From patchwork Fri Feb 25 14:25:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4254 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FEBEC433EF for ; Fri, 25 Feb 2022 14:26:52 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.web09.6915.1645799211491965552 for ; Fri, 25 Feb 2022 06:26:51 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=SEbyHabf; spf=softfail (domain: sakoman.com, ip: 209.85.215.171, mailfrom: steve@sakoman.com) Received: by mail-pg1-f171.google.com with SMTP id 132so4790537pga.5 for ; Fri, 25 Feb 2022 06:26:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=3vi6OXoK/DnKzV0RkLeDMqjaur9MT3W8eJwQJi4vhIc=; b=SEbyHabfYiEsEVMSW5mzt0XqXBmmyOIym7aovdfG99zsqAqQ0NRIjZ42lSpx7iSLuE Qh34QGJbr1xNfJeGrXIpaV08yKsjk47wEB3sJHPHYJRfbI4mDkuXg37nmvOJm9S5aXWH rLE4ETWBUAf/MCz97QEW63VDfOItNixOrhG9AEt64axq4TUJNc2ZGXCSK52QvwmxeKzO DKJIbXt/7NJ5+7gTlCwJGA+wQfsoYgRjzmO5y7Zbi3xKz0XQeW/Ww4aqxgkvXDeHMDjN a0M2hAPDsPcHky+79HCZ+XqlMIe1+Rdzcms/ubpXYTBEio4PZkPFqYEZUBqV+b3vueY/ 0RBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=3vi6OXoK/DnKzV0RkLeDMqjaur9MT3W8eJwQJi4vhIc=; b=dIqfsgC18cBU886+QcXm2yN47v5++8k4S2EJR59chwst00ZjCLFbHb6VtAP7iqlT80 ZAHRZpOe6KtIN92HEopK9GJNmb3JD34i1fV4Msqq6+4kIyAC1NjSKGWxFIrzx65aK8Ap ozoWs75SdFkk6eBCPK3ANK2vn6hXCmbmKj07K+82yIe6JkVRQ3OD2m7Sq5IFBV2G8JyJ I5lE5/w2SJ2WU/j9YhtSIJ2N/zJYVboD2LpLtXNgVP4L5cY3B9ZQ82JiyGhJSXDKPLgb HwjLiI7D5R2DrB7EG7GgCTEnvALRfS31HdhEfZforgbLKFlg5DnOL0LJ9jP89PjvKwHD TRIQ== X-Gm-Message-State: AOAM531dZ89tTFqxyn+NJze2nL8jshXrdpG1kzpCY4XTW7WkR6nVM9IG wdf+4DdY/N0K4JnHW+Q6xMJ4wxaohUHaa5iL X-Google-Smtp-Source: ABdhPJw416JovpgClDYqkF8NjwVsz2QpYE9B3bZL5e+o5w4U11g1MZEiWzMmRU3LyUwbDaSDXkSnzQ== X-Received: by 2002:a05:6a00:1a42:b0:4d1:e81a:64cb with SMTP id h2-20020a056a001a4200b004d1e81a64cbmr8060883pfv.78.1645799210282; Fri, 25 Feb 2022 06:26:50 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.26.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:26:49 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 01/50] openssl: Add fix for CVE-2021-4160 Date: Fri, 25 Feb 2022 04:25:41 -1000 Message-Id: <5216986fc6dfd06562efa5937581dc6fa77ad276.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:26:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162347 From: Ranjitsinh Rathod Add a patch to fix CVE-2021-4160 The issue only affects OpenSSL on MIPS platforms. Link: https://security-tracker.debian.org/tracker/CVE-2021-4160 Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman --- .../openssl/openssl/CVE-2021-4160.patch | 145 ++++++++++++++++++ .../openssl/openssl_1.1.1l.bb | 1 + 2 files changed, 146 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2021-4160.patch diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2021-4160.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2021-4160.patch new file mode 100644 index 0000000000..ff1e807157 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2021-4160.patch @@ -0,0 +1,145 @@ +From e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb Mon Sep 17 00:00:00 2001 +From: Bernd Edlinger +Date: Sat, 11 Dec 2021 20:28:11 +0100 +Subject: [PATCH] Fix a carry overflow bug in bn_sqr_comba4/8 for mips 32-bit + targets + +bn_sqr_comba8 does for instance compute a wrong result for the value: +a=0x4aaac919 62056c84 fba7334e 1a6be678 022181ba fd3aa878 899b2346 ee210f45 + +The correct result is: +r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f + 912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3d 97ed17d4 7950b465 3cb32899 + +but the actual result was: +r=0x15c72e32 605a3061 d11b1012 3c187483 6df96999 bd0c22ba d3e7d437 4724a82f + 912c5e61 6a187efe 8f7c47fc f6945fe5 75be8e3c 97ed17d4 7950b465 3cb32899 + +so the forth word of the result was 0x75be8e3c but should have been +0x75be8e3d instead. + +Likewise bn_sqr_comba4 has an identical bug for the same value as well: +a=0x022181ba fd3aa878 899b2346 ee210f45 + +correct result: +r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3d 97ed17d4 7950b465 3cb32899 + +wrong result: +r=0x00048a69 9fe82f8b 62bd2ed1 88781335 75be8e3c 97ed17d4 7950b465 3cb32899 + +Fortunately the bn_mul_comba4/8 code paths are not affected. + +Also the mips64 target does in fact not handle the carry propagation +correctly. + +Example: +a=0x4aaac91900000000 62056c8400000000 fba7334e00000000 1a6be67800000000 + 022181ba00000000 fd3aa87800000000 899b234635dad283 ee210f4500000001 + +correct result: +r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1 + 0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d + 3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06 + 2822309cd1d292f9 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001 + +wrong result: +r=0x15c72e32272c4471 392debf018c679c8 b85496496bf8254c d0204f36611e2be1 + 0cdb3db8f3c081d8 c94ba0e1bacc5061 191b83d47ff929f6 5be0aebfc13ae68d + 3eea7a7fdf2f5758 42f7ec656cab3cb5 6a28095be34756f2 64f24687bf37de06 + 2822309cd1d292f8 6fa698c972372f09 771e97d3a868cda0 dc421e8a00000001 + +Reviewed-by: Paul Dale +(Merged from https://github.com/openssl/openssl/pull/17258) + +(cherry picked from commit 336923c0c8d705cb8af5216b29a205662db0d590) + +Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=patch;h=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb] +CVE: CVE-2021-4160 +Signed-off-by: Ranjitsinh Rathod + +--- + crypto/bn/asm/mips.pl | 4 ++++ + test/bntest.c | 45 +++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 49 insertions(+) + +diff --git a/crypto/bn/asm/mips.pl b/crypto/bn/asm/mips.pl +index 8ad715bda4..74101030f2 100644 +--- a/crypto/bn/asm/mips.pl ++++ b/crypto/bn/asm/mips.pl +@@ -1984,6 +1984,8 @@ $code.=<<___; + sltu $at,$c_2,$t_1 + $ADDU $c_3,$t_2,$at + $ST $c_2,$BNSZ($a0) ++ sltu $at,$c_3,$t_2 ++ $ADDU $c_1,$at + mflo ($t_1,$a_2,$a_0) + mfhi ($t_2,$a_2,$a_0) + ___ +@@ -2194,6 +2196,8 @@ $code.=<<___; + sltu $at,$c_2,$t_1 + $ADDU $c_3,$t_2,$at + $ST $c_2,$BNSZ($a0) ++ sltu $at,$c_3,$t_2 ++ $ADDU $c_1,$at + mflo ($t_1,$a_2,$a_0) + mfhi ($t_2,$a_2,$a_0) + ___ +diff --git a/test/bntest.c b/test/bntest.c +index b58028a301..bab34ba54b 100644 +--- a/test/bntest.c ++++ b/test/bntest.c +@@ -627,6 +627,51 @@ static int test_modexp_mont5(void) + if (!TEST_BN_eq(c, d)) + goto err; + ++ /* ++ * Regression test for overflow bug in bn_sqr_comba4/8 for ++ * mips-linux-gnu and mipsel-linux-gnu 32bit targets. ++ */ ++ { ++ static const char *ehex[] = { ++ "95564994a96c45954227b845a1e99cb939d5a1da99ee91acc962396ae999a9ee", ++ "38603790448f2f7694c242a875f0cad0aae658eba085f312d2febbbd128dd2b5", ++ "8f7d1149f03724215d704344d0d62c587ae3c5939cba4b9b5f3dc5e8e911ef9a", ++ "5ce1a5a749a4989d0d8368f6e1f8cdf3a362a6c97fb02047ff152b480a4ad985", ++ "2d45efdf0770542992afca6a0590d52930434bba96017afbc9f99e112950a8b1", ++ "a359473ec376f329bdae6a19f503be6d4be7393c4e43468831234e27e3838680", ++ "b949390d2e416a3f9759e5349ab4c253f6f29f819a6fe4cbfd27ada34903300e", ++ "da021f62839f5878a36f1bc3085375b00fd5fa3e68d316c0fdace87a97558465", ++ NULL}; ++ static const char *phex[] = { ++ "f95dc0f980fbd22e90caa5a387cc4a369f3f830d50dd321c40db8c09a7e1a241", ++ "a536e096622d3280c0c1ba849c1f4a79bf490f60006d081e8cf69960189f0d31", ++ "2cd9e17073a3fba7881b21474a13b334116cb2f5dbf3189a6de3515d0840f053", ++ "c776d3982d391b6d04d642dda5cc6d1640174c09875addb70595658f89efb439", ++ "dc6fbd55f903aadd307982d3f659207f265e1ec6271b274521b7a5e28e8fd7a5", ++ "5df089292820477802a43cf5b6b94e999e8c9944ddebb0d0e95a60f88cb7e813", ++ "ba110d20e1024774107dd02949031864923b3cb8c3f7250d6d1287b0a40db6a4", ++ "7bd5a469518eb65aa207ddc47d8c6e5fc8e0c105be8fc1d4b57b2e27540471d5", ++ NULL}; ++ static const char *mhex[] = { ++ "fef15d5ce4625f1bccfbba49fc8439c72bf8202af039a2259678941b60bb4a8f", ++ "2987e965d58fd8cf86a856674d519763d0e1211cc9f8596971050d56d9b35db3", ++ "785866cfbca17cfdbed6060be3629d894f924a89fdc1efc624f80d41a22f1900", ++ "9503fcc3824ef62ccb9208430c26f2d8ceb2c63488ec4c07437aa4c96c43dd8b", ++ "9289ed00a712ff66ee195dc71f5e4ead02172b63c543d69baf495f5fd63ba7bc", ++ "c633bd309c016e37736da92129d0b053d4ab28d21ad7d8b6fab2a8bbdc8ee647", ++ "d2fbcf2cf426cf892e6f5639e0252993965dfb73ccd277407014ea784aaa280c", ++ "b7b03972bc8b0baa72360bdb44b82415b86b2f260f877791cd33ba8f2d65229b", ++ NULL}; ++ ++ if (!TEST_true(parse_bigBN(&e, ehex)) ++ || !TEST_true(parse_bigBN(&p, phex)) ++ || !TEST_true(parse_bigBN(&m, mhex)) ++ || !TEST_true(BN_mod_exp_mont_consttime(d, e, p, m, ctx, NULL)) ++ || !TEST_true(BN_mod_exp_simple(a, e, p, m, ctx)) ++ || !TEST_BN_eq(a, d)) ++ goto err; ++ } ++ + /* Zero input */ + if (!TEST_true(BN_bntest_rand(p, 1024, 0, 0))) + goto err; +-- +2.25.1 + diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb index bf7cd6527e..24466e11b1 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://afalg.patch \ file://reproducible.patch \ file://reproducibility.patch \ + file://CVE-2021-4160.patch \ " SRC_URI_append_class-nativesdk = " \ From patchwork Fri Feb 25 14:25:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4257 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71747C433FE for ; Fri, 25 Feb 2022 14:26:56 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.web10.7051.1645799213831933847 for ; Fri, 25 Feb 2022 06:26:54 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=lvDHMpJV; spf=softfail (domain: sakoman.com, ip: 209.85.216.47, mailfrom: steve@sakoman.com) Received: by mail-pj1-f47.google.com with SMTP id iq13-20020a17090afb4d00b001bc4437df2cso4959694pjb.2 for ; Fri, 25 Feb 2022 06:26:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=fch1dlqdQk90TVUoQLiZ+4jUwc6WSGVL+X4ZveFs33A=; b=lvDHMpJVo0Id4FopQJTJlV3tbiOMCA+30i3A1gw/m9jXRPOke+tMJpkOZw8Z0J2/Ya djGpNe7poSDr5tYdZETc4jve6hTULd8mA5V54zO4ExRj+LrAxXFVQAG5lMMr9vBwQbzj itVmhbykKZpREg7Pg/Wdx9P5OLKnbp88hxsjKNaeDftVjoxzP/plEWT2QHyylgj5OoOD JOwB3TNuJjRi4d8K+DlS8X7q9+xUhsY41QBaET1f6KbCyN2w5nfGQg61GiE1Ou/jiUQR gufecLq0PguraEqoYSvTFveK61359mjsmqLjTLK6vpBkT6oE0iwM89zYwCzvJOTIVWFN /0uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=fch1dlqdQk90TVUoQLiZ+4jUwc6WSGVL+X4ZveFs33A=; b=YUOE5FvnXsV7BlhBQr8IpEE3kDTlaaDlYsE7ID5Me9BAZnGgsAUhKhAMVasLgLC/PF J4uUhFewxEttn6Stf1I6xtOsvZW6nZt4qtYYICbKDTQuDihaXreepJL6aU9jnDXi9tnm mFQL6YOTRH33sMGQJi0gepxPrqbrchekoF4+zVdMZHN2SrpivKjvvbdjWa0u/M50bRR0 8n32RF8S43q67WeZXGwfsEnFjk+b7Y8OmOS7ezPdwPhdis4jjrE4y1OIVtMaxONrfZqA VbVo7AWqXURLG/S1w4FNjWv6FLimsetShadKAXkQy+vfl46ftevEFKPoS/abpRrE8ayT gwzA== X-Gm-Message-State: AOAM532+9dtzVa83+h+pgMkvxGB/eRMYvvx63Qyw17faJcjm9D0Bg163 I4BdPvQfqUU3J8+ipjkD9xHmalZYOPB3s6Hh X-Google-Smtp-Source: ABdhPJz8EWDgCM9aUyO63fOfvSj2yFJiqqMqySdJuTUWUZ7RrOwEsrZud3+sb5ncHReIb3ea1EuvsA== X-Received: by 2002:a17:902:ec92:b0:14f:e593:5e99 with SMTP id x18-20020a170902ec9200b0014fe5935e99mr7871986plg.42.1645799212722; Fri, 25 Feb 2022 06:26:52 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.26.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:26:52 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 02/50] tiff: fix for CVE-2022-22844 Date: Fri, 25 Feb 2022 04:25:42 -1000 Message-Id: <68b59e37d25ead5aaf68d24c6a55b7d1864203fa.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:26:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162348 From: Purushottam Choudhary Backport patch from: https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64 Signed-off-by: Purushottam Choudhary Signed-off-by: Purushottam Choudhary Signed-off-by: Steve Sakoman --- ...al-buffer-overflow-for-ASCII-tags-wh.patch | 52 +++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch diff --git a/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch b/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch new file mode 100644 index 0000000000..31f867e000 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/files/0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch @@ -0,0 +1,52 @@ +From b12a0326e6064b6e0b051d1184a219877472f69b Mon Sep 17 00:00:00 2001 +From: 4ugustus +Date: Tue, 25 Jan 2022 16:25:28 +0000 +Subject: [PATCH] tiffset: fix global-buffer-overflow for ASCII tags where + count is required (fixes #355) + +CVE: CVE-2022-22844 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64] +Signed-off-by: Purushottam Choudhary +Signed-off-by: Purushottam Choudhary +Comments: Add header stdint.h in tiffset.c explicitly for UINT16_MAX +--- + tools/tiffset.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/tools/tiffset.c b/tools/tiffset.c +index 8c9e23c5..e7a88c09 100644 +--- a/tools/tiffset.c ++++ b/tools/tiffset.c +@@ -33,6 +33,7 @@ + #include + #include + ++#include + #include "tiffio.h" + + static char* usageMsg[] = { +@@ -146,9 +146,19 @@ main(int argc, char* argv[]) + + arg_index++; + if (TIFFFieldDataType(fip) == TIFF_ASCII) { +- if (TIFFSetField(tiff, TIFFFieldTag(fip), argv[arg_index]) != 1) +- fprintf( stderr, "Failed to set %s=%s\n", +- TIFFFieldName(fip), argv[arg_index] ); ++ if(TIFFFieldPassCount( fip )) { ++ size_t len; ++ len = strlen(argv[arg_index]) + 1; ++ if (len > UINT16_MAX || TIFFSetField(tiff, TIFFFieldTag(fip), ++ (uint16_t)len, argv[arg_index]) != 1) ++ fprintf( stderr, "Failed to set %s=%s\n", ++ TIFFFieldName(fip), argv[arg_index] ); ++ } else { ++ if (TIFFSetField(tiff, TIFFFieldTag(fip), ++ argv[arg_index]) != 1) ++ fprintf( stderr, "Failed to set %s=%s\n", ++ TIFFFieldName(fip), argv[arg_index] ); ++ } + } else if (TIFFFieldWriteCount(fip) > 0 + || TIFFFieldWriteCount(fip) == TIFF_VARIABLE) { + int ret = 1; +-- +GitLab diff --git a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb index 43f210111d..0948bb4e2f 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.1.0.bb @@ -15,6 +15,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch \ file://002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch \ file://CVE-2020-35521_and_CVE-2020-35522.patch \ + file://0001-tiffset-fix-global-buffer-overflow-for-ASCII-tags-wh.patch \ " SRC_URI[md5sum] = "2165e7aba557463acc0664e71a3ed424" SRC_URI[sha256sum] = "5d29f32517dadb6dbcd1255ea5bbc93a2b54b94fbf83653b4d65c7d6775b8634" From patchwork Fri Feb 25 14:25:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4255 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76327C4332F for ; Fri, 25 Feb 2022 14:26:56 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.web11.6906.1645799215944013290 for ; Fri, 25 Feb 2022 06:26:56 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=ZOTG+Qle; spf=softfail (domain: sakoman.com, ip: 209.85.216.46, mailfrom: steve@sakoman.com) Received: by mail-pj1-f46.google.com with SMTP id h17-20020a17090acf1100b001bc68ecce4aso8565810pju.4 for ; Fri, 25 Feb 2022 06:26:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=x3q6vPHDgGXXfIYqkf44PYlu+IP/zHfZNpx0uBVfXdg=; b=ZOTG+QleVaHjXVWljkp96zRy0hkaOwBhYJAc+qQshoR9ssrU8W2V7aueRkMYmVPlLx 4Px+eo0/VI802Lew9n4LA2FOo7/1Exuhjclh8lcIs9yeqMqwPrHAkAk/tZT4P0DBwGkg qqov+2M2sHWnx+wurX4qEbeyy0+Pz/AwzI1WEsIKIjWolmiS+pQT1oUxnzf4zfPdjPG+ GehscrM9PmKA2ojtNkuZuFv6GQ3gSKtfARy0qkw4tU3UdFjFld9o4BVMlDUmm9eftn8S 4TZG/OR4pPra9Fd+S0i4FU3jE2enQX2NED3RKjmJpnveeA+Jc8mwxO0Vuh15q2nSqK9m hFWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=x3q6vPHDgGXXfIYqkf44PYlu+IP/zHfZNpx0uBVfXdg=; b=Qo+upX6oLaAXlPaNEmSU3CW2DoNemW+kd2NVQY2HRlZl5LfKDADgFKSyWEwc5sRUWL ifN8jYTqMkFtsdL/xrt4TE7h6400XFS9aYF8ws1TetqAYCyiMuahJ/+13BtCMEHHTvtx 6Kb5YXc/c0eRFVSEmwTDrkUJfUUtX6z4/L9iN6JzfJ6ArW5GL+Skah/tcr3Gj4fRiJP4 dihf5+LIoF4DmUhoZ4wl6Y1AtEyLAcakkFriAMGsiHcYby38M141gVDJWYWz1TGUnzFm jv7VJNmd5bh7OJCmoT4N86VBa7GLV6XgRoz4z8cCYAWlKzv0tWpGelTTMsjfBYPUTy2E E6uQ== X-Gm-Message-State: AOAM532ToqsvymVfyg0zBv3S7t4qdAb3iOHt/HW5B38WID4wdaItDqoh moCZXXLipddjBAKyiSHzF+M6t+rCM7ZJa0qg X-Google-Smtp-Source: ABdhPJwMmR6ccWrEGo94qmi88vyXLCVFo243ts1qTdV7LU/3UmshazippfIB3ySH3uosRLMWxFFScA== X-Received: by 2002:a17:902:da84:b0:14f:deb1:8f6d with SMTP id j4-20020a170902da8400b0014fdeb18f6dmr7688356plx.103.1645799215018; Fri, 25 Feb 2022 06:26:55 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.26.