Both the ATF and the OpenSBI hand-off paths look up the next stage's entry
point in a /fit-images node, trying fit_image_get_entry() and falling back
to fit_image_get_load(). Neither site tests the result of the fallback.
fit_image_get_address() returns -1 before it reaches the assignment to
*load in two cases: the property is absent, and the value does not fit in
a target ulong. The caller's ulong is left untouched in both, so a node
with neither property leaves the entry point uninitialised. It reaches
bl31_entry() as the BL33 entry point on ARM, and opensbi_info.next_addr,
the S-mode entry point, on RISC-V.
Both sites came from the same conversion in commit caa7fc2c5775 ("spl: Use
standard FIT entries"). fdt_getprop_u32() returned the value and yielded
FDT_ERROR on failure, so the variable was always assigned; the
fit_image_get_*() accessors moved the failure signal into a return value
that was then ignored.
Build-tested with no new warnings:
sifive_unmatched_defconfig (riscv64, spl/u-boot-spl)
cm3588-nas-rk3588_defconfig (aarch64, spl/u-boot-spl, covers spl_atf.c)
Sebastian Alba Vives (2):
spl: atf: Check the return of the entry/load lookup
spl: opensbi: Check the return of the entry/load lookup
common/spl/spl_atf.c | 20 ++++++++++++--------
common/spl/spl_opensbi.c | 5 +++++
2 files changed, 17 insertions(+), 8 deletions(-)
--
2.43.0
