Re: [PATCH v2 0/4] fit: Harden handling of external-data properties

Hi Anton,

On Thu, 6 Aug 2026 at 15:29, Anton Ivanov <[email protected]> wrote:
>
> The data-offset, data-position and data-size FIT properties are 32-bit
> unsigned values, but were read through signed int. Also, they are
> excluded from the configuration signature, so they are attacker
> controlled.
>
> Patch 1 switches the accessors and their callers to u32, removing
> the ad-hoc handling of "negative" values in U-Boot proper. This
> transition was discussed and agreed on in [1].
>
> The SPL loader has its own copy of this logic with the same problems
> and fewer checks. Patch 2 factors out a test helper, patch 3 makes the
> SPL offset/size arithmetic overflow-safe, and patch 4 adds the
> addressable-range and FIT_SIGNATURE_MAX_SIZE bounds check that U-Boot
> proper already performs in fit_image_get_data().
>
> Patches 3 and 4 build on each other and on patch 1, so they are not
> intended to be cherry-picked individually.
>
> [1] https://lore.kernel.org/u-boot/CAPWaX55XWFLcMGRuaUuXXn__MX_UG4J8QTd6rvXZmJ4WSOCy9w@mail.gmail.com/
>
> ---
> Changes in v2:
> - Patch 1: keep the 0xffffffff data-position and data-size test cases
>   instead of dropping them; they are renamed and repointed at the
>   "FIT external data is out of bounds" message they now hit.
> - Patches 3 and 4: no code changes, added SPL code-size figures
> - Link to v1: https://lore.kernel.org/all/[email protected]/
>
> Patches 1, 2 and 4 carry Reviewed-by: Simon Glass.

I don't see those tags?

>
> ---
> Anton Ivanov (4):
>       image-fit: Use unsigned types for external data properties
>       test: spl: Factor out external-data FIT property checks
>       spl: fit: Harden external-data offset and size arithmetic
>       spl: fit: Bound external data like U-Boot proper
>
>  boot/image-fit.c               |  29 ++++------
>  common/spl/spl_fit.c           | 122 +++++++++++++++++++++++++--------------
>  common/splash_source.c         |   2 +-
>  drivers/fpga/socfpga_arria10.c |   3 +-
>  include/image.h                |   6 +-
>  test/image/spl_load.c          | 128 +++++++++++++++++++++++++++++++++++------
>  test/py/tests/test_vboot.py    |  10 ++--
>  7 files changed, 210 insertions(+), 90 deletions(-)
> ---
> base-commit: 94b349bd902d9e38e1846c157fadd9054c34680a
> change-id: 20260730-b4-fit-ext-data-hardening-1734a9203753
>
> Best regards,
> --
> Anton Ivanov <[email protected]>
>

Regards,
SImon