Changeset c4267b1 in rtems

Timestamp:

04/10/18 07:06:18 (5 years ago)

Author:

David Gibson <david@…>

Branches:

5, master

Children:

8073f95e

Parents:

85d1769

git-author:

David Gibson <david@…> (04/10/18 07:06:18)

git-committer:

Sebastian Huber <sebastian.huber@…> (07/19/18 05:01:11)

Message:

libfdt: Improve sequential write state checking

When creating a tree with the sequential write functions, certain things
have to be done in a certain order. You must create the memory reserve map
and only then can you create the actual tree structure.

The -FDT_ERR_BADSTATE return code is for if you try to do things out of
order. However, we weren't checking that very thoroughly, so it was
possible to generate a corrupted blob if, for example, you started calling
fdt_begin_node() etc. before calling fdt_finish_reservemap().

This makes the state checking more thorough disallow that.

Signed-off-by: David Gibson <david@…>
Tested-by: Alexey Kardashevskiy <aik@…>
Reviewed-by: Alexey Kardashevskiy <aik@…>
Reviewed-by: Simon Glass <sjg@…>

File:

• cpukit/dtc/libfdt/fdt_sw.c (modified) (10 diffs)

cpukit/dtc/libfdt/fdt_sw.c

@@ -58 +58 @@
 static int fdt_sw_probe_(void *fdt)
 {
-        if (fdt_magic(fdt) != FDT_SW_MAGIC)
+        if (fdt_magic(fdt) == FDT_MAGIC)
+                return -FDT_ERR_BADSTATE;
+        else if (fdt_magic(fdt) != FDT_SW_MAGIC)
                 return -FDT_ERR_BADMAGIC;
-        /* FIXME: should check more details about the header state */
         return 0;
 }
@@ -71 +72 @@
         }
 
+/* 'memrsv' state:      Initial state after fdt_create()
+ *
+ * Allowed functions:
+ *      fdt_add_reservmap_entry()
+ *      fdt_finish_reservemap()         [moves to 'struct' state]
+ */
+static int fdt_sw_probe_memrsv_(void *fdt)
+{
+        int err = fdt_sw_probe_(fdt);
+        if (err)
+                return err;
+
+        if (fdt_off_dt_strings(fdt) != 0)
+                return -FDT_ERR_BADSTATE;
+        return 0;
+}
+
+#define FDT_SW_PROBE_MEMRSV(fdt) \
+        { \
+                int err; \
+                if ((err = fdt_sw_probe_memrsv_(fdt)) != 0) \
+                        return err; \
+        }
+
+/* 'struct' state:      Enter this state after fdt_finish_reservemap()
+ *
+ * Allowed functions:
+ *      fdt_begin_node()
+ *      fdt_end_node()
+ *      fdt_property*()
+ *      fdt_finish()                    [moves to 'complete' state]
+ */
+static int fdt_sw_probe_struct_(void *fdt)
+{
+        int err = fdt_sw_probe_(fdt);
+        if (err)
+                return err;
+
+        if (fdt_off_dt_strings(fdt) != fdt_totalsize(fdt))
+                return -FDT_ERR_BADSTATE;
+        return 0;
+}
+
+#define FDT_SW_PROBE_STRUCT(fdt) \
+        { \
+                int err; \
+                if ((err = fdt_sw_probe_struct_(fdt)) != 0) \
+                        return err; \
+        }
+
+/* 'complete' state:    Enter this state after fdt_finish()
+ *
+ * Allowed functions: none
+ */
+
 static void *fdt_grab_space_(void *fdt, size_t len)
 {
@@ -103 +159 @@
                                               sizeof(struct fdt_reserve_entry)));
         fdt_set_off_dt_struct(fdt, fdt_off_mem_rsvmap(fdt));
-        fdt_set_off_dt_strings(fdt, bufsize);
+        fdt_set_off_dt_strings(fdt, 0);
 
         return 0;
@@ -134 +190 @@
         }
 
-        fdt_set_off_dt_strings(buf, bufsize);
         fdt_set_totalsize(buf, bufsize);
+        if (fdt_off_dt_strings(buf))
+                fdt_set_off_dt_strings(buf, bufsize);
 
         return 0;
@@ -145 +202 @@
         int offset;
 
-        FDT_SW_PROBE(fdt);
-
-        if (fdt_size_dt_struct(fdt))
-                return -FDT_ERR_BADSTATE;
+        FDT_SW_PROBE_MEMRSV(fdt);
 
         offset = fdt_off_dt_struct(fdt);
@@ -165 +219 @@
 int fdt_finish_reservemap(void *fdt)
 {
-        return fdt_add_reservemap_entry(fdt, 0, 0);
+        int err = fdt_add_reservemap_entry(fdt, 0, 0);
+
+        if (err)
+                return err;
+
+        fdt_set_off_dt_strings(fdt, fdt_totalsize(fdt));
+        return 0;
 }
 
@@ -171 +231 @@
 {
         struct fdt_node_header *nh;
-        int namelen = strlen(name) + 1;
-
-        FDT_SW_PROBE(fdt);
-
+        int namelen;
+
+        FDT_SW_PROBE_STRUCT(fdt);
+
+        namelen = strlen(name) + 1;
         nh = fdt_grab_space_(fdt, sizeof(*nh) + FDT_TAGALIGN(namelen));
         if (! nh)
@@ -188 +249 @@
         fdt32_t *en;
 
-        FDT_SW_PROBE(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         en = fdt_grab_space_(fdt, FDT_TAGSIZE);
@@ -226 +287 @@
         int nameoff;
 
-        FDT_SW_PROBE(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         nameoff = fdt_find_add_string_(fdt, name);
@@ -263 +324 @@
         int offset, nextoffset;
 
-        FDT_SW_PROBE(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         /* Add terminator */