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:26:54 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 03/50] ruby: 2.7.4 -> 2.7.5 Date: Fri, 25 Feb 2022 04:25:43 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:26:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162349 From: Chee Yang Lee This release includes security fixes. CVE-2021-41817: Regular Expression Denial of Service Vulnerability of Date Parsing Methods CVE-2021-41816: Buffer Overrun in CGI.escape_html CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman --- meta/recipes-devtools/ruby/{ruby_2.7.4.bb => ruby_2.7.5.bb} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename meta/recipes-devtools/ruby/{ruby_2.7.4.bb => ruby_2.7.5.bb} (95%) diff --git a/meta/recipes-devtools/ruby/ruby_2.7.4.bb b/meta/recipes-devtools/ruby/ruby_2.7.5.bb similarity index 95% rename from meta/recipes-devtools/ruby/ruby_2.7.4.bb rename to meta/recipes-devtools/ruby/ruby_2.7.5.bb index dafa7d2f6b..44a2527ee7 100644 --- a/meta/recipes-devtools/ruby/ruby_2.7.4.bb +++ b/meta/recipes-devtools/ruby/ruby_2.7.5.bb @@ -9,8 +9,8 @@ SRC_URI += " \ file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \ " -SRC_URI[md5sum] = "823cd21d93c69e4168b03dd127369343" -SRC_URI[sha256sum] = "3043099089608859fc8cce7f9fdccaa1f53a462457e3838ec3b25a7d609fbc5b" +SRC_URI[md5sum] = "ede247b56fb862f1f67f9471189b04d4" +SRC_URI[sha256sum] = "2755b900a21235b443bb16dadd9032f784d4a88f143d852bc5d154f22b8781f1" PACKAGECONFIG ??= "" PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" From patchwork Fri Feb 25 14:25:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4258 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D521C433F5 for ; Fri, 25 Feb 2022 14:26:59 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.web11.6908.1645799218119254731 for ; Fri, 25 Feb 2022 06:26:58 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=cajMCTJU; spf=softfail (domain: sakoman.com, ip: 209.85.216.54, mailfrom: steve@sakoman.com) Received: by mail-pj1-f54.google.com with SMTP id j10-20020a17090a94ca00b001bc2a9596f6so4925188pjw.5 for ; Fri, 25 Feb 2022 06:26:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=KprXCRO2fjv0h2CRObxw3tHmqhYHA3j63UkDX++/NaU=; b=cajMCTJURfcVYEhlabBvKRQ6RF46VSHrf4y+kDpyhUYgjW7CyAlaZIL1G3RFFpXurO wNc0cJqoZsj6WTEcPw0RAaJID0LLbbSqaOv7wakxhTOhqCgkZE8ofzqCxO+fGTgyPXZN PxVoeeM5x9dyBsBXK2LV9czAA+MGl4aido2g4j0fq89igmCHha3WwD5zPW1zRjk0z61M oTA7khVJwi8QhorVzRdpibD9X2NLq1+UJrVYBXkRe0cMII7JTD8pZY4lilr1qiHVNzLC 5z3P/VH+t/R9O8JegkhGvfncPByEe4H8Bddh7KG01Ron8VjX3cXk9f4k5bUutfpBAwDB g+jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=KprXCRO2fjv0h2CRObxw3tHmqhYHA3j63UkDX++/NaU=; b=S7ct4TzmPfqAHpByLpbJ+DigDS+Ev06v78ZxZVOOcoK3ta8g9Pp2zTvV3Z3pPJKBQ4 G52NEUb1uNgTrBgspltzT9kmFndRfsmmLye9dDGXGgL0MWOCBO+RioGFnJsWm4covFSa 50o0DtXcElnER1m1bl2P0/03Tw+BmcJ1Qk4izQhRKpIYURZ7TwVF1Ab/IE93TV8P3aS6 EeXgQ6MfLfIwYhTrZKwNcrdW+zaD2l1y3eo67lUIfX4GEu7tZUhlSTPN/1BcaTeSK0EP GC7DiKX1SOWZU4mMLr87LGm6PHTGJgOQ+5wCrHdMrgVIUbzkut3rbJe+y21Bqi1siRG4 VUcA== X-Gm-Message-State: AOAM530f8SgPsGWCLNYLzNeu6JL+yth4Avz112QdHQKWKJP+udksDDph lYoipo3ShbLS7FA5/EVHGcwEInF411NQo9JA X-Google-Smtp-Source: ABdhPJxK8zbc69FUVDE3y/NIi06WlKm62QvZSmoujvd4brToyJpoIh+uati+4tIzbl1Vt4uOGx0rkA== X-Received: by 2002:a17:902:ef4c:b0:14f:7548:dae3 with SMTP id e12-20020a170902ef4c00b0014f7548dae3mr7706430plx.92.1645799217191; Fri, 25 Feb 2022 06:26:57 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.26.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:26:56 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 04/50] puzzles: Upstream changed to main branch for development Date: Fri, 25 Feb 2022 04:25:44 -1000 Message-Id: <930f097ef9e40fd4631a24ce79b99a4eb166319b.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:26:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162350 From: Kartikey Rameshbhai Parmar Signed-off-by: Kartikey Rameshbhai Parmar Signed-off-by: Steve Sakoman --- meta/recipes-sato/puzzles/puzzles_git.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-sato/puzzles/puzzles_git.bb b/meta/recipes-sato/puzzles/puzzles_git.bb index 2edc9ada2e..3ee441998d 100644 --- a/meta/recipes-sato/puzzles/puzzles_git.bb +++ b/meta/recipes-sato/puzzles/puzzles_git.bb @@ -9,7 +9,7 @@ DEPENDS = "libxt" # The libxt requires x11 in DISTRO_FEATURES REQUIRED_DISTRO_FEATURES = "x11" -SRC_URI = "git://git.tartarus.org/simon/puzzles.git;branch=master \ +SRC_URI = "git://git.tartarus.org/simon/puzzles.git;branch=main \ file://fix-compiling-failure-with-option-g-O.patch \ file://0001-palisade-Fix-warnings-with-clang-on-arm.patch \ file://0001-Use-Wno-error-format-overflow-if-the-compiler-suppor.patch \ From patchwork Fri Feb 25 14:25:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4259 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A5A4C433F5 for ; Fri, 25 Feb 2022 14:27:01 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web12.6886.1645799220509658319 for ; Fri, 25 Feb 2022 06:27:00 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=suQo8Z7v; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id x11so4933498pll.10 for ; Fri, 25 Feb 2022 06:27:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=qruG9ss2cxOI4qldARAhgzV+TB6/KvtboP0WkX1HbFo=; b=suQo8Z7v/AHt1KnMEv2d1RoswzYrFgX7tr08nAKORaIbATFt9nBkWUU/wOhEm4XSsi 4OLv/UO11zyYf0dFkf48AzpAFAMgua1Tb4v+bwr0j4iU4xZwLB+GMDnaKbfsQyYO7IJ3 6qRivr1/W32UW0/czr90RTe0cKOOldF5ZhPRF3d6++k/KT88s/FRI/oOXNVYXqhdxoCQ VVbImMmGpzNvZekhUWI9d1HkTmdXtlx/EX+xTwubADIWV9xGxt65SvMMxCZI0pt4nhxR kEnvgUqNV8fL0iL7+q/ofKB8VM3z+3rn1+fHiszsd0GCGvtGQsMrdm3ScKS4qs6ZLhCS CaUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qruG9ss2cxOI4qldARAhgzV+TB6/KvtboP0WkX1HbFo=; b=8Bc1ILrY5rK6xLU+y1a1XcYyKwxz3OnUIoRelLP+oLOZ5xSIxIRZTObiG1hXBgLzTK ecwWUL5KHQFpG5YKSYwY3tY1cQ/dMUjnFYmXsMSoTs9QzLs5lXJwATzxOxC9JibLkCz9 OTMt2zxvIDLEX/UM3Sm+FUfa8JOlXs15wu4FqyJPXPARAkcM56jqP0A9Gw1ZrlQqEI6e YNfDBUSScYq/CaaB2+YDJaNDiP0b6HDuaIaGZ8sI/KIm1mn1913KMy8439u2sqv2yMze NUBhqIYkHod/Jj60+vW5HUfnjKY1thilq5zcfjOT8GrIK+XcPQeGg34eY2YxpIBAWXWK QfWA== X-Gm-Message-State: AOAM533Y4OJ+ai8a+KYBmtmb2gKkEgLIfdcDHoN43osIo+kgt/0FoUMp ysQHwnZJwu4t3v+FSl7dOYfYgXXiI9+L0Dyg X-Google-Smtp-Source: ABdhPJzokf+j39CuMqUgxbofUXvNlw7jPY7aqOGD3RInGDXAdb0b5XGUD/mUbX9w1sjunewnzjgfBg== X-Received: by 2002:a17:90a:3046:b0:1bc:2b36:87bc with SMTP id q6-20020a17090a304600b001bc2b3687bcmr3327372pjl.191.1645799219558; Fri, 25 Feb 2022 06:26:59 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.26.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:26:58 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 05/50] grub: fix a memory leak Date: Fri, 25 Feb 2022 04:25:45 -1000 Message-Id: <330ef99ae58e025b78bf30b9a9d09b32dfa2f605.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162351 From: Marta Rybczynska Backport a fix for a memory leak in grub_mmap_iterate(). This patch is a part of a security series [1] [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...leak-when-iterating-over-mapped-memo.patch | 39 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 3 +- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/grub/files/0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch diff --git a/meta/recipes-bsp/grub/files/0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch b/meta/recipes-bsp/grub/files/0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch new file mode 100644 index 0000000000..eaaa7effae --- /dev/null +++ b/meta/recipes-bsp/grub/files/0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch @@ -0,0 +1,39 @@ +From 0900f11def2e7fbb4880efff0cd9c9b32f1cdb86 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 3 Dec 2020 14:39:45 +0000 +Subject: [PATCH] mmap: Fix memory leak when iterating over mapped memory + +When returning from grub_mmap_iterate() the memory allocated to present +is not being released causing it to leak. + +Fixes: CID 96655 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=8cb2848f9699642a698af84b12ba187cab722031] +Signed-off-by: Marta Rybczynska +--- + grub-core/mmap/mmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c +index 7ebf32e..8bf235f 100644 +--- a/grub-core/mmap/mmap.c ++++ b/grub-core/mmap/mmap.c +@@ -270,6 +270,7 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data) + hook_data)) + { + grub_free (ctx.scanline_events); ++ grub_free (present); + return GRUB_ERR_NONE; + } + +@@ -282,6 +283,7 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data) + } + + grub_free (ctx.scanline_events); ++ grub_free (present); + return GRUB_ERR_NONE; + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 9b20e1c09b..a06beac5ef 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -47,7 +47,8 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://CVE-2020-27779_7.patch \ file://CVE-2020-25632.patch \ file://CVE-2020-25647.patch \ -" + file://0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch \ + " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4260 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72399C433EF for ; Fri, 25 Feb 2022 14:27:03 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.web08.6780.1645799222876880579 for ; Fri, 25 Feb 2022 06:27:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=wjmDmRxR; spf=softfail (domain: sakoman.com, ip: 209.85.216.49, mailfrom: steve@sakoman.com) Received: by mail-pj1-f49.google.com with SMTP id d15so1559999pjg.1 for ; Fri, 25 Feb 2022 06:27:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=WnM3pQfF4FD7T5NEnL3mhxZdJiT9sOdNfr9Pz3aT/ec=; b=wjmDmRxRPQQw909g+fpuxWH3AG/2hYBSsU42XT1QIq3iqzVaaUQYELrUPNBvmOJKTE EDRFzZQ5Xuahi+khwbxrkrBqEZQD12qxDQdbhwp31iJkhsM3em1mlTPNw2YsfM5aeptK ezlXoIn7NihQrJEBFpksLL7J9Tm9IyVgVBZsExSgbexJRZKox5mFYhEPxTdCS728Y8MX wxb9Asy1s+nCLLi6hS2h9adCivxMXdxe4qt/DbYFCXbjqA8rc2VAMpsUNbRRLaGQedfA APKt5Mv8NpzPCXG61gU4r3YkiY+JM7mRyJlr4HL6Ozyzm1kcqPqjW93zCZ1q+giJNw3w nhDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=WnM3pQfF4FD7T5NEnL3mhxZdJiT9sOdNfr9Pz3aT/ec=; b=lThVUa1iWEvsXF8ERH5PWgLt81A+okNV/D0KezG/tv8LlIpcpFq+0z98w+NNfyEw8j dw42ieLvbvC7MQbyk3gE1mGikNQcff+Aaaa7Lr9GJUEtTqH9AX68XPodycANId4axvuX 6iicADDMGOvjolTaLxtRECXUzepwdElGRTRkZxIBPhr+/nVU3LpduvZy51mrbwqypCYl e3mUlrWzyWM2jAjEz5VSyE3AhAAhtWUs3MV4XnCmrMhHzKGdZmuX2jiB+h7FH9gB19q/ R4y9+rgIVcWh4Ckluag+M82OmAtX9rRdJVlYkdvUKd29jqAHGPUAM/qr3ejTU+fQVO8u JZ6w== X-Gm-Message-State: AOAM533TEEze6PUROq65VXPYgR0DVqDxP9iI2Ks2udsXrWzgYfxyw8KI nRYcOgeReqhbYrwAOhLbBqinZGSbOaIH0+n3 X-Google-Smtp-Source: ABdhPJwozGY0K6/kuoceeQfMJL3cqlzvuO4rdaaWueFNxvjYhGwXmamDx8AVdHbBn20YhfGmYEIZ2w== X-Received: by 2002:a17:90a:241:b0:1bc:1def:a8c5 with SMTP id t1-20020a17090a024100b001bc1defa8c5mr3381801pje.105.1645799221927; Fri, 25 Feb 2022 06:27:01 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:01 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 06/50] grub: add a fix for a possible NULL dereference Date: Fri, 25 Feb 2022 04:25:46 -1000 Message-Id: <5e62b476b541d3803e537f2228a264224b72cf81.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162352 From: Marta Rybczynska This fix removes a possible NULL pointer dereference in grub networking code. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ible-dereference-to-of-a-NULL-pointe.patch | 39 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch diff --git a/meta/recipes-bsp/grub/files/0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch b/meta/recipes-bsp/grub/files/0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch new file mode 100644 index 0000000000..d00821f5c3 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch @@ -0,0 +1,39 @@ +From f216a75e884ed5e4e94bf86965000dde51148f94 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 27 Nov 2020 15:10:26 +0000 +Subject: [PATCH] net/net: Fix possible dereference to of a NULL pointer + +It is always possible that grub_zalloc() could fail, so we should check for +a NULL return. Otherwise we run the risk of dereferencing a NULL pointer. + +Fixes: CID 296221 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=03f2515ae0c503406f1a99a2178405049c6555db] +Signed-off-by: Marta Rybczynska +--- + grub-core/net/net.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 38f19df..7c2cdf2 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -86,8 +86,13 @@ grub_net_link_layer_add_address (struct grub_net_card *card, + + /* Add sender to cache table. */ + if (card->link_layer_table == NULL) +- card->link_layer_table = grub_zalloc (LINK_LAYER_CACHE_SIZE +- * sizeof (card->link_layer_table[0])); ++ { ++ card->link_layer_table = grub_zalloc (LINK_LAYER_CACHE_SIZE ++ * sizeof (card->link_layer_table[0])); ++ if (card->link_layer_table == NULL) ++ return; ++ } ++ + entry = &(card->link_layer_table[card->new_ll_entry]); + entry->avail = 1; + grub_memcpy (&entry->ll_address, ll, sizeof (entry->ll_address)); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index a06beac5ef..2c0bff8fd0 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -48,6 +48,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://CVE-2020-25632.patch \ file://CVE-2020-25647.patch \ file://0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch \ + file://0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4261 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 738E7C433EF for ; Fri, 25 Feb 2022 14:27:05 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web11.6911.1645799225040828622 for ; Fri, 25 Feb 2022 06:27:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=tg1rRj6w; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id e13so4960654plh.3 for ; Fri, 25 Feb 2022 06:27:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=41FsmRH49fMUtepX4+4hyhYspY0Fk0dmP/kuBSTAbhU=; b=tg1rRj6w/w94kHk6DBJ5bY/6MCLSI2Zelats8vui7yAcv3F2XMMvxww4RXrddQBDch 3xW/uRRBjAaT1geiSYNFUtEcJESoH6VPTCDnfPF/bGD8vQQsWWurk8HG0ZINIb9kVoEW Er6fumvQSxF1Vvb0i+VqitV1lhNO2I6SF38fYQGQ74k8tJ6z3QjYifHTtEhfUnsSNisn 1GBE2qqJew/Y+UNC7q1y7iiTEVDSny8EdUI6p8ODKl4CysPqGxgRds21YSigwj3dJ2IH b34I7wJyEXg1XcJ0dKBLkldf5cZ2l2iFUta5BQtyiSdk73uPD5oB8Y6hTkn9MtHhxO8A z/7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=41FsmRH49fMUtepX4+4hyhYspY0Fk0dmP/kuBSTAbhU=; b=FNDCVzhVMKyShLmpwxTvuxZKybTe13dZiE1/J33Ha52jTsfU/8I3+iN67CV2I7LRu1 PcsdUG2WcwFwSC6g3ycwf548j6HkM3CIdmzpuuPo3peyEAjxD2YOXCcLnn7+wXq8thKm 41cQ/ACoU6BJkxNHF880SGYdOG2HhLtX9HLrz6RJ3g6qJ6FM1F7xcOXouFEMaiadZc/B kM/aCuTlTTinT2ZO3oyQhB1f7IcMZjYkHcU0QkNmFfUElIQvcgUI501NwJkjxIx9zEe6 khR//7ouGaE3LE2BKZsFBmc2JRZgDsG93jU55toIKm0eTjFrbS8o4fY70vj1Ymezqm94 KqKQ== X-Gm-Message-State: AOAM5336vCU8BVot+SIql91VtVuykffNiIKjt39o8aSEhNsGmS6BsS7k uKnW9oVOQTYPddCFfTmG5Dj3mGEhyg95IIsm X-Google-Smtp-Source: ABdhPJxFXbjuf/dqDxnhRP6NTQZsAxhY4MBBeo8thhf+ks0vFKfdBaFVljlnM65lLuUEEFIXRVWo/w== X-Received: by 2002:a17:902:d2c6:b0:150:128:b276 with SMTP id n6-20020a170902d2c600b001500128b276mr7977756plc.5.1645799224075; Fri, 25 Feb 2022 06:27:04 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:03 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 07/50] grub: fix a dangling memory pointer Date: Fri, 25 Feb 2022 04:25:47 -1000 Message-Id: <17a06ced4ed9305e0a4064bdaad49e653c18284b.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162353 From: Marta Rybczynska This change fixes a dangling memory pointer in the grub TFTP code. