| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Nicolas Bidron and Nicolas Guigo reported the two bugs below:
"
----------BUG 1----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.
This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).
Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
```C
} else if (h >= thisfrag) {
/* overlaps with initial part of the hole: move this hole */
newh = thisfrag + (len / 8);
*newh = *h;
h = newh;
if (h->next_hole)
payload[h->next_hole].prev_hole = (h - payload);
if (h->prev_hole)
payload[h->prev_hole].next_hole = (h - payload);
else
first_hole = (h - payload);
} else {
```
Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.
Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.
### Recommendation
Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
----------BUG 2----------
In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.
This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.
```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
static u16 first_hole, total_len;
struct hole *payload, *thisfrag, *h, *newh;
struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
uchar *indata = (uchar *)ip;
int offset8, start, len, done = 0;
u16 ip_off = ntohs(ip->ip_off);
/* payload starts after IP header, this fragment is in there */
payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
offset8 = (ip_off & IP_OFFS);
thisfrag = payload + offset8;
start = offset8 * 8;
len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```
The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.
```C
/* finally copy this fragment and possibly return whole packet */
memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```
In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
### Recommendation
Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
Add a check for ip_len lesser than 28 and stop processing the packet
in this case.
Such a check covers the two reported bugs.
Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
|
|
This patch mitigates the vulnerability identified via CVE-2019-14196.
The previous patch was bypassed/ineffective, and now the vulnerability
is identified via CVE-2022-30767. The patch removes the sanity check
introduced to mitigate CVE-2019-14196 since it's ineffective.
filefh3_length is changed to unsigned type integer, preventing negative
numbers from being used during comparison with positive values during
size sanity checks.
Signed-off-by: Andrea zi0Black Cappa <zi0Black@protonmail.com>
|
|
Add helper to resolve PHY node from it's ofnode via DM MDIO subsystem.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Stefan Roese <sr@denx.de>
|
|
Add a bootdev driver for Ethernet. It can use the PXE boot mechanism to
locate a file, added later.
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
- U-boot's PXE flow supports prefixing your bootfile name with an
IP address to fetch from a server other than the DHCP server,
e.g. `hostIPaddr:bootfilename`:
https://github.com/u-boot/u-boot/commit/a93907c43f847f076dd0e34ee3b69b5e8e6d0d29
- However, this breaks bootfile paths which contain a colon, e.g.
`f0:ad:4e:10:1b:87/7/pxelinux.cfg/default`
- This patch checks whether the `hostIPaddr` prefix is a valid
IP address before overriding the serverIP otherwise the whole
bootfile path is preserved
Signed-off-by: Lyle Franklin <lylejfranklin@gmail.com>
|
|
Some globals where not properly initialized causing timeouts
as data packets where not immediately acknowledged.
Fixes: cc6b87ecaa96 ("net: tftp: Add client support for RFC 7440")
Signed-off-by: Arjan Minzinga Zijlstra <arjan.minzingazijlstra@fox-it.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
Rename constant PHY_INTERFACE_MODE_NONE to PHY_INTERFACE_MODE_NA to make
it compatible with Linux' naming.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Stefan Roese <sr@denx.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
|
|
Add helpers ofnode_read_phy_mode() and dev_read_phy_mode() to parse the
"phy-mode" / "phy-connection-type" property. Add corresponding UT test.
Use them treewide.
This allows us to inline the phy_get_interface_by_name() into
ofnode_read_phy_mode(), since the former is not used anymore.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Patrice Chotard <patrice.chotard@foss.st.com>
|
|
Use the new dm_mdio_read/write/reset() wrappers treewide, instead of
always getting and dereferencing MDIO operations structure pointer.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
|
|
Add wrappers dm_mdio_read(), dm_mdio_write() and dm_mdio_reset() for
DM MDIO's .read(), .write() and .reset() operations.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
|
|
Add helpers ofnode_get_phy_node() and dev_get_phy_node() and use it in
net/mdio-uclass.c function dm_eth_connect_phy_handle(). Also add
corresponding UT test.
This is useful because other part's of U-Boot may want to get PHY ofnode
without connecting a PHY.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
|
|
Use the ARRAY_SIZE() macro instead of hardcoding sizes of arrays in
macros.
