Merge tag 'u-boot-dfu-20250124' of https://source.denx.de/u-boot/custodians/u-boot-dfu

CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/24323

Android:
- Fix kcmdline null pointer dereference (reported by coverity and
  multiple users)
- Move Igor to reviewers instead of maintainers for avb/ab
- Fix booting Android with AVB built-in, but disabled via
  fastboot flash --disable-verity vbmeta vbmeta.img

3 files changed, 31 insertions, 20 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index e0e9edd48a8..dc8e048dde4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -66,8 +66,8 @@ F:	lib/alist.c
 F:	test/lib/alist.c
 
 ANDROID AB
-M:	Igor Opaniuk <igor.opaniuk@gmail.com>
 M:	Mattijs Korpershoek <mkorpershoek@baylibre.com>
+R:	Igor Opaniuk <igor.opaniuk@gmail.com>
 R:	Sam Protsenko <semen.protsenko@linaro.org>
 S:	Maintained
 T:	git https://source.denx.de/u-boot/custodians/u-boot-dfu.git
@@ -77,8 +77,8 @@ F:	include/android_ab.h
 F:	test/py/tests/test_android/test_ab.py
 
 ANDROID AVB
-M:	Igor Opaniuk <igor.opaniuk@gmail.com>
 M:	Mattijs Korpershoek <mkorpershoek@baylibre.com>
+R:	Igor Opaniuk <igor.opaniuk@gmail.com>
 S:	Maintained
 T:	git https://source.denx.de/u-boot/custodians/u-boot-dfu.git
 F:	cmd/avb.c
diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
index d8c92b44a99..a5a86b29d7f 100644
--- a/boot/bootmeth_android.c
+++ b/boot/bootmeth_android.c
@@ -422,7 +422,7 @@ static int run_avb_verification(struct bootflow *bflow)
 {
 	struct blk_desc *desc = dev_get_uclass_plat(bflow->blk);
 	struct android_priv *priv = bflow->bootmeth_priv;
-	const char * const requested_partitions[] = {"boot", "vendor_boot"};
+	const char * const requested_partitions[] = {"boot", "vendor_boot", NULL};
 	struct AvbOps *avb_ops;
 	AvbSlotVerifyResult result;
 	AvbSlotVerifyData *out_data;
@@ -450,17 +450,26 @@ static int run_avb_verification(struct bootflow *bflow)
 				 AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE,
 				 &out_data);
 
-	if (result != AVB_SLOT_VERIFY_RESULT_OK) {
-		printf("Verification failed, reason: %s\n",
-		       str_avb_slot_error(result));
-		avb_slot_verify_data_free(out_data);
-		return log_msg_ret("avb verify", -EIO);
-	}
-
-	if (unlocked)
-		boot_state = AVB_ORANGE;
-	else
+	if (!unlocked) {
+		/* When device is locked, we only accept AVB_SLOT_VERIFY_RESULT_OK */
+		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
+			printf("Verification failed, reason: %s\n",
+			       str_avb_slot_error(result));
+			avb_slot_verify_data_free(out_data);
+			return log_msg_ret("avb verify", -EIO);
+		}
 		boot_state = AVB_GREEN;
+	} else {
+		/* When device is unlocked, we also accept verification errors */
+		if (result != AVB_SLOT_VERIFY_RESULT_OK &&
+		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
+			printf("Unlocked verification failed, reason: %s\n",
+			       str_avb_slot_error(result));
+			avb_slot_verify_data_free(out_data);
+			return log_msg_ret("avb verify unlocked", -EIO);
+		}
+		boot_state = AVB_ORANGE;
+	}
 
 	extra_args = avb_set_state(avb_ops, boot_state);
 	if (extra_args) {
@@ -470,9 +479,11 @@ static int run_avb_verification(struct bootflow *bflow)
 			goto free_out_data;
 	}
 
-	ret = avb_append_commandline(bflow, out_data->cmdline);
-	if (ret < 0)
-		goto free_out_data;
+	if (result == AVB_SLOT_VERIFY_RESULT_OK) {
+		ret = avb_append_commandline(bflow, out_data->cmdline);
+		if (ret < 0)
+			goto free_out_data;
+	}
 
 	return 0;
 
diff --git a/boot/image-android.c b/boot/image-android.c
index 60a422dfb74..fa4e14ca469 100644
--- a/boot/image-android.c
+++ b/boot/image-android.c
@@ -337,12 +337,12 @@ int android_image_get_kernel(const void *hdr,
 	if (bootargs)
 		len += strlen(bootargs);
 
-	if (*img_data.kcmdline) {
+	if (img_data.kcmdline && *img_data.kcmdline) {
 		printf("Kernel command line: %s\n", img_data.kcmdline);
 		len += strlen(img_data.kcmdline) + (len ? 1 : 0); /* +1 for extra space */
 	}
 
-	if (*img_data.kcmdline_extra) {
+	if (img_data.kcmdline_extra && *img_data.kcmdline_extra) {
 		printf("Kernel extra command line: %s\n", img_data.kcmdline_extra);
 		len += strlen(img_data.kcmdline_extra) + (len ? 1 : 0); /* +1 for extra space */
 	}
@@ -357,13 +357,13 @@ int android_image_get_kernel(const void *hdr,
 	if (bootargs)
 		strcpy(newbootargs, bootargs);
 
-	if (*img_data.kcmdline) {
+	if (img_data.kcmdline && *img_data.kcmdline) {
 		if (*newbootargs) /* If there is something in newbootargs, a space is needed */
 			strcat(newbootargs, " ");
 		strcat(newbootargs, img_data.kcmdline);
 	}
 
-	if (*img_data.kcmdline_extra) {
+	if (img_data.kcmdline_extra && *img_data.kcmdline_extra) {
 		if (*newbootargs) /* If there is something in newbootargs, a space is needed */
 			strcat(newbootargs, " ");
 		strcat(newbootargs, img_data.kcmdline_extra);