u-boot: Fix CVE-2021-27097, CVE-2021-27138

Backport fixes for CVE-2021-27097 and CVE-2021-27138 as well as
a precursor fdt validation fix that allows using the upstream
patches for the CVEs without significant rebasing.  Note that
the additional upstream changes to add new U-Boot fit image tests
have been left out to keep the patch count down.  Those tests are
currently not used for ptest or oe-selftest, so it is believed
their absence should not be problematic.

(From OE-Core rev: b6c2df341d7e6da5defca9a5567fdb7212489efa)

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 36 insertions, 0 deletions

diff --git a/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch b/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch
new file mode 100644
index 0000000000..d4ac9e2ed9
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch
@@ -0,0 +1,36 @@
+From ea1a9ec5f430359720d9a0621ed1acfbba6a142a Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Date: Wed, 13 Jan 2021 02:09:12 +0100
+Subject: [PATCH] image-fit: fit_check_format check for valid FDT
+
+fit_check_format() must check that the buffer contains a flattened device
+tree before calling any device tree library functions.
+
+Failure to do may cause segmentation faults.
+
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/ea1a9ec5f430359720d9a0621ed1acfbba6a142a]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/image-fit.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 6a8787ca0a..21c44bdf69 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1553,6 +1553,12 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp)
+  */
+ int fit_check_format(const void *fit)
+ {
++       /* A FIT image must be a valid FDT */
++       if (fdt_check_header(fit)) {
++               debug("Wrong FIT format: not a flattened device tree\n");
++               return 0;
++       }
++
+        /* mandatory / node 'description' property */
+        if (fdt_getprop(fit, 0, FIT_DESC_PROP, NULL) == NULL) {
+                debug("Wrong FIT format: no description\n");