The data-offset, data-position and data-size FIT properties are 32-bit unsigned values, but were read through signed int. Also, they are excluded from the configuration signature, so they are attacker controlled.
Patch 1 switches the accessors and their callers to u32, removing the ad-hoc handling of "negative" values in U-Boot proper. This transition was discussed and agreed on in [1]. The SPL loader has its own copy of this logic with the same problems and fewer checks. Patch 2 factors out a test helper, patch 3 makes the SPL offset/size arithmetic overflow-safe, and patch 4 adds the addressable-range and FIT_SIGNATURE_MAX_SIZE bounds check that U-Boot proper already performs in fit_image_get_data(). Patches 3 and 4 build on each other and on patch 1, so they are not intended to be cherry-picked individually. [1] https://lore.kernel.org/u-boot/capwax55xwflcmgruauuxxn__mx_ug4j8qtd6rvxzmj4wsoc...@mail.gmail.com/ --- Changes in v4: - Patches 3 and 4: the new diagnostics use log_debug() instead of printf(), in order to keep SPL size minimal; log_debug() compiles out in a non-debug SPL build. This is the only code change. - Fixed broken build of am335x_evm, which has only 100 bytes spare under CONFIG_SPL_MAX_SIZE (0x1b000) at the base commit; v3 overflowed it by 216 bytes, while this version leaves 113 bytes spare. - Patches 3 and 4: code-size figures re-measured with buildman -S inside the u-boot-gitlab-ci-runner container, so they match what CI sees, and they now cover every configuration rather than a sample: of the 413 boards that build spl_fit.c there are seven combinations of the options the changed code depends on, and each patch quotes one board per combination. - Patch 3: added Simon's Reviewed-by tag. - Link to v3: https://lore.kernel.org/all/[email protected]/ Changes in v3: - No code changes. - Patches 1, 2 and 4: added Simon's Reviewed-by tags, which were missing from the v2 patches. - Link to v2: https://lore.kernel.org/all/[email protected]/ Changes in v2: - Patch 1: keep the 0xffffffff data-position and data-size test cases instead of dropping them; they are renamed and repointed at the "FIT external data is out of bounds" message they now hit. - Patches 3 and 4: no code changes, added SPL code-size figures - Link to v1: https://lore.kernel.org/all/[email protected]/ All four patches carry Reviewed-by: Simon Glass. Patches 3 and 4 are unchanged since v3 apart from their diagnostics becoming log_debug(). --- Anton Ivanov (4): image-fit: Use unsigned types for external data properties test: spl: Factor out external-data FIT property checks spl: fit: Harden external-data offset and size arithmetic spl: fit: Bound external data like U-Boot proper boot/image-fit.c | 29 ++++------ common/spl/spl_fit.c | 122 +++++++++++++++++++++++++-------------- common/splash_source.c | 2 +- drivers/fpga/socfpga_arria10.c | 3 +- include/image.h | 6 +- test/image/spl_load.c | 128 +++++++++++++++++++++++++++++++++++------ test/py/tests/test_vboot.py | 10 ++-- 7 files changed, 210 insertions(+), 90 deletions(-) --- base-commit: 94b349bd902d9e38e1846c157fadd9054c34680a change-id: 20260730-b4-fit-ext-data-hardening-1734a9203753 Best regards, -- Anton Ivanov <[email protected]>
