From f6bc5d17afa9fe12418edaf1fc9f82beeda06132 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Pierre-Cl=C3=A9ment=20Tosi?= Date: Thu, 12 Aug 2021 15:28:31 +0000 Subject: [PATCH] env: Make _init() expect _INVALID when _IS_NOWHERE MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Avoid applying the "fix" introduced by commit 5557eec01cbf ("env: Fix invalid env handling in env_init()") to the environment "nowhere". This is necessary as that commit, by setting the return value of env_init() to -ENOENT if gd->env_valid is ENV_INVALID, forces that function to reset gd->env_valid to ENV_VALID. By doing so, it breaks the assumption (required by ENV_IS_NOWHERE) that gd->env_valid must be ENV_INVALID. This, in turn, results in env_relocate() calling env_load() (it should not), which itself, calls U_BOOT_ENV_LOCATION(nowhere).load() i.e. env_nowhere_load(). That function, being implemented under the assumption mentioned above, calls env_set_default(), which in turn, seeing that gd->env_valid is ENV_VALID (it should not), tries to dereference whatever lies in gd->env_addr (most likely garbage), leading to a faulty memory access. Note that other env_locations might be concerned by this bug but that this commit only intends to fix it for when ENV_IS_NOWHERE. Fixes: 5557eec01cbf ("env: Fix invalid env handling in env_init()") Signed-off-by: Pierre-Clément Tosi --- env/env.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/env/env.c b/env/env.c index e534008..0a0f234 100644 --- a/env/env.c +++ b/env/env.c @@ -336,7 +336,7 @@ int env_init(void) debug("%s: Environment %s init done (ret=%d)\n", __func__, drv->name, ret); - if (gd->env_valid == ENV_INVALID) + if (gd->env_valid == ENV_INVALID && drv->location != ENVL_NOWHERE) ret = -ENOENT; } -- 2.7.4