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
|
|
These global variables should both have type
static const char * const
Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
|
|
This converts the following to Kconfig:
CONFIG_SYS_RX_ETH_BUFFER
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This converts the following to Kconfig:
CONFIG_TFTP_PORT
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This converts the following to Kconfig:
CONFIG_SYS_FAULT_ECHO_LINK_DOWN
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This converts the following to Kconfig:
CONFIG_NFS_TIMEOUT
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This converts the following to Kconfig:
CONFIG_NET_RETRY_COUNT
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This converts the following to Kconfig:
CONFIG_ARP_TIMEOUT
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
This option is not in use anywhere and the documentation implies it's
for some very old and unlikely to be seen currently issues. Rather than
update the code so the CONFIG symbol could be easily in Kconfig, remove
the code.
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Ramon Fried <rfried.dev@gmail.com>
|
|
Use IS_ENABLED() instead, to reduce the number of build paths.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
This converts the following to Kconfig:
CONFIG_BOOTP_SERVERIP
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
This converts the following to Kconfig:
CONFIG_TIMESTAMP
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
This converts the following to Kconfig:
CONFIG_UDP_CHECKSUM
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
This converts the following to Kconfig:
CONFIG_KEEP_SERVERADDR
Drop the preprocessor usage also.
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request doc-2022-04-rc1
Replace @return by Return: in code comments.
|
|
Sphinx expects Return: and not @return to indicate a return value.
find . -name '*.c' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;
find . -name '*.h' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
|
|
https://source.denx.de/u-boot/custodians/u-boot-microblaze
Xilinx changes for v2022.04-rc1
gpio:
- Add modepin driver
net:
- Save random mac addresses to eth variable
zynqmp gem:
- Add support for mdio bus DT description
- Add support for reset and SGMII phy configuration
- Reduce timeout for MDIO accesses
zynqmp clk:
- Fix clock handling for gem and usb
phy:
- Add zynqmp phy/serdes driver
serial:
- Add one missing compatible string
microblaze:
- Symbol alignement
- SPL fixups
- Code cleanups
zynqmp:
- Various dt changes, DP pre-reloc, gem resets, gem clocks
- Switch SOM to shared psu configuration
- Move dcache handling to firmware driver
- Workaround gmii2rgmii DT description issue
- Enable broadcasts again
- Change firmware enablement logic
- Small adjustement in firmware driver
versal:
- Support new mmc@ DT nodes
- Fix run time variable handling
- Add missing I2C_PMC ID for power domain
|
|
The fastboot protocol uses per default the UDP port 5554. In some cases
it might be needed to change the used port. The fastboot utility provides
a way to specifiy an other port number to use already.
fastboot -s udp:192.168.1.76:1234 boot fastboot.img
Signed-off-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
If the DSA API is going to allow drivers to do things such as:
- phy_config in dsa_ops :: port_probe
- phy_startup in dsa_ops :: port_enable
then it would actually be good if the ->port_probe() method would
actually be called in all cases before the ->port_enable() is.
Currently this is true for user ports, but not true for the CPU port,
because the CPU port does not have a udevice registered for it (this is
all part of DSA's design). So the current issue is that after
phy_startup has finished for the CPU port, its phydev->speed is an
uninitialized value, because phy_config() was never called for the
priv->cpu_port_fixed_phy, and it is precisely phy_config() who copies
the speed into the phydev in the case of the fixed PHY driver.
So we need to simulate a probing event for the CPU port by manually
calling the driver's ->port_probe() method for the CPU port.
Fixes: 8a2982574854 ("net: dsa: introduce a .port_probe() method in struct dsa_ops")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
When a MAC address is randomly generated we currently only update the
appropriate data structure. For consistency and to re-align with
historic usage, it should be also saved to the appropriate environment
variable as well.
Cc: Wolfgang Denk <wd@denx.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
[trini: Update Kconfig, handle legacy networking case as well]
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Ramon Fried <rfried.dev@gmail.com>
Link: https://lore.kernel.org/r/1a2518e3cc19c14a41875ef64c5acc1f16edc813.1641893287.git.michal.simek@xilinx.com
|
|
set_promisc() call accepts the parameter of a bool type. Make it
clear by using true instead of 1.
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
The VCI string sent during bootp of U-Boot-SPL is corrupt. This is
because the byte counter is not adjusted within the bootp_extended()
function when the VCI string is added. We fix this.