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...net-tftp-Fix-dangling-memory-pointer.patch | 33 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0003-net-tftp-Fix-dangling-memory-pointer.patch diff --git a/meta/recipes-bsp/grub/files/0003-net-tftp-Fix-dangling-memory-pointer.patch b/meta/recipes-bsp/grub/files/0003-net-tftp-Fix-dangling-memory-pointer.patch new file mode 100644 index 0000000000..3b4633507d --- /dev/null +++ b/meta/recipes-bsp/grub/files/0003-net-tftp-Fix-dangling-memory-pointer.patch @@ -0,0 +1,33 @@ +From 09cc0df477758b60f51fbc0da1dee2f5d54c333d Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 19 Feb 2021 17:12:23 +0000 +Subject: [PATCH] net/tftp: Fix dangling memory pointer + +The static code analysis tool, Parfait, reported that the valid of +file->data was left referencing memory that was freed by the call to +grub_free(data) where data was initialized from file->data. + +To ensure that there is no unintentional access to this memory +referenced by file->data we should set the pointer to NULL. + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0cb838b281a68b536a09681f9557ea6a7ac5da7a] +Signed-off-by: Marta Rybczynska +--- + grub-core/net/tftp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index 7d90bf6..f76b19f 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -468,6 +468,7 @@ tftp_close (struct grub_file *file) + } + destroy_pq (data); + grub_free (data); ++ file->data = NULL; + return GRUB_ERR_NONE; + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 2c0bff8fd0..678aa5c4e2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -49,6 +49,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://CVE-2020-25647.patch \ file://0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch \ file://0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch \ + file://0003-net-tftp-Fix-dangling-memory-pointer.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4262 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73B5EC433EF for ; Fri, 25 Feb 2022 14:27:07 +0000 (UTC) Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by mx.groups.io with SMTP id smtpd.web11.6912.1645799227149155477 for ; Fri, 25 Feb 2022 06:27:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=6QB34BZ2; spf=softfail (domain: sakoman.com, ip: 209.85.210.175, mailfrom: steve@sakoman.com) Received: by mail-pf1-f175.google.com with SMTP id p8so4812722pfh.8 for ; Fri, 25 Feb 2022 06:27:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=nU98zbeHUSB3tqVcJXipYK+p3cNHClKhOWw1WFHlvLM=; b=6QB34BZ2L7NF1RzMD2gq4XQwr17SZhEf0rUDsHRSpQgqMC8KREVX6stJMlZwLcqISo /tI0PCoi2JiSnLSMs/MrgxSURDZTXzJu+kp27N2drxrTWcsjYmFi/HbU6x+eaWXGNMud yZ86sz7+DPeOZnjD1s7J0F5yUUAdxpDZHp0NpB6YKQbInRIy4k+lg5ViQTzuI/jOVVWf BKJnheCdqsR1JX4OQUREECHlm7o510CegcpHBasPZs8gAcSc0m0Psf4GwgmJ8Y7C/8Tw oFDS/dETH1PoRwAHmJNmVK5lelH5DBzMO6JTJyKOWYM6cVAkWtPM7kvIRZHiY97Eg/tQ 4B3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=nU98zbeHUSB3tqVcJXipYK+p3cNHClKhOWw1WFHlvLM=; b=Imw5/RxXnLWGid4RwTCSkCNn9pXBZ3UE408CKntNn2jUeRcjdZIlWGna1t4gjY2ZYk AhrJ5Bs1sLx3WJS+cJZTLNU1ehh+tkSSwPx+gVNUrSgn0RTpXJNKpcmqn+oINf+4m/W1 hE1IhXTHGGNHq0x91kfQCw918XMKSaF6syn6rNclZ0lZmHTQXI1gJecH/CFGnIynG5gK SYkEjapmqljoZwgIaxWp1/XvZPvQfW0k32t6TthCQNAp+Psa8N+T15lkao/TFfLZSQha I5EQX8yyyqeVEQSsggd93V9oRpRMOYQkfSKPLs3hrVMs9fPRU6MkOHXLaXWgLdOw9aRm K4lA== X-Gm-Message-State: AOAM532vi171TvetZjyDcJ44L//Bu5T6Ful69E+EaDNVv5qshMKySWSk Hx6RK5/NdEV3j3595iQtcbLs/rbsy5F04ACt X-Google-Smtp-Source: ABdhPJxLlQMNcY+yZKebAw86I2EoTbmAjo1RuaRFoSYid/ULKAu6qLwpcQhpnf+rOw7yxikhSDOBVw== X-Received: by 2002:a05:6a00:1146:b0:4c9:ede0:725a with SMTP id b6-20020a056a00114600b004c9ede0725amr8100958pfm.35.1645799226157; Fri, 25 Feb 2022 06:27:06 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:05 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 08/50] grub: fix wrong handling of argc == 0 Date: Fri, 25 Feb 2022 04:25:48 -1000 Message-Id: <8e537ef16bc1ef4bc807cc165d3b7eb1301578de.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162354 From: Marta Rybczynska This change fixes wrong handling of argc == 0 causing a memory leak. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...n-parser-Fix-resource-leak-if-argc-0.patch | 50 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0004-kern-parser-Fix-resource-leak-if-argc-0.patch diff --git a/meta/recipes-bsp/grub/files/0004-kern-parser-Fix-resource-leak-if-argc-0.patch b/meta/recipes-bsp/grub/files/0004-kern-parser-Fix-resource-leak-if-argc-0.patch new file mode 100644 index 0000000000..933416605c --- /dev/null +++ b/meta/recipes-bsp/grub/files/0004-kern-parser-Fix-resource-leak-if-argc-0.patch @@ -0,0 +1,50 @@ +From 8861fa6226f7229105722ba669465e879b56ee2b Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 22 Jan 2021 12:32:41 +0000 +Subject: [PATCH] kern/parser: Fix resource leak if argc == 0 + +After processing the command-line yet arriving at the point where we are +setting argv, we are allocating memory, even if argc == 0, which makes +no sense since we never put anything into the allocated argv. + +The solution is to simply return that we've successfully processed the +arguments but that argc == 0, and also ensure that argv is NULL when +we're not allocating anything in it. + +There are only 2 callers of this function, and both are handling a zero +value in argc assuming nothing is allocated in argv. + +Fixes: CID 96680 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d06161b035dde4769199ad65aa0a587a5920012b] +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/parser.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c +index 619db31..d1cf061 100644 +--- a/grub-core/kern/parser.c ++++ b/grub-core/kern/parser.c +@@ -146,6 +146,7 @@ grub_parser_split_cmdline (const char *cmdline, + int i; + + *argc = 0; ++ *argv = NULL; + do + { + if (!rd || !*rd) +@@ -207,6 +208,10 @@ grub_parser_split_cmdline (const char *cmdline, + (*argc)++; + } + ++ /* If there are no args, then we're done. */ ++ if (!*argc) ++ return 0; ++ + /* Reserve memory for the return values. */ + args = grub_malloc (bp - buffer); + if (!args) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 678aa5c4e2..2e4e6d7ac2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -50,6 +50,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0001-mmap-Fix-memory-leak-when-iterating-over-mapped-memo.patch \ file://0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch \ file://0003-net-tftp-Fix-dangling-memory-pointer.patch \ + file://0004-kern-parser-Fix-resource-leak-if-argc-0.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4263 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74EB8C433EF for ; Fri, 25 Feb 2022 14:27:10 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web08.6783.1645799229727490202 for ; Fri, 25 Feb 2022 06:27:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=3xtmUtFd; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id l9so4516963pls.6 for ; Fri, 25 Feb 2022 06:27:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=VPHKzmXSeTDsv+/Ho/dE8OPqTLNtKU0KPuuRUVddmAM=; b=3xtmUtFd0YBDQtuh01xkL/bVMsyazQDMKj/ex6L9z0ILLf8pvriz9K7Qh367x6/pRs q5q1X82y5fxaKewa0ftd67pjYHkSy09EBlmeGa4idIOiY1fcpQSlxuv80iamqU1oIR9j x98UyAn0NlD2DhQLOB252u+YtopS/znMRXsA5y2WxbP900HXXWcy4g2fcpMlyD2UNlQr 0cpb+wsjXVfgmxDzirV5Pi0PECEapD3IrpzVQjIQhV1R5wmHUHAkWWKXvMmPw/HcyagI xW+IeWqj2KtHnKe9/8dFzpy28xWLjq+pLHlT5gafbr565DMoTk07/ILGc9WwirdA1hzN sHtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=VPHKzmXSeTDsv+/Ho/dE8OPqTLNtKU0KPuuRUVddmAM=; b=V3/UwA8F1TDp1utkcMtMJBi0r7EkINQn+wALKjgJtbtmH1Y/7kNorrevewvx05nUwj aaeVrirHFfwZlNMOETSy0lpL57yVduLLKIB8Bx24VRiKflNSa97V8PmWT/qIivLFv7o8 7N/1BAYe54qYWK+4IBQvQxpqExAaqK8zGcQYDkw0QUF8ojWfFxXUFhqON4rctDr1pvm/ knyLlTTcA9EslHEzUr07WHiaHWS7iqJh1g5Y6pM1zRxuBWUWOcxQrNfaPT8kXZ2BFnn7 fRPMh5ZIE/JkA/RKaFz1FRdgANgtnh92dLxEjA0HAzsS4Dxo+dbFEy86VeFiGdbj3xMl 0BhQ== X-Gm-Message-State: AOAM532ftKusffsrl41Pf7qkbyj2CRlVN5TgBqF/seuh57G/cU6mTZLA dhxncvFMwhfIxUBBfNLyf1HaHWSnE3bDawEb X-Google-Smtp-Source: ABdhPJxrQzL7Vuqm751z48hSMCqdj6suk2Lgtn4b1RLQBwQtRglqAcSoSlQKMJfUCGx/KnPm68PRbQ== X-Received: by 2002:a17:90a:bb8b:b0:1bc:f3c9:df26 with SMTP id v11-20020a17090abb8b00b001bcf3c9df26mr2571808pjr.128.1645799228550; Fri, 25 Feb 2022 06:27:08 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:07 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 09/50] grub: add a fix for malformed device path handling Date: Fri, 25 Feb 2022 04:25:49 -1000 Message-Id: <7f08d97fb6a0ff9c779f788df150b54de8af2708.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162355 From: Marta Rybczynska This change fixes the malformed device paths in EFI handling. Device paths of length 4 or shorter could cause different kinds of unexpected behaviours. This patch is NOT a part of [1], but is a dependency of one of the patches included in the series. