u-boot-toradex.git, branch main

Merge tag 'u-boot-dfu-20260914' of https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu

2026-09-16T14:56:49+00:00

u-boot-dfu-20260914

Android:
* avb: fix missing break in avb_set_state() switch

DFU:
* dfu: mtd: probe before get_mtd_device_nm()

Merge tag 'net-20260915' of https://git.u-boot-project.org/u-boot/custodians/u-boot-net

2026-09-15T14:55:15+00:00

Pull request net-20260915.

net
- test: dm: nfs: Add regression tests for the NFS reply-length checks
- net: nfs: Bound the length of an NFS readlink reply
- net: nfs: Bound the length of an NFS read reply
- fix error check in eth init
- airoha: fix PCS calibration retry limit

net-legacy
- net6: validate IPv6 payload and transport lengths on receive
- test: dm: eth: add DHCPv6 oversized option regression tests
- net: dhcp6: bound received DUID option lengths

net-lwip
- lwip: allow DHCP to stop without releasing its lease
- lwip: add an HTTP client abort operation
- lwip: allow DNS callbacks to be canceled
- lwip: return ERR_ABRT after aborting wget receive

test: dm: nfs: Add regression tests for the NFS reply-length checks

2026-09-15T07:53:54+00:00

Add DM tests that feed nfs_pkt_recv() crafted NFSv3 replies with a read
and a readlink request outstanding. The READ reply carries a data length
with the top bit set; the READLINK reply carries a length of -1 that slips
past the destination bound as pathlen - 1. Either would drive a memcpy()
out of the reply buffer; the tests assert that nothing is stored and the
path buffer is left untouched.

Enable CONFIG_CMD_NFS in sandbox_defconfig so the NFS client and these
tests are built and run under sandbox.

Signed-off-by: Shahriyar Jalayeri 
Reviewed-by: Jerome Forissier

net: nfs: Bound the length of an NFS readlink reply

2026-09-15T07:53:49+00:00

nfs_readlink_reply() takes the symlink length from the server and
memcpy()s that many bytes into nfs_path_buff[]. It was kept in a signed
int and bounded with:

	if (((uchar *)&rpc_pkt.u.reply.data[0] - (uchar *)&rpc_pkt + rlen) > len)
		return -NFS_RPC_DROP;

A negative rlen makes the sum smaller than len, so the check passes; rlen
is then used as an unsigned size_t in memcpy(), and in the relative-symlink
branch pathlen + rlen also stays below the buffer size, so a length of -1
drives a memcpy() off nfs_path_buff. The bound is also measured from the
reply header rather than from the symlink data, which begins a few words
later, so a large positive length reads past the end of the received
reply.

A malicious server answers the READ with an ISDIR status to move the
client into the readlink state, then returns such a reply.

Read the length into an unsigned int, bound it against the received packet
measured from the symlink data, and check it against the destination
buffer with the subtraction ordered so it cannot wrap.

Fixes: cf3a4f1e86ec ("CVE-2019-14195: nfs: fix unbounded memcpy with unvalidated length at nfs_readlink_reply")
Signed-off-by: Shahriyar Jalayeri 
Reviewed-by: Jerome Forissier 
[jf: fix conflict with 85d82c523275 ("net: nfs: clean up bounds checks
in nfs_readlink_reply()")]
Signed-off-by: Jerome Forissier

net: nfs: Bound the length of an NFS read reply

2026-09-15T07:53:45+00:00

nfs_read_reply() takes the length of the returned data from the server
and hands it to store_block(), which memcpy()s that many bytes out of the
1152-byte rpc_pkt stack buffer to image_load_addr.

The length was kept in a signed int and bounded with:

	if (((uchar *)&rpc_pkt.u.reply.data[0] - (uchar *)&rpc_pkt + rlen) > len)
		return -9999;

On an LP64 target the pointer subtraction is a 64-bit ptrdiff_t, so a
length with the top bit set makes rlen negative, the sum stays below len
and the check passes. store_block() then takes rlen as an unsigned int,
so 0x80000000 becomes a ~2 GB copy that runs off both buffers. The bound
is also measured from the reply header rather than from the data, which
begins several words later, so a large positive length still reads past
the end of rpc_pkt.

Read the length into an unsigned int so it can never be negative, reject
anything larger than NFS_READ_SIZE (the most a read requests), and bound
it against the received packet measured from the start of the data. Take
the NFSv3 length from the opaque data_size field that prefixes the
returned bytes, which is what store_block() copies.

Both the classic and the lwIP NFS clients reach this through
nfs_pkt_recv(), so the single check covers both.

Fixes: aa207cf3a6d6 ("CVE-2019-14194/CVE-2019-14198: nfs: fix unbounded memcpy with a failed length check at nfs_read_reply")
Signed-off-by: Shahriyar Jalayeri 
Reviewed-by: Jerome Forissier

u-boot: fix error check in eth init

2026-09-15T07:53:28+00:00

eth_start_udev can fail but errno could still be zero which causes the
function ignores the error silently. This fix catches the error
properly.

Signed-off-by: Yuxiao Zhang 
Reviewed-by: Tom Rini

net: airoha: fix PCS calibration retry limit

2026-09-15T07:53:14+00:00

The calibration retry counter starts at zero and is incremented after
the limit check. Using a strict greater-than comparison therefore allows
one more retry than AIROHA_PCS_MAX_CALIBRATION_TRY specifies.

Use a greater-than-or-equal comparison so the function stops after the
configured number of retries.

Fixes: d4dd6eb29bda ("net: airoha: add support for Airoha PCS driver")

Signed-off-by: Li Xiao 
Reviewed-by: Jerome Forissier

net: net6: validate IPv6 payload and transport lengths on receive

2026-09-15T07:53:03+00:00

net_ip6_handler() checks the received length only against IP6_HDR_SIZE and
then uses length fields from the packet without checking them. The checksum
is computed over payload_len, but the UDP handler length comes from
udp_len. A sender can keep payload_len correct so the checksum still
validates and set udp_len larger than the frame. A handler that trusts that
length then reads or writes past the receive buffer. The DHCPv6 client
copies the declared number of bytes and can be made to write past the
packet buffer from a single link-local ADVERTISE.

Validate payload_len against the received length and trim len to it before
protocol dispatch. Validate the ICMPv6 and UDP header sizes before either
header is dereferenced, and validate udp_len before reading udp_xsum or
calling the UDP handler.

Fixes: 1feb697830ce ("net: ipv6: Add implementation of main IPv6 functions")
Suggested-by: Jerome Forissier 
Signed-off-by: Esteban Alba 
Reviewed-by: Jerome Forissier

net: lwip: allow DHCP to stop without releasing its lease

2026-09-15T07:51:32+00:00

U-Boot keeps using the address acquired by the dhcp command. The
existing lwIP stop operation sends DHCPRELEASE and clears the interface
address, which is unsuitable when the interface remains active for
another client.

Factor the common shutdown path and add dhcp_stop_without_release().
It stops the state machine and drops its UDP PCB reference without
sending DHCPRELEASE or clearing the interface address.

Signed-off-by: James Hilliard 
Reviewed-by: Jerome Forissier

net: lwip: add an HTTP client abort operation

2026-09-15T07:50:46+00:00

The HTTP client has no public way to cancel a request. Returning from
wget while DNS or TCP work remains pending can therefore leave callbacks
referencing its released command state.

Track pending DNS resolution and add httpc_abort(). The operation removes
a pending DNS callback, detaches the HTTP callbacks and immediately
aborts the altcp connection. Report a local abort through the normal
result callback.

Signed-off-by: James Hilliard 
Reviewed-by: Jerome Forissier