[PATCH 0/2] fpga: zynqpl: fix bitstream header scan length checks

[PATCH 0/2] fpga: zynqpl: fix bitstream header scan length checks

[Michal Simek]

Hi,

This series fixes bitstream header scan length checks in
check_data(), reachable from fpga load and fpga loadfs.

Patch 1 stops the bitstream header scan once there's no longer
enough room left for a full header. The old scan kept checking
positions near the end of the buffer that could never hold a
complete header, and a match there caused an unbounded header
read to go past the buffer end.

Patch 2 fixes zynq_loadfs() passing blocksize into
zynq_validate_bitstream() after fs_read(), even when actread
was smaller. Pass actread so the scan length matches the bytes
actually written into the buffer.

Thanks,
Michal


Suraj Kakade (2):
  fpga: zynqpl: use actread for bitstream scan in zynq_loadfs
  fpga: zynqpl: stop header scan once a full header can't fit

 drivers/fpga/zynqpl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

---

-- 
2.43.0

[PATCH 1/2] fpga: zynqpl: use actread for bitstream scan in zynq_loadfs

[Michal Simek]

From: Suraj Kakade <suraj.hanumantkakade@amd.com>

zynq_loadfs() called zynq_validate_bitstream() with blocksize after
fs_read(), even when actread was smaller. check_data() then scanned
past the bytes actually written into the buffer.

Pass actread instead of blocksize so the header scan length matches
what fs_read() wrote.

Fixes: 1a897668ac33 ("fpga: Added support to load bit stream from SD/MMC")
Signed-off-by: Suraj Kakade <suraj.hanumantkakade@amd.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
---

 drivers/fpga/zynqpl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fpga/zynqpl.c b/drivers/fpga/zynqpl.c
index 5a37a33b0a70..e8046995d7ca 100644
--- a/drivers/fpga/zynqpl.c
+++ b/drivers/fpga/zynqpl.c
@@ -445,7 +445,7 @@ static int zynq_loadfs(xilinx_desc *desc, const void *buf, size_t bsize,
 	if (fs_read(filename, (u32) buf, pos, blocksize, &actread) < 0)
 		return FPGA_FAIL;
 
-	if (zynq_validate_bitstream(desc, buf, bsize, blocksize, &swap,
+	if (zynq_validate_bitstream(desc, buf, bsize, actread, &swap,
 				    &partialbit))
 		return FPGA_FAIL;
 
-- 
2.43.0

[PATCH 2/2] fpga: zynqpl: stop header scan once a full header can't fit

[Michal Simek]

From: Suraj Kakade <suraj.hanumantkakade@amd.com>

The bitstream header scan didn't check whether enough bytes were
left in the buffer before testing for a match. Near the end of the
buffer this let it examine positions that could never hold a
complete header, and a match there caused the subsequent header
read to go past the end of the buffer.

Stop the scan once there isn't enough room left for a full header.
This only bounds the scan, a buffer just big enough to match the
header but with no data behind it would still pass, no minimum
bitstream size is enforced here.

Fixes: d5dae85f23c7 ("fpga: zynq: Add support for loading bitstream")
Signed-off-by: Suraj Kakade <suraj.hanumantkakade@amd.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
---

 drivers/fpga/zynqpl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fpga/zynqpl.c b/drivers/fpga/zynqpl.c
index e8046995d7ca..8c4bdb5ccf66 100644
--- a/drivers/fpga/zynqpl.c
+++ b/drivers/fpga/zynqpl.c
@@ -135,7 +135,7 @@ static void *check_data(u8 *buf, size_t bsize, u32 *swap)
 	u32 word, p = 0; /* possition */
 
 	/* Because buf doesn't need to be aligned let's read it by chars */
-	for (p = 0; p < bsize; p++) {
+	for (p = 0; p + sizeof(bin_format) <= bsize; p++) {
 		word = load_word(&buf[p], SWAP_NO);
 		debug("%s: word %x %x/%x\n", __func__, word, p, (u32)&buf[p]);
 
-- 
2.43.0