RFC: ext4: Add a few overflow checks in the writing code

Some memory allocations make use of data from the disk, so add some
overflow checks.

Adjust LOG2_BLOCK_SIZE() so it is easier to read.

Note: This is a trial to help figure out the best way to deal with these
sorts of things. Feedback welcome.

Series-to: u-boot
Series-cc: heinrich

Signed-off-by: Simon Glass <simon.glass@canonical.com>

Kconfig

@@ -551,7 +551,7 @@ config SYS_LOAD_ADDR
 	default 0x12000000 if ARCH_MX6 && !(MX6SL || MX6SLL  || MX6SX || MX6UL || MX6ULL)
 	default 0x80800000 if ARCH_MX7
 	default 0x90000000 if FSL_LSCH2 || FSL_LSCH3
-	default 0x02000000 if ARCH_EFI
+	default 0 if ARCH_EFI
 	default 0x0 if ARCH_SC5XX
 	help
 	  Address in memory to use as the default safe load address.

board/armltd/vexpress64/Kconfig

@@ -28,7 +28,7 @@ choice
 config TARGET_VEXPRESS64_BASE_FVP
 	bool "Support Versatile Express ARMv8a FVP BASE model"
 	select VEXPRESS64_BASE_MODEL
-	imply OF_HAS_PRIOR_STAGE
+	imply OF_HAS_PRIOR_STAGE if !BLOBLIST
 
 config TARGET_VEXPRESS64_BASER_FVP
 	bool "Support Versatile Express ARMv8r64 FVP BASE model"

board/armltd/vexpress64/Makefile

@@ -3,5 +3,8 @@
 # (C) Copyright 2000-2004
 # Wolfgang Denk, DENX Software Engineering, wd@denx.de.
 
-obj-y	:= vexpress64.o lowlevel_init.o
+obj-y	:= vexpress64.o
+
+obj-$(CONFIG_OF_HAS_PRIOR_STAGE)	+= lowlevel_init.o
+
 obj-$(CONFIG_TARGET_VEXPRESS64_JUNO)	+= pcie.o

board/armltd/vexpress64/vexpress64.c

@@ -100,7 +100,9 @@ int dram_init_banksize(void)
  * Push the variable into the .data section so that it
  * does not get cleared later.
  */
+#ifdef CONFIG_OF_HAS_PRIOR_STAGE
 unsigned long __section(".data") prior_stage_fdt_address[2];
+#endif
 
 #ifdef CONFIG_OF_BOARD
 
@@ -151,6 +153,7 @@ static phys_addr_t find_dtb_in_nor_flash(const char *partname)
 }
 #endif
 
+#ifdef CONFIG_OF_HAS_PRIOR_STAGE
 /*
  * Filter for a valid DTB, as TF-A happens to provide a pointer to some
  * data structure using the DTB format, which we cannot use.
@@ -201,6 +204,7 @@ int board_fdt_blob_setup(void **fdtp)
 	return -ENXIO;
 }
 #endif
+#endif
 
 /* Actual reset is done via PSCI. */
 void reset_cpu(void)

board/efi/Kconfig

@@ -17,7 +17,7 @@ config TARGET_EFI_X86_APP32
 	help
 	  This target is used for running U-Boot on top of EFI. In
 	  this case EFI does the early initialisation, and U-Boot
-	  takes over once the RAM, video and CPU are fully running.
+	  starts once the RAM, video and CPU are fully running.
 	  U-Boot is loaded as an application from EFI.
 
 config TARGET_EFI_X86_APP64
@@ -27,7 +27,7 @@ config TARGET_EFI_X86_APP64
 	help
 	  This target is used for running U-Boot on top of EFI in 64-bit mode.
 	  In this case EFI does the early initialisation, and U-Boot
-	  takes over once the RAM, video and CPU are fully running.
+	  starts once the RAM, video and CPU are fully running.
 	  U-Boot is loaded as an application from EFI.
 
 config TARGET_EFI_X86_PAYLOAD
@@ -59,7 +59,7 @@ config TARGET_EFI_ARM_APP64
 	help
 	  This target is used for running U-Boot on top of EFI in 64-bit mode.
 	  In this case EFI does the early initialisation, and U-Boot
-	  takes over once the RAM, video and CPU are fully running.
+	  starts once the RAM, video and CPU are fully running.
 	  U-Boot is loaded as an application from EFI.
 