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...formed-device-path-arithmetic-errors.patch | 235 ++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 236 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch diff --git a/meta/recipes-bsp/grub/files/0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch b/meta/recipes-bsp/grub/files/0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch new file mode 100644 index 0000000000..04748befc8 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch @@ -0,0 +1,235 @@ +From 16a4d739b19f8680cf93a3c8fa0ae9fc1b1c310b Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 16:53:27 -0400 +Subject: [PATCH] efi: Fix some malformed device path arithmetic errors + +Several places we take the length of a device path and subtract 4 from +it, without ever checking that it's >= 4. There are also cases where +this kind of malformation will result in unpredictable iteration, +including treating the length from one dp node as the type in the next +node. These are all errors, no matter where the data comes from. + +This patch adds a checking macro, GRUB_EFI_DEVICE_PATH_VALID(), which +can be used in several places, and makes GRUB_EFI_NEXT_DEVICE_PATH() +return NULL and GRUB_EFI_END_ENTIRE_DEVICE_PATH() evaluate as true when +the length is too small. Additionally, it makes several places in the +code check for and return errors in these cases. + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d2cf823d0e31818d1b7a223daff6d5e006596543] +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/efi/efi.c | 64 +++++++++++++++++++++++++----- + grub-core/loader/efi/chainloader.c | 13 +++++- + grub-core/loader/i386/xnu.c | 9 +++-- + include/grub/efi/api.h | 14 ++++--- + 4 files changed, 79 insertions(+), 21 deletions(-) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index ad170c7..6a38080 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -360,7 +360,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + + dp = dp0; + +- while (1) ++ while (dp) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -370,9 +370,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE + && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE) + { +- grub_efi_uint16_t len; +- len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4) +- / sizeof (grub_efi_char16_t)); ++ grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ len = (len - 4) / sizeof (grub_efi_char16_t); + filesize += GRUB_MAX_UTF8_PER_UTF16 * len + 2; + } + +@@ -388,7 +394,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + if (!name) + return NULL; + +- while (1) ++ while (dp) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -404,8 +410,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + + *p++ = '/'; + +- len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4) +- / sizeof (grub_efi_char16_t)); ++ len = GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ len = (len - 4) / sizeof (grub_efi_char16_t); + fp = (grub_efi_file_path_device_path_t *) dp; + /* According to EFI spec Path Name is NULL terminated */ + while (len > 0 && fp->path_name[len - 1] == 0) +@@ -480,7 +493,26 @@ grub_efi_duplicate_device_path (const grub_efi_device_path_t *dp) + ; + p = GRUB_EFI_NEXT_DEVICE_PATH (p)) + { +- total_size += GRUB_EFI_DEVICE_PATH_LENGTH (p); ++ grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (p); ++ ++ /* ++ * In the event that we find a node that's completely garbage, for ++ * example if we get to 0x7f 0x01 0x02 0x00 ... (EndInstance with a size ++ * of 2), GRUB_EFI_END_ENTIRE_DEVICE_PATH() will be true and ++ * GRUB_EFI_NEXT_DEVICE_PATH() will return NULL, so we won't continue, ++ * and neither should our consumers, but there won't be any error raised ++ * even though the device path is junk. ++ * ++ * This keeps us from passing junk down back to our caller. ++ */ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ total_size += len; + if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (p)) + break; + } +@@ -525,7 +557,7 @@ dump_vendor_path (const char *type, grub_efi_vendor_device_path_t *vendor) + void + grub_efi_print_device_path (grub_efi_device_path_t *dp) + { +- while (1) ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp)) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -937,7 +969,10 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1, + /* Return non-zero. */ + return 1; + +- while (1) ++ if (dp1 == dp2) ++ return 0; ++ ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp1) && GRUB_EFI_DEVICE_PATH_VALID (dp2)) + { + grub_efi_uint8_t type1, type2; + grub_efi_uint8_t subtype1, subtype2; +@@ -973,5 +1008,14 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1, + dp2 = (grub_efi_device_path_t *) ((char *) dp2 + len2); + } + ++ /* ++ * There's no "right" answer here, but we probably don't want to call a valid ++ * dp and an invalid dp equal, so pick one way or the other. ++ */ ++ if (GRUB_EFI_DEVICE_PATH_VALID (dp1) && !GRUB_EFI_DEVICE_PATH_VALID (dp2)) ++ return 1; ++ else if (!GRUB_EFI_DEVICE_PATH_VALID (dp1) && GRUB_EFI_DEVICE_PATH_VALID (dp2)) ++ return -1; ++ + return 0; + } +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index daf8c6b..a8d7b91 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -156,9 +156,18 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + + size = 0; + d = dp; +- while (1) ++ while (d) + { +- size += GRUB_EFI_DEVICE_PATH_LENGTH (d); ++ grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (d); ++ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ size += len; + if ((GRUB_EFI_END_ENTIRE_DEVICE_PATH (d))) + break; + d = GRUB_EFI_NEXT_DEVICE_PATH (d); +diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c +index b7d176b..c50cb54 100644 +--- a/grub-core/loader/i386/xnu.c ++++ b/grub-core/loader/i386/xnu.c +@@ -516,14 +516,15 @@ grub_cmd_devprop_load (grub_command_t cmd __attribute__ ((unused)), + + devhead = buf; + buf = devhead + 1; +- dpstart = buf; ++ dp = dpstart = buf; + +- do ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp) && buf < bufend) + { +- dp = buf; + buf = (char *) buf + GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp)) ++ break; ++ dp = buf; + } +- while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp) && buf < bufend); + + dev = grub_xnu_devprop_add_device (dpstart, (char *) buf + - (char *) dpstart); +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index addcbfa..cf1355a 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -625,6 +625,7 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t; + #define GRUB_EFI_DEVICE_PATH_TYPE(dp) ((dp)->type & 0x7f) + #define GRUB_EFI_DEVICE_PATH_SUBTYPE(dp) ((dp)->subtype) + #define GRUB_EFI_DEVICE_PATH_LENGTH(dp) ((dp)->length) ++#define GRUB_EFI_DEVICE_PATH_VALID(dp) ((dp) != NULL && GRUB_EFI_DEVICE_PATH_LENGTH (dp) >= 4) + + /* The End of Device Path nodes. */ + #define GRUB_EFI_END_DEVICE_PATH_TYPE (0xff & 0x7f) +@@ -633,13 +634,16 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t; + #define GRUB_EFI_END_THIS_DEVICE_PATH_SUBTYPE 0x01 + + #define GRUB_EFI_END_ENTIRE_DEVICE_PATH(dp) \ +- (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \ +- && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \ +- == GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE)) ++ (!GRUB_EFI_DEVICE_PATH_VALID (dp) || \ ++ (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \ ++ && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \ ++ == GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE))) + + #define GRUB_EFI_NEXT_DEVICE_PATH(dp) \ +- ((grub_efi_device_path_t *) ((char *) (dp) \ +- + GRUB_EFI_DEVICE_PATH_LENGTH (dp))) ++ (GRUB_EFI_DEVICE_PATH_VALID (dp) \ ++ ? ((grub_efi_device_path_t *) \ ++ ((char *) (dp) + GRUB_EFI_DEVICE_PATH_LENGTH (dp))) \ ++ : NULL) + + /* Hardware Device Path. */ + #define GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE 1 diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 2e4e6d7ac2..f7f2aa892f 