[PATCH 0/2] board: xilinx: Fix board name overflow and allow board ft_board_setup()

[Sriram Sriram <sriramsriram@linux.microsoft.com>]

Two independent fixes to the xilinx vendor common board file, both found
while bringing a downstream Versal NET board up to date with mainline.

Patch 1 fixes a heap buffer overflow in board_name_decode(). The name is
built with strcat() into a 50 byte allocation, and the length check that
is supposed to catch the overflow only runs after the writes. Each EEPROM
descriptor can contribute up to 29 characters, so a base board plus a
carrier card already overruns the buffer with EEPROM-supplied data.

Patch 2 marks ft_board_setup() __weak so that a board using the xilinx
vendor common library can supply its own device tree fixups, the same way
the file already allows board_name_decode(), board_detection(),
soc_detection() and board_rng_seed() to be overridden. Today such a board
fails to link with "multiple definition of ft_board_setup".

Both patches were build tested on xilinx_zynqmp_kria_defconfig, which
enables CONFIG_DTB_RESELECT and CONFIG_OF_BOARD_SETUP and so compiles
both of the changed functions.

Drew Kluemke (1):
  board: xilinx: Use strlcat() in board_name_decode()

Sriram Sriram (1):
  board: xilinx: Make ft_board_setup() weak

 board/xilinx/common/board.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

-- 
2.49.0