Check whether the loaded image or entry point does not overlap SPL.
Signed-off-by: Marek Vasut <ma...@denx.de>
---
Cc: "NXP i.MX U-Boot Team" <uboot-...@nxp.com>
Cc: Fabio Estevam <feste...@denx.de>
Cc: Heiko Schocher <h...@denx.de>
Cc: Heinrich Schuchardt <xypron.g...@gmx.de>
Cc: Rasmus Villemoes <rasmus.villem...@prevas.dk>
Cc: Simon Glass <s...@chromium.org>
Cc: Stefano Babic <sba...@denx.de>
Cc: Tom Rini <tr...@konsulko.com>
Cc: Ye Li <ye...@nxp.com>
---
common/spl/spl_legacy.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/common/spl/spl_legacy.c b/common/spl/spl_legacy.c
index 16851c55eb5..b21173baf55 100644
--- a/common/spl/spl_legacy.c
+++ b/common/spl/spl_legacy.c
@@ -7,6 +7,7 @@
#include <image.h>
#include <log.h>
#include <malloc.h>
+#include <asm/sections.h>
#include <spl.h>
#include <lzma/LzmaTypes.h>
@@ -15,6 +16,22 @@
#define LZMA_LEN (1 << 20)
+static void spl_parse_legacy_validate(uintptr_t start, uintptr_t size)
+{
+ uintptr_t spl_start = (uintptr_t)__image_copy_start;
+ uintptr_t spl_end = (uintptr_t)__image_copy_end;
+ uintptr_t end = start + size;
+
+ if ((start >= spl_start && start < spl_end) ||
+ (end > spl_start && end <= spl_end) ||
+ (start < spl_start && end >= spl_end) ||
+ (start > end && end > spl_start))
+ panic("SPL: Image overlaps SPL\n");
+
+ if (size > CONFIG_SYS_BOOTM_LEN)
+ panic("SPL: Image too large\n");
+}
+
int spl_parse_legacy_header(struct spl_image_info *spl_image,
const struct legacy_img_hdr *header)
{
@@ -58,6 +75,9 @@ int spl_parse_legacy_header(struct spl_image_info *spl_image,
"payload image: %32s load addr: 0x%lx size: %d\n",
spl_image->name, spl_image->load_addr, spl_image->size);
+ spl_parse_legacy_validate(spl_image->load_addr, spl_image->size);
+ spl_parse_legacy_validate(spl_image->entry_point, 0);
+
return 0;
}
--
2.39.2
