[U-Boot] [PATCH] drivers: dfu: ram: fix a crash with dfu ram with invalid dfu_alt_info env

[U-Boot] [PATCH] drivers: dfu: ram: fix a crash with dfu ram with invalid dfu_alt_info env

[Mugunthan V N]

U-Boot crashes when an invalid dfu_alt_info is set and tried
using dfu command. Fixing this as it is handled in dfu-mmc.

=> dfu 0 ram 0
data abort
pc : [<9ff893d6>]          lr : [<9ff6edb9>]
reloc pc : [<808323d6>]    lr : [<80817db9>]
sp : 9ef36cf0  ip : 00000158     fp : 9ffbc0b8
r10: 9ffbc0b8  r9 : 9ef36ed8     r8 : 00000000
r7 : 00000000  r6 : 9ffbc0c8     r5 : 9ef36cfc  r4 : 9ef392c8
r3 : 00000004  r2 : 00000000     r1 : 9ff9a985  r0 : ffffffff
Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32
Resetting CPU ...

resetting ...

Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
---

Verified this on AM335x BBB, added logs [1] without fix and with fix

[1]: http://pastebin.ubuntu.com/15978003/

---
 drivers/dfu/dfu_ram.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/dfu/dfu_ram.c b/drivers/dfu/dfu_ram.c
index e094a94..1391a0d 100644
--- a/drivers/dfu/dfu_ram.c
+++ b/drivers/dfu/dfu_ram.c
@@ -54,19 +54,26 @@ static int dfu_read_medium_ram(struct dfu_entity *dfu, u64 offset,
 
 int dfu_fill_entity_ram(struct dfu_entity *dfu, char *devstr, char *s)
 {
-	char *st;
+	const char *argv[3];
+	const char **parg = argv;
+
+	for (; parg < argv + sizeof(argv) / sizeof(*argv); ++parg) {
+		*parg = strsep(&s, " ");
+		if (*parg == NULL) {
+			error("Invalid number of arguments.\n");
+			return -ENODEV;
+		}
+	}
 
 	dfu->dev_type = DFU_DEV_RAM;
-	st = strsep(&s, " ");
-	if (strcmp(st, "ram")) {
-		error("unsupported device: %s\n", st);
+	if (strcmp(argv[0], "ram")) {
+		error("unsupported device: %s\n", argv[0]);
 		return -ENODEV;
 	}
 
 	dfu->layout = DFU_RAM_ADDR;
-	dfu->data.ram.start = (void *)simple_strtoul(s, &s, 16);
-	s++;
-	dfu->data.ram.size = simple_strtoul(s, &s, 16);
+	dfu->data.ram.start = (void *)simple_strtoul(argv[1], NULL, 0);
+	dfu->data.ram.size = simple_strtoul(argv[2], NULL, 0);
 
 	dfu->write_medium = dfu_write_medium_ram;
 	dfu->get_medium_size = dfu_get_medium_size_ram;
-- 
2.8.1.101.g72d917a

[U-Boot] [PATCH] drivers: dfu: ram: fix a crash with dfu ram with invalid dfu_alt_info env

[Lukasz Majewski]

Hi Mugunthan,

> U-Boot crashes when an invalid dfu_alt_info is set and tried
> using dfu command. Fixing this as it is handled in dfu-mmc.
> 
> => dfu 0 ram 0
> data abort
> pc : [<9ff893d6>]          lr : [<9ff6edb9>]
> reloc pc : [<808323d6>]    lr : [<80817db9>]
> sp : 9ef36cf0  ip : 00000158     fp : 9ffbc0b8
> r10: 9ffbc0b8  r9 : 9ef36ed8     r8 : 00000000
> r7 : 00000000  r6 : 9ffbc0c8     r5 : 9ef36cfc  r4 : 9ef392c8
> r3 : 00000004  r2 : 00000000     r1 : 9ff9a985  r0 : ffffffff
> Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32
> Resetting CPU ...
> 
> resetting ...
> 
> Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
> ---
> 
> Verified this on AM335x BBB, added logs [1] without fix and with fix
> 
> [1]: http://pastebin.ubuntu.com/15978003/
> 
> ---
>  drivers/dfu/dfu_ram.c | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/dfu/dfu_ram.c b/drivers/dfu/dfu_ram.c
> index e094a94..1391a0d 100644
> --- a/drivers/dfu/dfu_ram.c
> +++ b/drivers/dfu/dfu_ram.c
> @@ -54,19 +54,26 @@ static int dfu_read_medium_ram(struct dfu_entity
> *dfu, u64 offset, 
>  int dfu_fill_entity_ram(struct dfu_entity *dfu, char *devstr, char
> *s) {
> -	char *st;
> +	const char *argv[3];
> +	const char **parg = argv;
> +
> +	for (; parg < argv + sizeof(argv) / sizeof(*argv); ++parg) {
> +		*parg = strsep(&s, " ");
> +		if (*parg == NULL) {
> +			error("Invalid number of arguments.\n");
> +			return -ENODEV;
> +		}
> +	}
>  
>  	dfu->dev_type = DFU_DEV_RAM;
> -	st = strsep(&s, " ");
> -	if (strcmp(st, "ram")) {
> -		error("unsupported device: %s\n", st);
> +	if (strcmp(argv[0], "ram")) {
> +		error("unsupported device: %s\n", argv[0]);
>  		return -ENODEV;
>  	}
>  
>  	dfu->layout = DFU_RAM_ADDR;
> -	dfu->data.ram.start = (void *)simple_strtoul(s, &s, 16);
> -	s++;
> -	dfu->data.ram.size = simple_strtoul(s, &s, 16);
> +	dfu->data.ram.start = (void *)simple_strtoul(argv[1], NULL,
> 0);
> +	dfu->data.ram.size = simple_strtoul(argv[2], NULL, 0);
>  
>  	dfu->write_medium = dfu_write_medium_ram;
>  	dfu->get_medium_size = dfu_get_medium_size_ram;

Acked-by: Lukasz Majewski <l.majewski@samsung.com>

Build tested with buildman:
./tools/buildman/buildman.py --branch=HEAD ti --detail --verbose
--show_errors --force-build --count=9 --output-dir=./BUILD/

-- 
Best regards,

Lukasz Majewski

Samsung R&D Institute Poland (SRPOL) | Linux Platform Group

[U-Boot] [PATCH] drivers: dfu: ram: fix a crash with dfu ram with invalid dfu_alt_info env

[Tom Rini]

On Fri, Apr 22, 2016 at 02:19:25PM +0530, Mugunthan V N wrote:

> U-Boot crashes when an invalid dfu_alt_info is set and tried
> using dfu command. Fixing this as it is handled in dfu-mmc.
> 
> => dfu 0 ram 0
> data abort
> pc : [<9ff893d6>]          lr : [<9ff6edb9>]
> reloc pc : [<808323d6>]    lr : [<80817db9>]
> sp : 9ef36cf0  ip : 00000158     fp : 9ffbc0b8
> r10: 9ffbc0b8  r9 : 9ef36ed8     r8 : 00000000
> r7 : 00000000  r6 : 9ffbc0c8     r5 : 9ef36cfc  r4 : 9ef392c8
> r3 : 00000004  r2 : 00000000     r1 : 9ff9a985  r0 : ffffffff
> Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32
> Resetting CPU ...
> 
> resetting ...
> 
> Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>

Reviewed-by: Tom Rini <trini@konsulko.com>

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20160422/5f471446/attachment.sig>