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -51,6 +51,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0002-net-net-Fix-possible-dereference-to-of-a-NULL-pointe.patch \ file://0003-net-tftp-Fix-dangling-memory-pointer.patch \ file://0004-kern-parser-Fix-resource-leak-if-argc-0.patch \ + file://0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4264 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8ADD0C433FE for ; Fri, 25 Feb 2022 14:27:12 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.web09.6925.1645799231909151257 for ; Fri, 25 Feb 2022 06:27:12 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=szbo+D9y; spf=softfail (domain: sakoman.com, ip: 209.85.216.48, mailfrom: steve@sakoman.com) Received: by mail-pj1-f48.google.com with SMTP id g7-20020a17090a708700b001bb78857ccdso8587331pjk.1 for ; Fri, 25 Feb 2022 06:27:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=GN9wqylD1az1CyDatjUZLDGS7AxIOgQBN01aRcrbLzA=; b=szbo+D9yfkxA/xIU2f7/XJib8FcaooObrdqIBOrR7wzMscR33NTdoBBdKivM8To85I O8tqgUy+aZwFScncetKlISxUjdaYCRqndmgyGgA6e395DYEGuXwoKQJM94/rTadjCXGZ c6WRa56Npuby6McuP+VfOKpjFUR/Ze3DEwKJUnfjfprs8YtJhSbsJCE7gHUGFvQ0BoRD EmJxblylbwdJ2g/LPaH3su6Ng1dQ+xKkcM5P8O3sqUnEWRMQf+ja1ZsukPU24+Q0RYpg jePIrXHqap5l7nMpjTE4d7cZk/4wyOGiZq/+TlqmpQWEw1F2fuYYuTQDHZ8jHtsydM6J X3og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=GN9wqylD1az1CyDatjUZLDGS7AxIOgQBN01aRcrbLzA=; b=HsfYkd9rIIGE2wdi533RneOp2OWcvNBZzpy15ptbXGGcGSWSYfHCA1UNafZebyDLDr Ac6gpmXKUGX8PkAi+yZPNuVPoccGYNvCF1zbwHGh8b5jBXUlwfs/8rGYArHQn668y2DU Pcv2qcty8CWAvldJpR9rDyhuKJ2FKzwp0+Mqj9tE9WTsXpNHNyJjB4Xb5MNQvdLljL/o kOymNGMBzHRv7+hOw90p0RuXy0xrXhznXc2GXsQeaPU/24wKiFaSLI4Rfct4mBHyvQtH HyTO3Rv4fbxVkCHgrB5Mr/1qjFvA1UqgLfbMmEMkTSWCdKs7gpB3RzoPGZbvBbQTbNgI ikig== X-Gm-Message-State: AOAM531MxAWj8jYUlWW0hjnNcEm3rhetVBDXRPkSKZnhHze/kRsFhHd2 D38iHqnbaAIj5KqSZ8nvfirvfJOeUMTxkWaX X-Google-Smtp-Source: ABdhPJwTvKC8iLbr76E+Km7czR88dA50eZxzPE2AXqika+ketynqUMq13tj1IDYtgD0s1XLq/BH2og== X-Received: by 2002:a17:903:291:b0:14d:522c:fe3d with SMTP id j17-20020a170903029100b0014d522cfe3dmr7718933plr.100.1645799230939; Fri, 25 Feb 2022 06:27:10 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:10 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 10/50] grub: fix memory leak at error in grub_efi_get_filename() Date: Fri, 25 Feb 2022 04:25:50 -1000 Message-Id: <1b192247fa913c29f5cdf22abe4e71a509b3861e.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162356 From: Marta Rybczynska This change fixes a memory leak on error in grub_efi_get_filename(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...-kern-efi-Fix-memory-leak-on-failure.patch | 30 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0006-kern-efi-Fix-memory-leak-on-failure.patch diff --git a/meta/recipes-bsp/grub/files/0006-kern-efi-Fix-memory-leak-on-failure.patch b/meta/recipes-bsp/grub/files/0006-kern-efi-Fix-memory-leak-on-failure.patch new file mode 100644 index 0000000000..9d7327cee6 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0006-kern-efi-Fix-memory-leak-on-failure.patch @@ -0,0 +1,30 @@ +From d4fd0243920b71cc6e03cc0cadf23b4fe03c352f Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 5 Nov 2020 10:15:25 +0000 +Subject: [PATCH] kern/efi: Fix memory leak on failure + +Free the memory allocated to name before returning on failure. + +Fixes: CID 296222 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ed286ceba6015d37a9304f04602451c47bf195d7] +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/efi/efi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 6a38080..baeeef0 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -415,6 +415,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + { + grub_error (GRUB_ERR_OUT_OF_RANGE, + "malformed EFI Device Path node has length=%d", len); ++ grub_free (name); + return NULL; + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index f7f2aa892f..04ed8b7b23 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -52,6 +52,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0003-net-tftp-Fix-dangling-memory-pointer.patch \ file://0004-kern-parser-Fix-resource-leak-if-argc-0.patch \ file://0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch \ + file://0006-kern-efi-Fix-memory-leak-on-failure.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4265 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75783C433EF for ; Fri, 25 Feb 2022 14:27:14 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.web09.6927.1645799234045712812 for ; Fri, 25 Feb 2022 06:27:14 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=b3U15PLY; spf=softfail (domain: sakoman.com, ip: 209.85.216.54, mailfrom: steve@sakoman.com) Received: by mail-pj1-f54.google.com with SMTP id ev16-20020a17090aead000b001bc3835fea8so4985141pjb.0 for ; Fri, 25 Feb 2022 06:27:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=0aGud+Az9S6DmdzzrcVTYI3LQYlzdBksdwSJdqP096c=; b=b3U15PLYzix7v43yF0LKe2EQb63KD/lB8qbHLe3jsjEzhQaf5/tSe/vGrRiv11pJNy GysNSWmXQCq6JCdssxD4AgX7oh05K5cM2Hcrg6RnSkZHKp3dtnvwwgsu1S2hT2MuGim7 rk1ceiIeLbn2wUzjTXFYgBJN3ZRBiD09IrZ5AETlITT0btI9f5EStgp8Xjf+iTLPoHsp r6l+FnVe/srQvQk3irpcDXcG8poVTgsnITJL3oHh07CkQP/l0webhMe06EbJCJvVsmKW 9JDxQzDt7x2QGX5XYo0i90MSpEC3CyQVcZfEcZZmamXKnqf5YkCvGtXVRmVw3CwPC/Wz F/RA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0aGud+Az9S6DmdzzrcVTYI3LQYlzdBksdwSJdqP096c=; b=QwC68/jl6vyaUerjTpH7SM0ZJV4ONS3W6P0j9nY09w8QQbUG3KJU2tm1uAZzk2tTe0 4CXeTpM6hsfiHE1k6pzWCrotNfObpT6yY8G3RgTIcNzWYZWqbwFZtBOKjBRS8H8hxEzN wVfIlsS3iLc5MkkhsJx0IqAg4+GaI42tUkYsMOG58E33vmM1kzgOkHTBfFnKySMzv/JP fRGyPOIIErQY3lJLbAf90uXjWS5YrJKectS3DSvJ4XSCeSrL9CjEUQlfn3Mhy/3/uw/9 VOAhaiKNkkjIFrXI2jE1by0TF3gFVVFRU9/G1Ggqa4dJjfq4JrpwZTDwv4jYyLU8Dtxf ULJA== X-Gm-Message-State: AOAM5318ikG+Q3AAuKavySwLQ+9RGchlYVswg5xRXrBufv2dLzlFloiR 9MvNrq7KmIuk9cpN/a7eBhs0M6VXWCFfYBHF X-Google-Smtp-Source: ABdhPJztDxhm3TWgk3bldCLRKYHs/fjE2Kw9e5hiuTLxUyelG988+6n5Nk9fiw/7tdV42hsvBlqUTA== X-Received: by 2002:a17:902:9a47:b0:150:27e0:abc5 with SMTP id x7-20020a1709029a4700b0015027e0abc5mr3664671plv.109.1645799233102; Fri, 25 Feb 2022 06:27:13 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:12 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 11/50] grub: add a fix for a possible NULL pointer dereference Date: Fri, 25 Feb 2022 04:25:51 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162357 From: Marta Rybczynska This change fixes a possible NULL pointer dereference in grub's EFI support. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ix-possible-NULL-pointer-dereference.patch | 65 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch diff --git a/meta/recipes-bsp/grub/files/0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch b/meta/recipes-bsp/grub/files/0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch new file mode 100644 index 0000000000..d55709406b --- /dev/null +++ b/meta/recipes-bsp/grub/files/0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch @@ -0,0 +1,65 @@ +From be03a18b8767be50f16a845c389fd5ed29aae055 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 11 Dec 2020 15:03:13 +0000 +Subject: [PATCH] kern/efi/mm: Fix possible NULL pointer dereference + +The model of grub_efi_get_memory_map() is that if memory_map is NULL, +then the purpose is to discover how much memory should be allocated to +it for the subsequent call. + +The problem here is that with grub_efi_is_finished set to 1, there is no +check at all that the function is being called with a non-NULL memory_map. + +While this MAY be true, we shouldn't assume it. + +The solution to this is to behave as expected, and if memory_map is NULL, +then don't try to use it and allow memory_map_size to be filled in, and +return 0 as is done later in the code if the buffer is too small (or NULL). + +Additionally, drop unneeded ret = 1. + +Fixes: CID 96632 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6aee4bfd6973c714056fb7b56890b8d524e94ee1] +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/efi/mm.