a360910943cf22f239cc946354b1ae47.tar.gz barebox-2cd8bd64a360910943cf22f239cc946354b1ae47.tar.xz | |
MIPS: relocate_code: fix barebox image memcpy() size
In this relocate_code() piece 'length' is greater than 'barebox_image_size':
#define MAX_BSS_SIZE SZ_1M
...
length = barebox_image_size + MAX_BSS_SIZE;
relocaddr = ALIGN_DOWN(ram_size - barebox_image_size, SZ_64K);
...
memcpy((void *)relocaddr, __image_start, length);
so 'ram_size' overflow occurs during memcpy().
Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/mips/lib/reloc.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/arch/mips/lib/reloc.c b/arch/mips/lib/reloc.c index 9756d61666..14ba6167dd 100644 --- a/arch/mips/lib/reloc.c +++ b/arch/mips/lib/reloc.c @@ -40,8 +40,6 @@ #include <linux/sizes.h> #include <asm-generic/memory_layout.h> -#define MAX_BSS_SIZE SZ_1M - void main_entry(void *fdt, u32 fdt_size); void relocate_code(void *fdt, u32 fdt_size, u32 relocaddr); @@ -127,8 +125,10 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size) unsigned int type; long off; - length = barebox_image_size + MAX_BSS_SIZE; - relocaddr = ALIGN_DOWN(ram_size - barebox_image_size, SZ_64K); + bss_len = (unsigned long)&__bss_stop - (unsigned long)__bss_start; + + length = barebox_image_size + bss_len; + relocaddr = ALIGN_DOWN(ram_size - length, SZ_64K); relocaddr = KSEG0ADDR(relocaddr); new_stack = relocaddr - MALLOC_SIZE - 16; @@ -143,7 +143,7 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size) panic("Mis-aligned relocation\n"); /* Copy Barebox to RAM */ - memcpy((void *)relocaddr, __image_start, length); + memcpy((void *)relocaddr, __image_start, barebox_image_size); /* Now apply relocations to the copy in RAM */ buf = __rel_start; @@ -162,7 +162,6 @@ void relocate_code(void *fdt, u32 fdt_size, u32 ram_size) /* Clear the .bss section */ bss_start = (uint8_t *)((unsigned long)__bss_start + off); - bss_len = (unsigned long)&__bss_stop - (unsigned long)__bss_start; memset(bss_start, 0, bss_len); __asm__ __volatile__ ( |