 endchoice

board/efi/efi-arm_app/MAINTAINERS

@@ -1,10 +1,3 @@
-EFI-ARM_APP32 BOARD
-M:	Simon Glass <sjg@chromium.org>
-S:	Maintained
-F:	board/efi/Kconfig
-F:	board/efi/efi-arm_app/
-F:	configs/efi-arm_app32_defconfig
-
 EFI-ARM_APP64 BOARD
 M:	Simon Glass <sjg@chromium.org>
 S:	Maintained

common/Kconfig

@@ -1055,8 +1055,8 @@ choice
 config BLOBLIST_FIXED
 	bool "Place bloblist at a fixed address in memory"
 	help
-	  Select this to used a fixed memory address for the bloblist. If the
-	  bloblist exists at this address from a previous phase, it used as is.
+	  Select this to use a fixed memory address for the bloblist. If the
+	  bloblist exists at this address from a previous phase, it is used as is.
 	  If not it is created at this address in U-Boot.
 
 config BLOBLIST_ALLOC
@@ -1066,6 +1066,12 @@ config BLOBLIST_ALLOC
 	  specify a fixed address on systems where this is unknown or can
 	  change at runtime.
 
+config BLOBLIST_PASSAGE
+	bool "Use bloblist in-place"
+	help
+	  Use a bloblist in the incoming standard passage. The size is detected
+	  automatically so CONFIG_BLOBLIST_SIZE can be 0.
+
 endchoice
 
 config BLOBLIST_ADDR
@@ -1080,17 +1086,17 @@ config BLOBLIST_ADDR
 
 config BLOBLIST_SIZE
 	hex "Size of bloblist"
+	default 0x0 if BLOBLIST_PASSAGE
 	default 0x400
 	help
 	  Sets the size of the bloblist in bytes. This must include all
 	  overhead (alignment, bloblist header, record header). The bloblist
 	  is set up in the first part of U-Boot to run (TPL, SPL or U-Boot
-	  proper), and this sane bloblist is used for subsequent phases.
+	  proper), and this same bloblist is used for subsequent phases.
 
 config BLOBLIST_SIZE_RELOC
 	hex "Size of bloblist after relocation"
 	default BLOBLIST_SIZE if BLOBLIST_FIXED || BLOBLIST_ALLOC
-	default 0x0 if BLOBLIST_PASSAGE
 	default 0x20000 if (ARM && EFI_LOADER && GENERATE_ACPI_TABLE)
 	help
 	  Sets the size of the bloblist in bytes after relocation. Since U-Boot

common/bloblist.c

@@ -489,6 +489,9 @@ int bloblist_reloc(void *to, uint to_size)
 {
 	struct bloblist_hdr *hdr;
 
+	if (!to_size)
+		return 0;
+
 	if (to_size < gd->bloblist->total_size)
 		return -ENOSPC;
 
@@ -519,13 +522,6 @@ int bloblist_init(void)
 	 * at a fixed address.
 	 */
 	bool from_addr = fixed && !xpl_is_first_phase();
-	/*
-	 * If U-Boot is in the first phase that an arch custom routine should
-	 * install the bloblist passed from previous loader to this fixed
-	 * address.
-	 */
-	bool from_boot_arg = fixed && xpl_is_first_phase();
-
 	if (xpl_prev_phase() == PHASE_TPL && !IS_ENABLED(CONFIG_TPL_BLOBLIST))
 		from_addr = false;
 	if (fixed)
@@ -533,7 +529,13 @@ int bloblist_init(void)
 				      CONFIG_BLOBLIST_ADDR);
 	size = CONFIG_BLOBLIST_SIZE;
 
-	if (from_boot_arg)
+
+	/*
+	 * If the current boot stage is the first phase of U-Boot, then an
+	 * architecture-specific routine should be used to handle the bloblist
+	 * passed from the previous boot loader
+	 */
+	if (xpl_is_first_phase() && !IS_ENABLED(CONFIG_BLOBLIST_ALLOC))
 		ret = xferlist_from_boot_arg(addr, size);
 	else if (from_addr)
 		ret = bloblist_check(addr, size);

configs/vexpress_fvp_bloblist_defconfig

@@ -0,0 +1,5 @@
+#include <configs/vexpress_fvp_defconfig>
+
+CONFIG_BLOBLIST=y
+CONFIG_BLOBLIST_PASSAGE=y
+CONFIG_BLOBLIST_SIZE_RELOC=0x10000

doc/board/armltd/vexpress64.rst

@@ -43,6 +43,22 @@ Juno is an Arm development board with the following features:
 
 More details can be found in the board documentation [3]_.
 
