[PATCH v2 0/3] Bounds hardening in NFS, TFTP and ext4

[Sriram Sriram <sriramsriram@linux.microsoft.com>]

Three independent hardening fixes found by internal static analysis and
code review. They do not depend on each other.

Changes in v2:
 - Dropped "boot: image-fit: add overflow guard for FIT decompression
   buffer" (2/4 in v1). As Tom pointed out, max_decomp_len is used both
   as the allocation size and as the unc_len bound handed to
   image_decomp(), so a wrapped multiply cannot leave the bound larger
   than the buffer, and image_decomp() already fails cleanly on a bound
   that is too small. The claim in that commit message was wrong, so the
   patch is withdrawn rather than reworded.
 - net: tftp: replaced the four bounded strncasecmp() comparisons with a
   single check that the packet ends in a NUL, per Tom's review. It is
   smaller (+16 bytes of .text on am335x_evm_defconfig instead of +24)
   and it also covers the dectoul() calls, which v1 left unbounded.
   Retitled to match.
 - Rebased onto current master (a44f46af0aa).
 - No change to the NFS and ext4 patches.

Daniel Munic (1):
  fs: ext4: widen ext4fs_update() block-group loop counter

Drew Kluemke (2):
  net: nfs: add bounds checks on memcpy into stack-allocated rpc_pkt
  net: tftp: verify the OACK packet is NUL terminated

 fs/ext4/ext4_write.c |  2 +-
 net/nfs-common.c     | 10 ++++++++++
 net/tftp.c           |  7 +++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

-- 
2.49.0