diff options
| author | Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com> | 2019-01-26 22:13:04 +0100 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2019-02-02 08:19:17 -0500 |
| commit | 9cc2323feebdde500f50f7abb855045dbde765cb (patch) | |
| tree | 7d4c0bf226c098a560620457a6e4a96321a47bee /net/tftp.c | |
| parent | e3b4fc9598388f47632a8c802aaa68b1154526f2 (diff) | |
lmb: handle more than one DRAM BANK
This fixes the automatic lmb initialization and reservation for boards
with more than one DRAM bank.
This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load
files into the firs DRAM bank from fs and via tftp.
Found-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'net/tftp.c')
| -rw-r--r-- | net/tftp.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/net/tftp.c b/net/tftp.c index eca801aa19..34488b76c8 100644 --- a/net/tftp.c +++ b/net/tftp.c @@ -606,8 +606,7 @@ static int tftp_init_load_addr(void) struct lmb lmb; phys_size_t max_size; - lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start, - gd->bd->bi_dram[0].size, (void *)gd->fdt_blob); + lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob); max_size = lmb_get_free_size(&lmb, load_addr); if (!max_size) |