Hi Sriram, On 12/10/2026 23:20, Sriram Sriram wrote: > On Mon, Oct 12, 2026 at 02:05:26PM -0700, Sriram Sriram wrote: >> On Mon, Oct 12, 2026 at 02:01:31PM -0600, Tom Rini wrote: >>> On Mon, Oct 12, 2026 at 12:20:39PM -0700, Sriram Sriram wrote: >>>> On Thu, Oct 01, 2026 at 08:47:15AM -0700, Sriram Sriram wrote: >>>>> On Wed, Sep 30, 2026 at 07:20:11PM -0600, Tom Rini wrote: >>>>>> On Tue, 15 Sep 2026 13:52:07 -0700, Sriram Sriram wrote: >>>>>> >>>>>>> Three independent hardening fixes found by internal static analysis and >>>>>>> code review. They do not depend on each other. >>>>>>> >>>>>>> Changes in v2: >>>>>>> - Dropped "boot: image-fit: add overflow guard for FIT decompression >>>>>>> buffer" (2/4 in v1). As Tom pointed out, max_decomp_len is used both >>>>>>> as the allocation size and as the unc_len bound handed to >>>>>>> image_decomp(), so a wrapped multiply cannot leave the bound larger >>>>>>> than the buffer, and image_decomp() already fails cleanly on a bound >>>>>>> that is too small. The claim in that commit message was wrong, so the >>>>>>> patch is withdrawn rather than reworded. >>>>>>> - net: tftp: replaced the four bounded strncasecmp() comparisons with a >>>>>>> single check that the packet ends in a NUL, per Tom's review. It is >>>>>>> smaller (+16 bytes of .text on am335x_evm_defconfig instead of +24) >>>>>>> and it also covers the dectoul() calls, which v1 left unbounded. >>>>>>> Retitled to match. >>>>>>> - Rebased onto current master (a44f46af0aa). >>>>>>> - No change to the NFS and ext4 patches. >>>>>>> >>>>>>> [...] >>>>>> >>>>>> Applied to u-boot/next, thanks! >>>>>> >>>>>> [3/3] fs: ext4: widen ext4fs_update() block-group loop counter >>>>>> commit: 1c1b6c2b2ae03912007ed2ffd361f43b7c2e5401 >>>>>> -- >>>>>> Tom >>>>>> >>>>> Great! Thank you. >>>>> >>>>> Regards, >>>>> Sriram >>>>> >>>> Hi Tom, >>>> >>>> Just following up on the other two patches. I see that Jerome reviewed >>>> them on Sep 17th, but they haven't been applied yet. Is anything else >>>> needed for those patches? >>> >>> Since they're both networking ones, I'm expecting Jerome to pick them >>> up. >>> >>> -- >>> Tom >> Thanks Tom. >> >> Hi Jerome, >> >> Anything else needed for these patches? >> >> Regards, >> Sriram > Hi Jerome, > > Sorry, there was a typo in the previous email. Anything else needed for > these patches?
No, that was an oversight on my part. Sorry about that. I’ll pick them up for the next net PR. Thanks, -- Jerome > > Regards, > Sriram