+Bloblist Support
+----------------
+
+The ``vexpress_fvp_bloblist_defconfig`` configures U-Boot to be compiled for
+Vexpress64 with Bloblist as the primary method for information handoff between
+boot stages. U-Boot offers three methods to set up a bloblist: using a
+predefined bloblist at a specified address, dynamically allocating memory for a
+bloblist, or utilizing a standard passage-provided bloblist with automatic size
+detection.
+
+By default, ``vexpress_fvp_bloblist_defconfig`` uses the standard passage method
+(CONFIG_BLOBLIST_PASSAGE) because TF-A provides a Transfer List in non-secure
+memory that U-Boot can utilise. This Bloblist, which is referred to as a Transfer List in
+TF-A, contains all necessary data for the handoff process, including DT and ACPI
+tables.
+
 References
 ----------
 

fs/ext4/ext4_write.c

@@ -108,8 +108,15 @@ int ext4fs_get_bgdtable(void)
 {
 	int status;
 	struct ext_filesystem *fs = get_fs();
-	int gdsize_total = ROUND(fs->no_blkgrp * fs->gdsize, fs->blksz);
+	size_t alloc_size;
+	int gdsize_total;
+
+	if (__builtin_mul_overflow(fs->no_blkgrp, fs->gdsize, &alloc_size))
+		return -1;
+	gdsize_total = ROUND(alloc_size, fs->blksz);
 	fs->no_blk_pergdt = gdsize_total / fs->blksz;
+	if (!fs->no_blk_pergdt)
+		return -1;
 
 	/* allocate memory for gdtable */
 	fs->gdtable = zalloc(gdsize_total);
@@ -117,7 +124,7 @@ int ext4fs_get_bgdtable(void)
 		return -ENOMEM;
 	/* read the group descriptor table */
 	status = ext4fs_devread((lbaint_t)fs->gdtable_blkno * fs->sect_perblk,
-				0, fs->blksz * fs->no_blk_pergdt, fs->gdtable);
+				0, gdsize_total, fs->gdtable);
 	if (status == 0)
 		goto fail;
 
@@ -599,10 +606,17 @@ int ext4fs_init(void)
 	int i;
 	uint32_t real_free_blocks = 0;
 	struct ext_filesystem *fs = get_fs();
+	size_t alloc_size;
+
+	/* check for a reasonable block size, no more than 64K */
+	if (LOG2_BLOCK_SIZE(ext4fs_root) > 16)
+		goto fail;
 
 	/* populate fs */
 	fs->blksz = EXT2_BLOCK_SIZE(ext4fs_root);
 	fs->sect_perblk = fs->blksz >> fs->dev_desc->log2blksz;
+	if (!fs->sect_perblk)
+		goto fail;
 
 	/* get the superblock */
 	fs->sb = zalloc(SUPERBLOCK_SIZE);
@@ -629,7 +643,9 @@ int ext4fs_init(void)
 	}
 
 	/* load all the available bitmap block of the partition */
-	fs->blk_bmaps = zalloc(fs->no_blkgrp * sizeof(char *));
+	if (__builtin_mul_overflow(fs->no_blkgrp, sizeof(char *), &alloc_size))
+		goto fail;
+	fs->blk_bmaps = zalloc(alloc_size);
 	if (!fs->blk_bmaps)
 		goto fail;
 	for (i = 0; i < fs->no_blkgrp; i++) {
@@ -649,7 +665,7 @@ int ext4fs_init(void)
 	}
 
 	/* load all the available inode bitmap of the partition */
-	fs->inode_bmaps = zalloc(fs->no_blkgrp * sizeof(unsigned char *));
+	fs->inode_bmaps = zalloc(alloc_size);
 	if (!fs->inode_bmaps)
 		goto fail;
 	for (i = 0; i < fs->no_blkgrp; i++) {

include/bloblist.h

@@ -475,7 +475,7 @@ int bloblist_init(void);
 /**
  * bloblist_maybe_init() - Init the bloblist system if not already done
  *
- * Calls bloblist_init() if the GD_FLG_BLOBLIST_READY flag is not et
+ * Calls bloblist_init() if the GD_FLG_BLOBLIST_READY flag is not set
  *
  * Return: 0 if OK, -ve on error
  */

