All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tom Rini <trini@konsulko.com>
To: "Pali Rohár" <pali@kernel.org>
Cc: "Simon Glass" <sjg@chromium.org>,
	"Heinrich Schuchardt" <xypron.glpk@gmx.de>,
	"Michal Simek" <michal.simek@xilinx.com>,
	"Marek Behún" <marek.behun@nic.cz>,
	u-boot@lists.denx.de
Subject: Re: [PATCH 1/7] xyz-modem: Fix crash after cancelling transfer
Date: Fri, 3 Sep 2021 17:29:04 -0400	[thread overview]
Message-ID: <20210903212904.GO858@bill-the-cat> (raw)
In-Reply-To: <20210803142844.19455-2-pali@kernel.org>

[-- Attachment #1: Type: text/plain, Size: 779 bytes --]

On Tue, Aug 03, 2021 at 04:28:38PM +0200, Pali Rohár wrote:

> Variable xyz.len is set to -1 on error. At the end xyzModem_stream_read()
> function calls memcpy() with length from variable xyz.len. If this variable
> is set to -1 then value passed to memcpy is casted to unsigned value, which
> means to copy whole address space. Which then cause U-Boot crash. E.g. on
> arm64 it cause CPU crash: "Synchronous Abort" handler, esr 0x96000006
> 
> Fix this issue by checking that value stored in xyz.len is valid prior
> trying to use it.
> 
> Signed-off-by: Pali Rohár <pali@kernel.org>
> Acked-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

With a quick X/Y modem test boot on am335x_evm:
For the series, applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

  parent reply	other threads:[~2021-09-03 21:29 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-03 14:28 [PATCH 0/7] xyz-modem: Fix cancelling and closing transfers Pali Rohár
2021-08-03 14:28 ` [PATCH 1/7] xyz-modem: Fix crash after cancelling transfer Pali Rohár
2021-08-04  8:50   ` Heinrich Schuchardt
2021-09-03 21:29   ` Tom Rini [this message]
2021-08-03 14:28 ` [PATCH 2/7] xyz-modem: Fix x-modem "xyzModem_eof error" at the end of file Pali Rohár
2021-08-12 21:46   ` Simon Glass
2021-08-03 14:28 ` [PATCH 3/7] xyz-modem: Put xyzModem_stream_close debug diagnostic message into ZM_DEBUG() Pali Rohár
2021-08-04  9:30   ` Heinrich Schuchardt
2021-08-06 16:20     ` Pali Rohár
2021-08-03 14:28 ` [PATCH 4/7] xyz-modem: Close stream after processing/sending terminate sequence Pali Rohár
2021-08-04  8:59   ` Heinrich Schuchardt
2021-08-06 16:27     ` Pali Rohár
2021-08-03 14:28 ` [PATCH 5/7] xyz-modem: Properly abort/terminate transfer on error Pali Rohár
2021-08-12 21:46   ` Simon Glass
2021-08-12 21:48     ` Pali Rohár
2021-08-03 14:28 ` [PATCH 6/7] xyz-modem: Show information about finished transfer Pali Rohár
2021-08-04  9:15   ` Heinrich Schuchardt
2021-08-06 16:16     ` Pali Rohár
2021-08-03 14:28 ` [PATCH 7/7] xyz-modem: Allow to cancel transfer also by CTRL+C Pali Rohár
2021-08-12 21:46   ` Simon Glass
2021-08-27  8:40 ` [PATCH 0/7] xyz-modem: Fix cancelling and closing transfers Pali Rohár

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210903212904.GO858@bill-the-cat \
    --to=trini@konsulko.com \
    --cc=marek.behun@nic.cz \
    --cc=michal.simek@xilinx.com \
    --cc=pali@kernel.org \
    --cc=sjg@chromium.org \
    --cc=u-boot@lists.denx.de \
    --cc=xypron.glpk@gmx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.