On Tue, Oct 13, 2026 at 01:23:10PM +0200, Jerome Forissier wrote: > Hi Sriram, > > On 12/10/2026 23:20, Sriram Sriram wrote: > > On Mon, Oct 12, 2026 at 02:05:26PM -0700, Sriram Sriram wrote: > >> On Mon, Oct 12, 2026 at 02:01:31PM -0600, Tom Rini wrote: > >>> On Mon, Oct 12, 2026 at 12:20:39PM -0700, Sriram Sriram wrote: > >>>> On Thu, Oct 01, 2026 at 08:47:15AM -0700, Sriram Sriram wrote: > >>>>> On Wed, Sep 30, 2026 at 07:20:11PM -0600, Tom Rini wrote: > >>>>>> On Tue, 15 Sep 2026 13:52:07 -0700, Sriram Sriram wrote: > >>>>>> > >>>>>>> Three independent hardening fixes found by internal static analysis > >>>>>>> and > >>>>>>> code review. They do not depend on each other. > >>>>>>> > >>>>>>> Changes in v2: > >>>>>>> - Dropped "boot: image-fit: add overflow guard for FIT decompression > >>>>>>> buffer" (2/4 in v1). As Tom pointed out, max_decomp_len is used > >>>>>>> both > >>>>>>> as the allocation size and as the unc_len bound handed to > >>>>>>> image_decomp(), so a wrapped multiply cannot leave the bound larger > >>>>>>> than the buffer, and image_decomp() already fails cleanly on a > >>>>>>> bound > >>>>>>> that is too small. The claim in that commit message was wrong, so > >>>>>>> the > >>>>>>> patch is withdrawn rather than reworded. > >>>>>>> - net: tftp: replaced the four bounded strncasecmp() comparisons > >>>>>>> with a > >>>>>>> single check that the packet ends in a NUL, per Tom's review. It is > >>>>>>> smaller (+16 bytes of .text on am335x_evm_defconfig instead of +24) > >>>>>>> and it also covers the dectoul() calls, which v1 left unbounded. > >>>>>>> Retitled to match. > >>>>>>> - Rebased onto current master (a44f46af0aa). > >>>>>>> - No change to the NFS and ext4 patches. > >>>>>>> > >>>>>>> [...] > >>>>>> > >>>>>> Applied to u-boot/next, thanks! > >>>>>> > >>>>>> [3/3] fs: ext4: widen ext4fs_update() block-group loop counter > >>>>>> commit: 1c1b6c2b2ae03912007ed2ffd361f43b7c2e5401 > >>>>>> -- > >>>>>> Tom > >>>>>> > >>>>> Great! Thank you. > >>>>> > >>>>> Regards, > >>>>> Sriram > >>>>> > >>>> Hi Tom, > >>>> > >>>> Just following up on the other two patches. I see that Jerome reviewed > >>>> them on Sep 17th, but they haven't been applied yet. Is anything else > >>>> needed for those patches? > >>> > >>> Since they're both networking ones, I'm expecting Jerome to pick them > >>> up. > >>> > >>> -- > >>> Tom > >> Thanks Tom. > >> > >> Hi Jerome, > >> > >> Anything else needed for these patches? > >> > >> Regards, > >> Sriram > > Hi Jerome, > > > > Sorry, there was a typo in the previous email. Anything else needed for > > these patches? > > No, that was an oversight on my part. Sorry about that. I’ll pick them up > for the next net PR. > > Thanks, > -- > Jerome > > > > > Regards, > > Sriram Hi Jerome,
No problem. Thanks a lot. Regards, Sriram
