bootm: fix size arg of flush_cache() in bootm_load_os().
PATCH 1/1 bootm: fix size arg of flush_cache() in bootm_load_os().
Variable _load_end_ points to end address of uncompressed buffer (*not* uncomress_buffer_end / sizeof(ulong)), so multipling uncompressed size with sizeof(ulong) is grossly incorrect in flush_cache().
It might lead to access of address beyond valid memory range and hang the CPU.
Tested on MIPS architecture by using compressed(gzip, lzma) and uncompressed uImage.
---
common/bootm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
common/bootm.c +1 -1
@@ -435,7 +435,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end,bootstage_error (BOOTSTAGE_ID_DECOMP_IMAGE );return err; } -flush_cache (load, (*load_end - load) *sizeof (ulong)); +flush_cache (load, *load_end - load);debug (" kernel loaded at 0x%08lx, end = 0x%08lx\n" , load, *load_end);bootstage_mark (BOOTSTAGE_ID_KERNEL_LOADED );
Signature · 1 line
1.8.3.1
PATCH 1/1 bootm: fix size arg of flush_cache() in bootm_load_os().
Quoted 5 lines · Purna Chandra Mandal
Variable _load_end_ points to end address of uncompressed buffer (*not*
uncomress_buffer_end/ sizeof(ulong)), so multipling uncompressed size with sizeof(ulong) is grossly incorrect inflush_cache().
It might lead to access of address beyond valid memory range and hang the CPU.
Quoted 8 lines
Tested on MIPS architecture by using
compressed(gzip, lzma)and uncompressed uImage.Signed-off-by Purna Chandra Mandal <[email protected]>---
common/bootm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
PATCH 1/1 bootm: fix size arg of flush_cache() in bootm_load_os().
In reply to Purna Chandra MandalAm Mittwoch, den 20.01.2016, 14:07 +0530 schrieb Purna Chandra Mandal:
Quoted 11 lines
Variable _load_end_ points to end address of uncompressed buffer (*not*
uncomress_buffer_end/ sizeof(ulong)), so multipling uncompressed
size with sizeof(ulong) is grossly incorrect inflush_cache(). It might lead to access of address beyond valid memory range and hang the CPU.Tested on MIPS architecture by using
compressed(gzip, lzma)and uncompressed uImage.Signed-off-by Purna Chandra Mandal <[email protected]>
Quoted 20 lines
---
common/bootm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)common/bootm.c +1
-1@@ -435,7 +435,7 @@ static int bootm_load_os(bootm_headers_t *images,unsigned long *load_end,bootstage_error (BOOTSTAGE_ID_DECOMP_IMAGE );return err; } -flush_cache (load, (*load_end - load) *sizeof (ulong)); +flush_cache (load, *load_end - load); debug(" kernel loaded at 0x%08lx, end = 0x%08lx\n", load,
*load_end);
bootstage_mark(BOOTSTAGE_ID_KERNEL_LOADED);
Signature · 1 line
- Daniel
Quoted 11 lines · Purna Chandra Mandal
Variable _load_end_ points to end address of uncompressed buffer (*not*
uncomress_buffer_end/ sizeof(ulong)), so multipling uncompressed size with sizeof(ulong) is grossly incorrect inflush_cache().
It might lead to access of address beyond valid memory range and hang the CPU.Tested on MIPS architecture by using
compressed(gzip, lzma)and uncompressed uImage.Signed-off-by Purna Chandra Mandal <[email protected]>Reviewed-by Simon Glass <[email protected]>Reviewed-by Daniel Schwierzeck <[email protected]>
Applied to u-boot/master, thanks!
Signature · 8 lines
Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20160125/955e186f/attachment.sig>