From 9cc2323feebdde500f50f7abb855045dbde765cb Mon Sep 17 00:00:00 2001 From: Simon Goldschmidt Date: Sat, 26 Jan 2019 22:13:04 +0100 Subject: lmb: handle more than one DRAM BANK This fixes the automatic lmb initialization and reservation for boards with more than one DRAM bank. This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load files into the firs DRAM bank from fs and via tftp. Found-by: Heinrich Schuchardt Signed-off-by: Simon Goldschmidt Tested-by: Heinrich Schuchardt Reviewed-by: Simon Glass --- net/tftp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'net') diff --git a/net/tftp.c b/net/tftp.c index eca801a..34488b7 100644 --- a/net/tftp.c +++ b/net/tftp.c @@ -606,8 +606,7 @@ static int tftp_init_load_addr(void) struct lmb lmb; phys_size_t max_size; - lmb_init_and_reserve(&lmb, gd->bd->bi_dram[0].start, - gd->bd->bi_dram[0].size, (void *)gd->fdt_blob); + lmb_init_and_reserve(&lmb, gd->bd, (void *)gd->fdt_blob); max_size = lmb_get_free_size(&lmb, load_addr); if (!max_size) -- cgit v1.1