net: Check for the minimum IP fragmented datagram size

[platform/kernel/u-boot.git] / net / nfs.c

diff --git a/net/nfs.c b/net/nfs.c
index 86dfe9a..9152ab7 100644 (file)
--- a/net/nfs.c
+++ b/net/nfs.c
@@ -28,19 +28,18 @@
 
 #include <common.h>
 #include <command.h>
+#include <flash.h>
+#include <image.h>
+#include <log.h>
 #include <net.h>
 #include <malloc.h>
 #include <mapmem.h>
 #include "nfs.h"
 #include "bootp.h"
+#include <time.h>
 
 #define HASHES_PER_LINE 65     /* Number of "loading" hashes per line  */
 #define NFS_RETRY_COUNT 30
-#ifndef CONFIG_NFS_TIMEOUT
-# define NFS_TIMEOUT 2000UL
-#else
-# define NFS_TIMEOUT CONFIG_NFS_TIMEOUT
-#endif
 
 #define NFS_RPC_ERR    1
 #define NFS_RPC_DROP   124
@@ -49,11 +48,11 @@ static int fs_mounted;
 static unsigned long rpc_id;
 static int nfs_offset = -1;
 static int nfs_len;
-static ulong nfs_timeout = NFS_TIMEOUT;
+static const ulong nfs_timeout = CONFIG_NFS_TIMEOUT;
 
 static char dirfh[NFS_FHSIZE]; /* NFSv2 / NFSv3 file handle of directory */
 static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */
-static int filefh3_length;     /* (variable) length of filefh when NFSv3 */
+static unsigned int filefh3_length;    /* (variable) length of filefh when NFSv3 */
 
 static enum net_loop_state nfs_download_state;
 static struct in_addr nfs_server_ip;
@@ -86,14 +85,15 @@ static inline int store_block(uchar *src, unsigned offset, unsigned len)
 
        for (i = 0; i < CONFIG_SYS_MAX_FLASH_BANKS; i++) {
                /* start address in flash? */
-               if (load_addr + offset >= flash_info[i].start[0]) {
+               if (image_load_addr + offset >= flash_info[i].start[0]) {
                        rc = 1;
                        break;
                }
        }
 
        if (rc) { /* Flash is destination for this packet */
-               rc = flash_write((uchar *)src, (ulong)(load_addr+offset), len);
+               rc = flash_write((uchar *)src, (ulong)image_load_addr + offset,
+                                len);
                if (rc) {
                        flash_perror(rc);
                        return -1;
@@ -101,7 +101,7 @@ static inline int store_block(uchar *src, unsigned offset, unsigned len)
        } else
 #endif /* CONFIG_SYS_DIRECT_FLASH_NFS */
        {
-               void *ptr = map_sysmem(load_addr + offset, len);
+               void *ptr = map_sysmem(image_load_addr + offset, len);
 
                memcpy(ptr, src, len);
                unmap_sysmem(ptr);
@@ -196,10 +196,10 @@ static void rpc_req(int rpc_prog, int rpc_proc, uint32_t *data, int datalen)
                rpc_pkt.u.call.vers = htonl(2); /* portmapper is version 2 */
        }
        rpc_pkt.u.call.proc = htonl(rpc_proc);
-       p = (uint32_t *)&(rpc_pkt.u.call.data);
+       p = rpc_pkt.u.call.data;
 
        if (datalen)
-               memcpy((char *)p, (char *)data, datalen*sizeof(uint32_t));
+               memcpy(p, data, datalen * sizeof(uint32_t));
 
        pktlen = (char *)p + datalen * sizeof(uint32_t) - (char *)&rpc_pkt;
 
@@ -566,6 +566,8 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len)
        }
 
        if (supported_nfs_versions & NFSV2_FLAG) {
+               if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + NFS_FHSIZE) > len)
+                       return -NFS_RPC_DROP;
                memcpy(filefh, rpc_pkt.u.reply.data + 1, NFS_FHSIZE);
        } else {  /* NFSV3_FLAG */
                filefh3_length = ntohl(rpc_pkt.u.reply.data[1]);
@@ -579,7 +581,7 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len)
 
 static int nfs3_get_attributes_offset(uint32_t *data)
 {
-       if (ntohl(data[1]) != 0) {
+       if (data[1]) {
                /* 'attributes_follow' flag is TRUE,
                 * so we have attributes on 21 dwords */
                /* Skip unused values :
@@ -634,6 +636,9 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
        /* new path length */
        rlen = ntohl(rpc_pkt.u.reply.data[1 + nfsv3_data_offset]);
 
+       if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len)
+               return -NFS_RPC_DROP;
+
        if (*((char *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset])) != '/') {
                int pathlen;
 
@@ -701,6 +706,9 @@ static int nfs_read_reply(uchar *pkt, unsigned len)
                        &(rpc_pkt.u.reply.data[4 + nfsv3_data_offset]);
        }
 
+       if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + rlen) > len)
+                       return -9999;
+
        if (store_block(data_ptr, nfs_offset, rlen))
                        return -9999;
 
@@ -718,7 +726,7 @@ static void nfs_timeout_handler(void)
        } else {
                puts("T ");
                net_set_timeout_handler(nfs_timeout +
-                                       NFS_TIMEOUT * nfs_timeout_count,
+                                       nfs_timeout * nfs_timeout_count,
                                        nfs_timeout_handler);
                nfs_send();
        }
@@ -732,6 +740,9 @@ static void nfs_handler(uchar *pkt, unsigned dest, struct in_addr sip,
 
        debug("%s\n", __func__);
 
+       if (len > sizeof(struct rpc_t))
+               return;
+
        if (dest != nfs_our_port)
                return;
 
@@ -859,7 +870,8 @@ void nfs_start(void)
                return;
        }
 
-       if (net_boot_file_name[0] == '\0') {
+       if (!net_parse_bootfile(&nfs_server_ip, nfs_path,
+                               sizeof(nfs_path_buff))) {
                sprintf(nfs_path, "/nfsroot/%02X%02X%02X%02X.img",
                        net_ip.s_addr & 0xFF,
                        (net_ip.s_addr >>  8) & 0xFF,
@@ -868,18 +880,6 @@ void nfs_start(void)
 
                printf("*** Warning: no boot file name; using '%s'\n",
                       nfs_path);
-       } else {
-               char *p = net_boot_file_name;
-
-               p = strchr(p, ':');
-
-               if (p != NULL) {
-                       nfs_server_ip = string_to_ip(net_boot_file_name);
-                       ++p;
-                       strcpy(nfs_path, p);
-               } else {
-                       strcpy(nfs_path, net_boot_file_name);
-               }
        }
 
        nfs_filename = basename(nfs_path);
@@ -908,7 +908,7 @@ void nfs_start(void)
                       net_boot_file_expected_size_in_blocks << 9);
                print_size(net_boot_file_expected_size_in_blocks << 9, "");
        }
-       printf("\nLoad address: 0x%lx\nLoading: *\b", load_addr);
+       printf("\nLoad address: 0x%lx\nLoading: *\b", image_load_addr);
 
        net_set_timeout_handler(nfs_timeout, nfs_timeout_handler);
        net_set_udp_handler(nfs_handler);