Hi Torsten, On Wed, Sep 2, 2026 at 10:10 AM Torsten Rupp <[email protected]> wrote: > > Dear U-boot developers, > > I found a bug in mmc_get_env_addr(). The internal calculated offset is OK, > because that is a 64bit value. But the returned env_addr value is only 32bit, > thus it may be truncated. If the offset for the environment memory is beyond > 4GB as in my case (Raspberry compute module 4 with 8GB flash and the > environment is located in a small partition at the end) the value is > truncated and the environment data is read and written from/to some other > location which very likely will override some essential data there (in my > case part of the root file system). > > To fix this the signature of mmc_get_env_addr() have to be: > > int mmc_get_env_addr(struct mmc *mmc, int copy, u64 *env_addr); > > and in all usages of this function the type of the return value have to be > change to 64bit, too.
Please submit a patch: https://docs.u-boot.org/en/v2024.07/develop/sending_patches.html Thanks
