Merge patch series "lmb: rework logic to validate load address for network commands"

Sughosh Ganu <sughosh.ganu@linaro.org> says:

Rework the logic to verify the load address so that address re-use is
not an issue.

2 files changed, 2 insertions, 53 deletions

diff --git a/net/tftp.c b/net/tftp.c
index b5d227d8bc2..d6744bc24e2 100644
--- a/net/tftp.c
+++ b/net/tftp.c
@@ -82,7 +82,6 @@ static ulong	tftp_block_wrap;
 static ulong	tftp_block_wrap_offset;
 static int	tftp_state;
 static ulong	tftp_load_addr;
-static ulong	tftp_load_size;
 #ifdef CONFIG_TFTP_TSIZE
 /* The file size reported by the server */
 static int	tftp_tsize;
@@ -159,13 +158,8 @@ static inline int store_block(int block, uchar *src, unsigned int len)
 	void *ptr;
 
 	if (CONFIG_IS_ENABLED(LMB)) {
-		ulong end_addr = tftp_load_addr + tftp_load_size;
-
-		if (!end_addr)
-			end_addr = ULONG_MAX;
-
 		if (store_addr < tftp_load_addr ||
-		    store_addr + len > end_addr) {
+		    lmb_read_check(store_addr, len)) {
 			puts("\nTFTP error: ");
 			puts("trying to overwrite reserved memory...\n");
 			return -1;
@@ -712,19 +706,8 @@ static void tftp_timeout_handler(void)
 	}
 }
 
-/* Initialize tftp_load_addr and tftp_load_size from image_load_addr and lmb */
 static int tftp_init_load_addr(void)
 {
-	if (CONFIG_IS_ENABLED(LMB)) {
-		phys_size_t max_size;
-
-		max_size = lmb_get_free_size(image_load_addr);
-		if (!max_size)
-			return -1;
-
-		tftp_load_size = max_size;
-	}
-
 	tftp_load_addr = image_load_addr;
 	return 0;
 }
diff --git a/net/wget.c b/net/wget.c
index 4a168641c65..a88c31f236b 100644
--- a/net/wget.c
+++ b/net/wget.c
@@ -64,26 +64,6 @@ static unsigned int retry_tcp_ack_num;	/* TCP retry acknowledge number*/
 static unsigned int retry_tcp_seq_num;	/* TCP retry sequence number */
 static int retry_len;			/* TCP retry length */
 
-static ulong wget_load_size;
-
-/**
- * wget_init_max_size() - initialize maximum load size
- *
- * Return:	0 if success, -1 if fails
- */
-static int wget_init_load_size(void)
-{
-	phys_size_t max_size;
-
-	max_size = lmb_get_free_size(image_load_addr);
-	if (!max_size)
-		return -1;
-
-	wget_load_size = max_size;
-
-	return 0;
-}
-
 /**
  * store_block() - store block in memory
  * @src: source of data
@@ -97,13 +77,8 @@ static inline int store_block(uchar *src, unsigned int offset, unsigned int len)
 	uchar *ptr;
 
 	if (CONFIG_IS_ENABLED(LMB)) {
-		ulong end_addr = image_load_addr + wget_load_size;
-
-		if (!end_addr)
-			end_addr = ULONG_MAX;
-
 		if (store_addr < image_load_addr ||
-		    store_addr + len > end_addr) {
+		    lmb_read_check(store_addr, len)) {
 			printf("\nwget error: ");
 			printf("trying to overwrite reserved memory...\n");
 			return -1;
@@ -493,15 +468,6 @@ void wget_start(void)
 	debug_cond(DEBUG_WGET,
 		   "\nwget:Load address: 0x%lx\nLoading: *\b", image_load_addr);
 
-	if (CONFIG_IS_ENABLED(LMB)) {
-		if (wget_init_load_size()) {
-			printf("\nwget error: ");
-			printf("trying to overwrite reserved memory...\n");
-			net_set_state(NETLOOP_FAIL);
-			return;
-		}
-	}
-
 	net_set_timeout_handler(wget_timeout, wget_timeout_handler);
 	tcp_set_tcp_handler(wget_handler);