Signed-off-by: Walter Stoll <walter.stoll@duagon.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
|
|
In the current DSA switch driver API, only the udevice of the switch
(belonging to UCLASS_DSA) is exposed, as well as an "int port" argument.
So drivers do not have access to the udevice of individual ports
(belonging to UCLASS_ETH), one of the reasons being that not all ports
have an associated UCLASS_ETH udevice.
However, all DSA ports have an OF node, and in some cases the driver
needs a handle to it, for all ports including the CPU port. Example: the
following Linux per-port device tree property:
managed = "in-band-status";
states whether a port should operate with clause 37 in-band autoneg
enabled or not.
This patch exposes a function which can be called by individual drivers
as needed.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
Signed-off-by: Wolfgang Denk <wd@denx.de>
|
|
https://source.denx.de/u-boot/custodians/u-boot-net into next
- Fix some non-NULL terminated strings in the networking subsystem
- net: tsec: Mark tsec_get_interface as __maybe_unused
|
|
truncation
strncpy() simply bails out when copying a source string whose size
exceeds the destination string size, potentially leaving the destination
string unterminated.
One possible way to address is to pass DSA_PORT_NAME_LENGTH - 1 and a
previously zero-initialized destination string, but this is more
difficult to maintain.
The chosen alternative is to use strlcpy(), which properly limits the
copy len in the (srclen >= size) case to "size - 1", and which is also
more efficient than the strncpy() byte-by-byte implementation by using
memcpy. The destination string returned by strlcpy() is always NULL
terminated.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
dm_mdio_post_probe used to be vulnerable after truncation, but has been
patched by commit 398e7512d8d7 ("net: Fix Covarity Defect 244093").
Nonetheless, we can use strlcpy like the rest of the code base now,
which yields the same result.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
"dev" and "dsa_pdata" are unused inside dsa_port_of_to_pdata.
"dsa_priv" is unused inside dsa_port_probe.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
While adding the logic for DSA to register a fixed-link PHY for the CPU
port, I forgot to pass it to the .port_disable method too, just
.port_enable.
Bug had no impact for felix_switch.c, due to the phy argument not being
used, but ksz9477.c does use it => NULL pointer dereference.
Fixes: fc054d563bfb ("net: Introduce DSA class for Ethernet switches")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
Some drivers might want to execute code for each port at probe time, as
opposed to executing code just-in-time for the port selected for
networking.
To cater to that use case, introduce a .port_probe() callback method
into the DSA switch operations which is called for each available port,
at the end of dsa_port_probe().
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
|
|
function
This snippet of code has a bothering "if (...) return 0" in it which
assumes it is the last piece of code running in dsa_port_probe().
This makes it difficult to add further code at the end of dsa_port_probe()
which does not depend on MAC address stuff.
So move the code to a dedicated function which returns void and let the
code flow through.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
|
|
DM DSA uses "err" for error code values, so use this consistently.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
|
|
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
|
|
The code under drivers/net is related to ethernet networking drivers, in
some fashion or another. Drop these from the top-level Makefile and
also move the phy rule into drivers/net/Makefile which is where it
belongs. Make the new rule for drivers/net check for the build-stage
relevant ETH symbol.
Fix up some Kconfig dependencies while we're here to mirror how the
Makefile logic now works.
Signed-off-by: Simon Glass <sjg@chromium.org>
[trini: Introduce ETH, Kconfig dependency changes, am43xx fix]
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
default n/no doesn't need to be specified. It is default option anyway.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
[trini: Rework FSP_USE_UPD portion]
Signed-off-by: Tom Rini <trini@konsulko.com>
|
|
It is a pain to have to specify the value 10 in each call. Add a new
dectoul() function and update the code to use it.
Signed-off-by: Simon Glass <sjg@chromium.org>
|
|
Define LOG_CATEGORY to allow filtering with log command.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
If ports have their own unique MAC addrs and master has a set_promisc
function, call it so that packets will be received for ports.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
|
|
Prepare v2021.07-rc5
# gpg: Signature made Mon 28 Jun 2021 03:39:36 PM EDT
# gpg: using RSA key 1A3C7F70E08FAB1707809BBF147C39FF9634B72C
# gpg: Good signature from "Thomas Rini <trini@konsulko.com>" [ultimate]
# Conflicts:
# configs/am64x_evm_r5_defconfig
|
