spl: fit: Fill in the image descriptor when skipping a zero-size image

load_simple_fit() is expected to fill in the image_info structure it
receives upon successful return, but the path which skips a zero-sized
image returns success without touching it. The result is that
spl_fit_record_loadable() then publishes whatever else the descriptor
happened to hold in /fit-images under the skipped image's name: the size
and entry point of the previous loadable, or - for the first one, since
image_info is declared without an initialiser - uninitialised stack.

This is reachable whenever a FIT carries an image node with no content,
which binman produces for an optional blob that was not supplied, such as
an OP-TEE which the build did not provide.

Ensure that the image_info structure is filled in with a size and entry
point before returning, same way as other successful paths do (but
skipping the actual load).

Fixes: 6d99f866952b ("spl: fit: Skip attempting to load 0 length image")
Signed-off-by: Alexey Charkov <alchark@flipper.net>
Reviewed-by: Simon Glass <sjg@chromium.org>

1 files changed, 29 insertions, 11 deletions

diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index 18bff7b8d4a..0dbc0ba8153 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -194,6 +194,33 @@ static int get_aligned_image_size(struct spl_load_info *info, int data_size,
 }
 
 /**
+ * fit_fill_image_info(): describe a loaded image to the caller
+ * @fit:	points to the FIT image
+ * @node:	offset of the DT node describing the image
+ * @image_info:	filled in with where the image ended up and how big it is;
+ *		ignored if NULL
+ * @load_addr:	address the image was loaded to
+ * @size:	number of bytes loaded, which may be zero
+ */
+static void fit_fill_image_info(const void *fit, int node,
+				struct spl_image_info *image_info,
+				ulong load_addr, ulong size)
+{
+	ulong entry_point;
+
+	if (!image_info)
+		return;
+
+	image_info->load_addr = load_addr;
+	image_info->size = size;
+
+	if (!fit_image_get_entry(fit, node, &entry_point))
+		image_info->entry_point = entry_point;
+	else
+		image_info->entry_point = FDT_ERROR;
+}
+
+/**
  * load_simple_fit(): load the image described in a certain FIT node
  * @info:	points to information about the device to load data from
  * @fit_offset:	the offset of the FIT image on the device
@@ -291,6 +318,7 @@ static int load_simple_fit(struct spl_load_info *info, ulong fit_offset,
 		if (!len) {
 			log_warning("%s: Skip load '%s': image size is 0!\n",
 				    __func__, fit_get_name(fit, node, NULL));
+			fit_fill_image_info(fit, node, image_info, load_addr, 0);
 			return 0;
 		}
 
@@ -385,17 +413,7 @@ static int load_simple_fit(struct spl_load_info *info, ulong fit_offset,
 		memmove(load_ptr, src, length);
 	}
 
-	if (image_info) {
-		ulong entry_point;
-
-		image_info->load_addr = load_addr;
-		image_info->size = length;
-
-		if (!fit_image_get_entry(fit, node, &entry_point))
-			image_info->entry_point = entry_point;
-		else
-			image_info->entry_point = FDT_ERROR;
-	}
+	fit_fill_image_info(fit, node, image_info, load_addr, length);
 	log_debug("- done loading\n");
 
 	upl_add_image(fit, node, load_addr, length);