include/configs/vexpress_aemv8.h

@@ -169,12 +169,14 @@
 		"  if load hostfs - ${kernel_addr_r} ${kernel_name}; then"	\
 		"    setenv fdt_high 0xffffffffffffffff;"		\
 		"    setenv initrd_high 0xffffffffffffffff;"		\
-		"    load hostfs - ${fdt_addr_r} ${fdtfile};"			\
+		"    if test -n load hostfs - ${fdt_addr_r} ${fdtfile}; then"			\
+		"        fdt move $fdtcontroladdr $fdt_addr_r;"			\
+		"    fi;"			\
 		"    load hostfs - ${ramdisk_addr_r} ${ramdisk_name};" \
 		"    fdt addr ${fdt_addr_r};"				\
 		"    fdt resize;"					\
 		"    fdt chosen ${ramdisk_addr_r} ${filesize};"	\
-		"    booti $kernel_addr_r - $fdt_addr_r;"		\
+		"    booti $kernel_addr_r - ${fdt_addr_r};"		\
 		"  fi;"							\
 		"fi\0"
 #define BOOTENV_DEV_NAME_SMH(devtypeu, devtypel, instance) "smh "

include/ext_common.h

@@ -67,8 +67,7 @@ struct cmd_tbl;
 #define EXT2_BLOCK_SIZE(data)	   (1 << LOG2_BLOCK_SIZE(data))
 
 /* Log2 size of ext2 block in bytes.  */
-#define LOG2_BLOCK_SIZE(data)	   (le32_to_cpu		   \
-				    (data->sblock.log2_block_size) \
+#define LOG2_BLOCK_SIZE(data)	(le32_to_cpu((data)->sblock.log2_block_size) \
 				    + EXT2_MIN_BLOCK_LOG_SIZE)
 
 #define EXT2_FT_DIR	2

tools/patman/control.py

@@ -63,7 +63,8 @@ def prepare_patches(col, branch, count, start, end, ignore_binary, signoff,
         branch, start, to_do, ignore_binary, series, signoff)
 
     # Fix up the patch files to our liking, and insert the cover letter
-    patchstream.fix_patches(series, patch_files, keep_change_id)
+    patchstream.fix_patches(series, patch_files, keep_change_id,
+                            insert_base_commit=not cover_fname)
     if cover_fname and series.get('cover'):
         patchstream.insert_cover_letter(cover_fname, series, to_do)
     return series, cover_fname, patch_files

tools/patman/func_test.py

@@ -357,6 +357,31 @@ Changes in v2:
                 expected = expected.splitlines()
                 self.assertEqual(expected, lines[start:(start+len(expected))])
 
+    def test_base_commit(self):
+        """Test adding a base commit with no cover letter"""
+        orig_text = self._get_text('test01.txt')
+        pos = orig_text.index('commit 5ab48490f03051875ab13d288a4bf32b507d76fd')
+        text = orig_text[:pos]
+        series = patchstream.get_metadata_for_test(text)
+        series.base_commit = Commit('1a44532')
+        series.branch = 'mybranch'
+        cover_fname, args = self._create_patches_for_test(series)
+        self.assertFalse(cover_fname)
+        with capture_sys_output() as out:
+            patchstream.fix_patches(series, args, insert_base_commit=True)
+        self.assertEqual('Cleaned 1 patch\n', out[0].getvalue())
+        lines = tools.read_file(args[0], binary=False).splitlines()
+        pos = lines.index('-- ')
+
+        # We expect these lines at the end:
+        # -- (with trailing space)
+        # 2.7.4
+        # (empty)
+        # base-commit: xxx
+        # branch: xxx
+        self.assertEqual('base-commit: 1a44532', lines[pos + 3])
+        self.assertEqual('branch: mybranch', lines[pos + 4])
+
     def make_commit_with_file(self, subject, body, fname, text):
         """Create a file and add it to the git repo with a new commit
 
@@ -527,6 +552,11 @@ complicated as possible''')
             self.assertEqual(f'base-commit: {base}', lines[0])
             self.assertEqual('branch: second', lines[1])
 
