[PATCH v2 0/2] spl: Fix the uninitialised /fit-images entry point

[PATCH v2 0/2] spl: Fix the uninitialised /fit-images entry point

[Sebastian Alba Vives]

Both the ATF and the OpenSBI hand-off paths look up the next stage's entry
point in a /fit-images node, trying fit_image_get_entry() and falling back
to fit_image_get_load(). Neither site tests the result of the fallback.

fit_image_get_address() returns -1 before it reaches the assignment to
*load in two cases: the property is absent, and the value does not fit in
a target ulong. The caller's ulong is left untouched in both, so a node
with neither property leaves the entry point uninitialised. It reaches
bl31_entry() as the BL33 entry point on ARM, and opensbi_info.next_addr,
the S-mode entry point, on RISC-V.

Both sites came from the same conversion in commit caa7fc2c5775 ("spl: Use
standard FIT entries"). fdt_getprop_u32() returned the value and yielded
FDT_ERROR on failure, so the variable was always assigned; the
fit_image_get_*() accessors moved the failure signal into a return value
that was then ignored.

The two paths differ in what a failed lookup means, so they are fixed
differently. In spl_invoke_atf() the caller has already initialised a
sane default (0 for BL32, CONFIG_TEXT_BASE for BL33), so the out
parameter is the whole fix and there is no status worth returning. In
spl_invoke_opensbi() there is no default, so the boot fails.

Changes in v2:
 - 1/2: drop the int return type. Tom pointed out that neither call site
   checked it, and there is nothing for them to do: the accessors leave
   the out parameter untouched on failure, so the default the caller
   already set up stands. The function is void and the commit message
   now spells out that mechanism. Subject reworded to match.
 - 2/2: unchanged.

v1: https://lore.kernel.org/u-boot/20261012015542.1156811-1-sebasjosue84@gmail.com/

Build-tested with no new warnings:
  sifive_unmatched_defconfig   (riscv64, spl/u-boot-spl)
  cm3588-nas-rk3588_defconfig  (aarch64, spl/u-boot-spl, covers spl_atf.c)

Sebastian Alba Vives (2):
  spl: atf: Keep the caller's default when the entry lookup fails
  spl: opensbi: Check the return of the entry/load lookup

 common/spl/spl_atf.c     | 21 ++++++++++++---------
 common/spl/spl_opensbi.c |  5 +++++
 2 files changed, 17 insertions(+), 9 deletions(-)

-- 
2.43.0

[PATCH v2 1/2] spl: atf: Keep the caller's default when the entry lookup fails

[Sebastian Alba Vives]

spl_fit_images_get_entry() reads the entry point of a /fit-images node
with fit_image_get_entry(), falling back to fit_image_get_load(). Both
report failure through their return value and leave the caller's ulong
untouched: fit_image_get_address() returns -1 before it reaches the
*load assignment, both when the property is absent and when the value
does not fit in a target ulong.

The result was stored in ret but never tested, so a node carrying
neither an entry nor a load property made the function return an
uninitialised stack value, after first reading it in the debug() call.
spl_invoke_atf() hands that value to bl31_entry() as the BL33 entry
point, overwriting the CONFIG_TEXT_BASE default the caller set up for
exactly this case.

Before commit caa7fc2c5775 ("spl: Use standard FIT entries") the lookup
used fdt_getprop_u32(), which returns the value itself and yields
FDT_ERROR on failure, so the variable was always assigned. Switching to
the fit_image_get_*() accessors moved the failure signal into the
return value, where it was left unchecked.

Pass the entry point out through a parameter instead. The accessors
leave it untouched when they fail, so both call sites keep the default
they initialised, and the uninitialised read is gone. A failed lookup
is not an error the caller can act on - the default is the fallback -
so the function returns void rather than a status nobody would check.

Fixes: caa7fc2c5775 ("spl: Use standard FIT entries")
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
---
 common/spl/spl_atf.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/common/spl/spl_atf.c b/common/spl/spl_atf.c
index cb0604ce03..c1233b54cf 100644
--- a/common/spl/spl_atf.c
+++ b/common/spl/spl_atf.c
@@ -252,17 +252,20 @@ static int spl_fit_images_find(void *blob, int os)
 	return found;
 }
 
-ulong spl_fit_images_get_entry(void *blob, int node)
+void spl_fit_images_get_entry(void *blob, int node, ulong *entry)
 {
-	ulong  val;
 	int ret;
 
