diff options
| author | Rob Herring <rob.herring@calxeda.com> | 2013-03-22 11:26:21 (GMT) |
|---|---|---|
| committer | Tom Rini <trini@ti.com> | 2013-04-02 20:23:34 (GMT) |
| commit | 60d7d5a63189c9f77a190c9965861dc15482c2d0 (patch) | |
| tree | 68bf7c543f8f282142eb7a10c700b3a3d86341fb /common/env_nand.c | |
| parent | c17b94ec5ec89c63070dd385b6c3a6645761c405 (diff) | |
| download | u-boot-fsl-qoriq-60d7d5a63189c9f77a190c9965861dc15482c2d0.tar.xz | |
env: fix potential stack overflow in environment functions
Most of the various environment functions create CONFIG_ENV_SIZE buffers on
the stack. At least on ARM and PPC which have 4KB stacks, this can overflow
the stack if we have large environment sizes. So move all the buffers off
the stack to static buffers.
Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Diffstat (limited to 'common/env_nand.c')
| -rw-r--r-- | common/env_nand.c | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/common/env_nand.c b/common/env_nand.c index 5b69889..8cc2055 100644 --- a/common/env_nand.c +++ b/common/env_nand.c @@ -64,6 +64,8 @@ env_t *env_ptr = (env_t *)CONFIG_NAND_ENV_DST; env_t *env_ptr; #endif /* ENV_IS_EMBEDDED */ +DEFINE_CACHE_ALIGN_BUFFER(char, env_buf, CONFIG_ENV_SIZE); + DECLARE_GLOBAL_DATA_PTR; /* @@ -173,7 +175,7 @@ static unsigned char env_flags; int saveenv(void) { - env_t env_new; + env_t *env_new = (env_t *)env_buf; ssize_t len; char *res; int ret = 0; @@ -185,14 +187,14 @@ int saveenv(void) if (CONFIG_ENV_RANGE < CONFIG_ENV_SIZE) return 1; - res = (char *)&env_new.data; + res = (char *)env_new->data; len = hexport_r(&env_htab, '\0', 0, &res, ENV_SIZE, 0, NULL); if (len < 0) { error("Cannot export environment: errno = %d\n", errno); return 1; } - env_new.crc = crc32(0, env_new.data, ENV_SIZE); - env_new.flags = ++env_flags; /* increase the serial */ + env_new->crc = crc32(0, env_new->data, ENV_SIZE); + env_new->flags = ++env_flags; /* increase the serial */ if (gd->env_valid == 1) { puts("Erasing redundant NAND...\n"); @@ -201,7 +203,7 @@ int saveenv(void) return 1; puts("Writing to redundant NAND... "); - ret = writeenv(CONFIG_ENV_OFFSET_REDUND, (u_char *)&env_new); + ret = writeenv(CONFIG_ENV_OFFSET_REDUND, (u_char *)env_new); } else { puts("Erasing NAND...\n"); nand_erase_options.offset = CONFIG_ENV_OFFSET; @@ -209,7 +211,7 @@ int saveenv(void) return 1; puts("Writing to NAND... "); - ret = writeenv(CONFIG_ENV_OFFSET, (u_char *)&env_new); + ret = writeenv(CONFIG_ENV_OFFSET, (u_char *)env_new); } if (ret) { puts("FAILED!\n"); @@ -226,7 +228,7 @@ int saveenv(void) int saveenv(void) { int ret = 0; - ALLOC_CACHE_ALIGN_BUFFER(env_t, env_new, 1); + env_t *env_new = (env_t *)env_buf; ssize_t len; char *res; nand_erase_options_t nand_erase_options; @@ -238,7 +240,7 @@ int saveenv(void) if (CONFIG_ENV_RANGE < CONFIG_ENV_SIZE) return 1; - res = (char *)&env_new->data; + res = (char *)env_new->data; len = hexport_r(&env_htab, '\0', 0, &res, ENV_SIZE, 0, NULL); if (len < 0) { error("Cannot export environment: errno = %d\n", errno); @@ -404,7 +406,6 @@ void env_relocate_spec(void) { #if !defined(ENV_IS_EMBEDDED) int ret; - ALLOC_CACHE_ALIGN_BUFFER(char, buf, CONFIG_ENV_SIZE); #if defined(CONFIG_ENV_OFFSET_OOB) ret = get_nand_env_oob(&nand_info[0], &nand_env_oob_offset); @@ -420,13 +421,13 @@ void env_relocate_spec(void) } #endif - ret = readenv(CONFIG_ENV_OFFSET, (u_char *)buf); + ret = readenv(CONFIG_ENV_OFFSET, (u_char *)env_buf); if (ret) { set_default_env("!readenv() failed"); return; } - env_import(buf, 1); + env_import(env_buf, 1); #endif /* ! ENV_IS_EMBEDDED */ } #endif /* CONFIG_ENV_OFFSET_REDUND */ |