+            # Make sure that the base-commit is not present when it is in the
+            # cover letter
+            for fname in patch_files:
+                self.assertNotIn(b'base-commit:', tools.read_file(fname))
+
             # Check that it can skip patches at the end
             with capture_sys_output() as _:
                 _, cover_fname, patch_files = control.prepare_patches(

tools/patman/patchstream.py

@@ -76,8 +76,13 @@ class PatchStream:
     are interested in. We can also process a patch file in order to remove
     unwanted tags or inject additional ones. These correspond to the two
     phases of processing.
+
+    Args:
+        keep_change_id (bool): Keep the Change-Id tag
+        insert_base_commit (bool): True to add the base commit to the end
     """
-    def __init__(self, series, is_log=False, keep_change_id=False):
+    def __init__(self, series, is_log=False, keep_change_id=False,
+                 insert_base_commit=False):
         self.skip_blank = False          # True to skip a single blank line
         self.found_test = False          # Found a TEST= line
         self.lines_after_test = 0        # Number of lines found after TEST=
@@ -103,6 +108,7 @@ class PatchStream:
         self.recent_quoted = collections.deque([], 5)
         self.recent_unquoted = queue.Queue()
         self.was_quoted = None
+        self.insert_base_commit = insert_base_commit
 
     @staticmethod
     def process_text(text, is_comment=False):
@@ -658,6 +664,13 @@ class PatchStream:
                     outfd.write(line + '\n')
                     self.blank_count = 0
         self.finalise()
+        if self.insert_base_commit:
+            if self.series.base_commit:
+                print(f'base-commit: {self.series.base_commit.hash}',
+                      file=outfd)
+            if self.series.branch:
+                print(f'branch: {self.series.branch}', file=outfd)
+
 
 def insert_tags(msg, tags_to_emit):
     """Add extra tags to a commit message
@@ -778,7 +791,8 @@ def get_metadata_for_test(text):
     pst.finalise()
     return series
 
-def fix_patch(backup_dir, fname, series, cmt, keep_change_id=False):
+def fix_patch(backup_dir, fname, series, cmt, keep_change_id=False,
+              insert_base_commit=False):
     """Fix up a patch file, by adding/removing as required.
 
     We remove our tags from the patch file, insert changes lists, etc.
@@ -792,6 +806,7 @@ def fix_patch(backup_dir, fname, series, cmt, keep_change_id=False):
         series (Series): Series information about this patch set
         cmt (Commit): Commit object for this patch file
         keep_change_id (bool): Keep the Change-Id tag.
+        insert_base_commit (bool): True to add the base commit to the end
 
     Return:
         list: A list of errors, each str, or [] if all ok.
@@ -799,7 +814,8 @@ def fix_patch(backup_dir, fname, series, cmt, keep_change_id=False):
     handle, tmpname = tempfile.mkstemp()
     outfd = os.fdopen(handle, 'w', encoding='utf-8')
     infd = open(fname, 'r', encoding='utf-8')
-    pst = PatchStream(series, keep_change_id=keep_change_id)
+    pst = PatchStream(series, keep_change_id=keep_change_id,
+                      insert_base_commit=insert_base_commit)
     pst.commit = cmt
     pst.process_stream(infd, outfd)
     infd.close()
@@ -811,7 +827,7 @@ def fix_patch(backup_dir, fname, series, cmt, keep_change_id=False):
     shutil.move(tmpname, fname)
     return cmt.warn
 
-def fix_patches(series, fnames, keep_change_id=False):
+def fix_patches(series, fnames, keep_change_id=False, insert_base_commit=False):
     """Fix up a list of patches identified by filenames
 
     The patch files are processed in place, and overwritten.
@@ -820,6 +836,7 @@ def fix_patches(series, fnames, keep_change_id=False):
         series (Series): The Series object
         fnames (:type: list of str): List of patch files to process
         keep_change_id (bool): Keep the Change-Id tag.
+        insert_base_commit (bool): True to add the base commit to the end
     """
     # Current workflow creates patches, so we shouldn't need a backup
     backup_dir = None  #tempfile.mkdtemp('clean-patch')
@@ -829,7 +846,8 @@ def fix_patches(series, fnames, keep_change_id=False):
         cmt.patch = fname
         cmt.count = count
         result = fix_patch(backup_dir, fname, series, cmt,
-                           keep_change_id=keep_change_id)
+                           keep_change_id=keep_change_id,
+                           insert_base_commit=insert_base_commit)
         if result:
             print('%d warning%s for %s:' %
                   (len(result), 's' if len(result) > 1 else '', fname))