-	ret = fit_image_get_entry(blob, node, &val);
+	ret = fit_image_get_entry(blob, node, entry);
 	if (ret)
-		ret = fit_image_get_load(blob, node, &val);
-
-	debug("%s: entry point 0x%lx\n", __func__, val);
-	return val;
+		ret = fit_image_get_load(blob, node, entry);
+	if (ret) {
+		debug("%s: no entry or load address, keeping 0x%lx\n",
+		      __func__, *entry);
+		return;
+	}
+
+	debug("%s: entry point 0x%lx\n", __func__, *entry);
 }
 
 void __noreturn spl_invoke_atf(struct spl_image_info *spl_image)
@@ -280,7 +283,7 @@ void __noreturn spl_invoke_atf(struct spl_image_info *spl_image)
 	 */
 	node = spl_fit_images_find(blob, IH_OS_TEE);
 	if (node >= 0)
-		bl32_entry = spl_fit_images_get_entry(blob, node);
+		spl_fit_images_get_entry(blob, node, &bl32_entry);
 
 	/*
 	 * Find the U-Boot binary (in /fit-images) load addreess or
@@ -291,7 +294,7 @@ void __noreturn spl_invoke_atf(struct spl_image_info *spl_image)
 
 	node = spl_fit_images_find(blob, IH_OS_U_BOOT);
 	if (node >= 0)
-		bl33_entry = spl_fit_images_get_entry(blob, node);
+		spl_fit_images_get_entry(blob, node, &bl33_entry);
 
 	/*
 	 * If ATF_NO_PLATFORM_PARAM is set, we override the platform
-- 
2.43.0

[PATCH v2 2/2] spl: opensbi: Check the return of the entry/load lookup

[Sebastian Alba Vives]

spl_invoke_opensbi() takes the next-stage entry point from a
/fit-images node with fit_image_get_entry(), falling back to
fit_image_get_load(). fit_image_get_address() returns -1 without
assigning the caller's ulong, both when the property is absent and
when the address does not fit in a target ulong, so os_entry stays
uninitialised when a node has neither property.

ret was not tested after the fallback, so that uninitialised stack
value became opensbi_info.next_addr, the address OpenSBI jumps to when
it hands control to S-mode.

spl_opensbi_find_os_node() selects the first /fit-images subnode whose
os property matches the requested type and does not require an entry
or load property, so such a node is reachable.

Fail the boot instead, matching how the rest of the function handles a
device tree it cannot use.

Fixes: caa7fc2c5775 ("spl: Use standard FIT entries")
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
---
 common/spl/spl_opensbi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/common/spl/spl_opensbi.c b/common/spl/spl_opensbi.c
index 0ed6afeacc..a3881f6597 100644
--- a/common/spl/spl_opensbi.c
+++ b/common/spl/spl_opensbi.c
@@ -97,6 +97,11 @@ void __noreturn spl_invoke_opensbi(struct spl_image_info *spl_image)
 	ret = fit_image_get_entry(spl_image->fdt_addr, os_node, &os_entry);
 	if (ret)
 		ret = fit_image_get_load(spl_image->fdt_addr, os_node, &os_entry);
+	if (ret) {
+		pr_err("Can't get entry point or load address for %s, %d\n",
+		       genimg_get_os_name(os_type), ret);
+		hang();
+	}
 
 	/* Prepare opensbi_info object */
 	opensbi_info.magic = FW_DYNAMIC_INFO_MAGIC_VALUE;
-- 
2.43.0

Re: [PATCH v2 2/2] spl: opensbi: Check the return of the entry/load lookup

[Yao Zi]

On Mon, Oct 12, 2026 at 03:46:04PM -0600, Sebastian Alba Vives wrote:
> spl_invoke_opensbi() takes the next-stage entry point from a
> /fit-images node with fit_image_get_entry(), falling back to
> fit_image_get_load(). fit_image_get_address() returns -1 without
> assigning the caller's ulong, both when the property is absent and
> when the address does not fit in a target ulong, so os_entry stays
> uninitialised when a node has neither property.
> 
> ret was not tested after the fallback, so that uninitialised stack
> value became opensbi_info.next_addr, the address OpenSBI jumps to when
> it hands control to S-mode.
> 
> spl_opensbi_find_os_node() selects the first /fit-images subnode whose
> os property matches the requested type and does not require an entry
> or load property, so such a node is reachable.
> 
> Fail the boot instead, matching how the rest of the function handles a
> device tree it cannot use.
> 
> Fixes: caa7fc2c5775 ("spl: Use standard FIT entries")
> Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>

Reviewed-by: Yao Zi <me@ziyao.cc>

> ---
>  common/spl/spl_opensbi.c | 5 +++++
>  1 file changed, 5 insertions(+)

Thanks,
Yao Zi