Hi Anton, On Thu, 6 Aug 2026 at 15:29, Anton Ivanov <[email protected]> wrote: > > The data-offset, data-position and data-size FIT properties are 32-bit > unsigned values, but were read through signed int. Also, they are > excluded from the configuration signature, so they are attacker > controlled. > > Patch 1 switches the accessors and their callers to u32, removing > the ad-hoc handling of "negative" values in U-Boot proper. This > transition was discussed and agreed on in [1]. > > The SPL loader has its own copy of this logic with the same problems > and fewer checks. Patch 2 factors out a test helper, patch 3 makes the > SPL offset/size arithmetic overflow-safe, and patch 4 adds the > addressable-range and FIT_SIGNATURE_MAX_SIZE bounds check that U-Boot > proper already performs in fit_image_get_data(). > > Patches 3 and 4 build on each other and on patch 1, so they are not > intended to be cherry-picked individually. > > [1] > https://lore.kernel.org/u-boot/capwax55xwflcmgruauuxxn__mx_ug4j8qtd6rvxzmj4wsoc...@mail.gmail.com/ > > --- > Changes in v2: > - Patch 1: keep the 0xffffffff data-position and data-size test cases > instead of dropping them; they are renamed and repointed at the > "FIT external data is out of bounds" message they now hit. > - Patches 3 and 4: no code changes, added SPL code-size figures > - Link to v1: > https://lore.kernel.org/all/[email protected]/ > > Patches 1, 2 and 4 carry Reviewed-by: Simon Glass.
I don't see those tags? > > --- > Anton Ivanov (4): > image-fit: Use unsigned types for external data properties > test: spl: Factor out external-data FIT property checks > spl: fit: Harden external-data offset and size arithmetic > spl: fit: Bound external data like U-Boot proper > > boot/image-fit.c | 29 ++++------ > common/spl/spl_fit.c | 122 +++++++++++++++++++++++++-------------- > common/splash_source.c | 2 +- > drivers/fpga/socfpga_arria10.c | 3 +- > include/image.h | 6 +- > test/image/spl_load.c | 128 > +++++++++++++++++++++++++++++++++++------ > test/py/tests/test_vboot.py | 10 ++-- > 7 files changed, 210 insertions(+), 90 deletions(-) > --- > base-commit: 94b349bd902d9e38e1846c157fadd9054c34680a > change-id: 20260730-b4-fit-ext-data-hardening-1734a9203753 > > Best regards, > -- > Anton Ivanov <[email protected]> > Regards, SImon
