Re: [PATCH 01/15] spl: nand: Fix NULL-pointer dereference

Sean Anderson
2023-10-29T14:15:32Z

On 10/28/23 23:48, Sean Anderson wrote:
> spl_nand_fit_read unconditionally accesses load->priv. Ensure it is set.
>
> Fixes: 00e180cc513 ("spl: nand: support loading i.MX container format file")
> Fixes: 4620e8aabc1 ("spl: nand: support loading legacy image with payload compressed")
> Signed-off-by: Sean Anderson <seanga2@gmail.com>
> ---
>
> common/spl/spl_nand.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/common/spl/spl_nand.c b/common/spl/spl_nand.c
> index 07916bedbb9..a19236d9e6d 100644
> --- a/common/spl/spl_nand.c
> +++ b/common/spl/spl_nand.c
> @@ -105,7 +105,7 @@ static int spl_nand_load_element(struct spl_image_info *spl_image,
> struct spl_load_info load;
>
> load.dev = NULL;
> - load.priv = NULL;
> + load.priv = &offset;
> load.filename = NULL;
> load.bl_len = bl_len;
> load.read = spl_nand_fit_read;
> @@ -116,7 +116,7 @@ static int spl_nand_load_element(struct spl_image_info *spl_image,
>
> debug("Found legacy image\n");
> load.dev = NULL;
> - load.priv = NULL;
> + load.priv = &offset;
> load.filename = NULL;
> load.bl_len = 1;
> load.read = spl_nand_legacy_read;

Actually, since spl_nand_legacy_read doesn't reference priv, this second hunk is
unnecessary. Actually, spl_nand_legacy_read and spl_load_legacy_img are technically buggy
since size/offset are supposed to be in units of bl_len. However, this basically just
results in extra multiplies and divides, so I don't think it's desirable. I actually have
a patch to convert everything to bytes (keeping alignment), so "fixing" this is not
necessary for the moment.

--Sean