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c +index b02fab1..5afcef7 100644 +--- a/grub-core/kern/efi/mm.c ++++ b/grub-core/kern/efi/mm.c +@@ -328,15 +328,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size, + if (grub_efi_is_finished) + { + int ret = 1; +- if (*memory_map_size < finish_mmap_size) ++ ++ if (memory_map != NULL) + { +- grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); +- ret = 0; ++ if (*memory_map_size < finish_mmap_size) ++ { ++ grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); ++ ret = 0; ++ } ++ else ++ grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); + } + else + { +- grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); +- ret = 1; ++ /* ++ * Incomplete, no buffer to copy into, same as ++ * GRUB_EFI_BUFFER_TOO_SMALL below. ++ */ ++ ret = 0; + } + *memory_map_size = finish_mmap_size; + if (map_key) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 04ed8b7b23..46d65d8609 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -53,6 +53,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0004-kern-parser-Fix-resource-leak-if-argc-0.patch \ file://0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch \ file://0006-kern-efi-Fix-memory-leak-on-failure.patch \ + file://0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4266 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 752C6C433F5 for ; Fri, 25 Feb 2022 14:27:17 +0000 (UTC) Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by mx.groups.io with SMTP id smtpd.web09.6931.1645799236453593493 for ; Fri, 25 Feb 2022 06:27:16 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=c8klFGl8; spf=softfail (domain: sakoman.com, ip: 209.85.215.181, mailfrom: steve@sakoman.com) Received: by mail-pg1-f181.google.com with SMTP id 75so4804081pgb.4 for ; Fri, 25 Feb 2022 06:27:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=O8SOwzEl4GtSKXmZFpRgURIBRHC3QLY1jSivlcrA9w0=; b=c8klFGl8MLY+o924MpiiMNh+blVsnmyrUJH1N/XucLu08/NMLMs58sdFh+jYAnJFMX lwphY6wVzxUA6CfPE3yIrNXWs6dWOnApXqiKE5fZqJfHru8XBGGdqkieosCXmEdie2mm t3ESW1BSH8rJvABeErWP8FtO1NZpWieWH7JcbeOxNcL5CqRz1APzmgMnaMCnNe84eYoQ VMIN9U4s6fH6Y2+1sDXFJdd7ueW8dGeBKQzM0dQeAVVzmGA1yr4mWT5ClLqdSLfa/Do5 1OdtilDOQas23M1jemleR/JTtjy5Q0M74ju3Ci4W9UC5K18jpCwdWO8Ri09xhBr1/jcK Xz2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=O8SOwzEl4GtSKXmZFpRgURIBRHC3QLY1jSivlcrA9w0=; b=J5L/8AAXdCe1GzxVjBnDkncFDT9SOzdYgOK/KMMqh7TvWOqLVyPkJildTdgonJoQmK TT89k0NYvLhM8OkbngNqz50RGQAP8U2Jhr3nva5FC8t52lrtxFeyFerdnUHCQ9lXY0cX U/sP+D+C1V3mg0teR3Z4CpEgjLKsKrcVbta3EZK8hd9LXsmhau/qEGodDCMknmt8zmVy 2Vp0Rl4pZO2dMRuAKP+rQmEm3EweRD4S9XswpJW0aUhWwn54rE/5FRmfb9fDn5AjeHiB 1gUSZHoPx6IifIuyf7Z+Fi7wRh+Tmglu4fIHxL1I7F/Yp8DiBTpkXOWi5F9vlgGqSTcd vyBg== X-Gm-Message-State: AOAM533Olz57Cv+PiKGOSdaGyAoPVaQeBH5AnM2pZEcZk4NhmDGpBflR Yp+9+jPpwBKOqiKp8hUr4Uj4H7pwe7xLOWkZ X-Google-Smtp-Source: ABdhPJyWnDMUIq5SpWjwAAPvbLMQfeKQ7vDbxtt6Wy+PeGsjwTo5/piRdCkpLAAZB4p7MFjM4kHkKQ== X-Received: by 2002:a63:90c8:0:b0:365:5cc7:e776 with SMTP id a191-20020a6390c8000000b003655cc7e776mr6278320pge.13.1645799235390; Fri, 25 Feb 2022 06:27:15 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:14 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 12/50] grub: add a fix for unused variable in gnulib Date: Fri, 25 Feb 2022 04:25:52 -1000 Message-Id: <30cf1e62b0f139cd6e1e3d5c09b7156acfb276b5.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162358 From: Marta Rybczynska This changes adds a fix for an unused variable issue in gnulib. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ulib-regexec-Resolve-unused-variable.patch | 59 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0008-gnulib-regexec-Resolve-unused-variable.patch diff --git a/meta/recipes-bsp/grub/files/0008-gnulib-regexec-Resolve-unused-variable.patch b/meta/recipes-bsp/grub/files/0008-gnulib-regexec-Resolve-unused-variable.patch new file mode 100644 index 0000000000..74ffb559e9 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0008-gnulib-regexec-Resolve-unused-variable.patch @@ -0,0 +1,59 @@ +From 9d36bce5d516b6379ba3a0dd1a94a9c035838827 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Wed, 21 Oct 2020 14:41:27 +0000 +Subject: [PATCH] gnulib/regexec: Resolve unused variable + +This is a really minor issue where a variable is being assigned to but +not checked before it is overwritten again. + +The reason for this issue is that we are not building with DEBUG set and +this in turn means that the assert() that reads the value of the +variable match_last is being processed out. + +The solution, move the assignment to match_last in to an ifdef DEBUG too. + +Fixes: CID 292459 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=a983d36bd9178d377d2072fd4b11c635fdc404b4] +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.extra-dist | 1 + + .../lib/gnulib-patches/fix-unused-value.patch | 14 ++++++++++++++ + 2 files changed, 15 insertions(+) + create mode 100644 grub-core/lib/gnulib-patches/fix-unused-value.patch + +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index 46c4e95..9b01152 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -29,6 +29,7 @@ EXTRA_DIST += grub-core/genemuinit.sh + EXTRA_DIST += grub-core/genemuinitheader.sh + + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch ++EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/no-abort.patch + +diff --git a/grub-core/lib/gnulib-patches/fix-unused-value.patch b/grub-core/lib/gnulib-patches/fix-unused-value.patch +new file mode 100644 +index 0000000..ba51f1b +--- /dev/null ++++ b/grub-core/lib/gnulib-patches/fix-unused-value.patch +@@ -0,0 +1,14 @@ ++--- a/lib/regexec.c 2020-10-21 14:25:35.310195912 +0000 +++++ b/lib/regexec.c 2020-10-21 14:32:07.961765604 +0000 ++@@ -828,7 +828,11 @@ ++ break; ++ if (__glibc_unlikely (err != REG_NOMATCH)) ++ goto free_return; +++#ifdef DEBUG +++ /* Only used for assertion below when DEBUG is set, otherwise +++ it will be over-written when we loop around. */ ++ match_last = -1; +++#endif ++ } ++ else ++ break; /* We found a match. */ diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 46d65d8609..d2a1502d56 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -54,6 +54,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0005-efi-Fix-some-malformed-device-path-arithmetic-errors.patch \ file://0006-kern-efi-Fix-memory-leak-on-failure.patch \ file://0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch \ + file://0008-gnulib-regexec-Resolve-unused-variable.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4267 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ECD4C433EF for ; Fri, 25 Feb 2022 14:27:19 +0000 (UTC) Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by mx.groups.io with SMTP id smtpd.web10.7061.1645799238667436858 for ; Fri, 25 Feb 2022 06:27:18 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=f20GhceC; spf=softfail (domain: sakoman.com, ip: 209.85.210.181, mailfrom: steve@sakoman.com) Received: by mail-pf1-f181.google.com with SMTP id y5so4832221pfe.4 for ; Fri, 25 Feb 2022 06:27:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=lxtISXHm76OZQFnAhhah9LGIb6TDQVF2VitEPH4B3bc=; b=f20GhceCH3BxRYefOysDf7lBd7pZaME0WXVR3xOgF1CVxii8zymEBzG4+6HTMnrJM1 TS5B/GpzhQJZ+tUodlkChErCvBZU/DpDUQdxb6+ng0hibzpXXKZF5xX1aVnlWR7oqYDV TU8BEIVoNZlGlUBX25ODwCvPjzzTwJ3ZEUmpDu7RwIkKJPcSRvqACUUcTO0TuhdBhWBP 7m2pNJz1NgSTVsSAgeHeXxWX+1ZKiU8bngkO3OhG23G4CSEzcedJjALuwjIuAJsF5XtX fauH/2Myp8pV1U3qgZleqDGIrlkqlR3nxUY9RnGp2GP9TzDG4g/XXF23IlkaH8/G/YfL j+cA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=lxtISXHm76OZQFnAhhah9LGIb6TDQVF2VitEPH4B3bc=; b=G8fJ7Y0Ox3u0lq8K2pj0QL0XBrG3+P+Wc6NMaYw5eG8zp+gTiAf2fZvjT8KrJqu1um w9QQgEzN7XrZpyuuT7wSsJ+OOKWuZMA2pR3PXLrMFaHsy3zNEWQI2q6wN3Hc+q2sAhBy zQFKeYi92zVpAvbiVQ29bI72AAvhdH080G1iSRZRorQk0doTSYayWlIyL/lwHu9QntSp O31b62DoYnzt3n14dvhGX/EfqdsPoZnROTNE1YjDPMo0D0FVaIFZbxN7r36L6EESsB4x kPoVGQAyOnwHl8pDWAHX+PACKJpDwR6lvpZ9CzcpZJ+2LVKyyyDlMgy+RX+PnfetdVh/ rjyQ== X-Gm-Message-State: AOAM532gRNZV1PtsnEjDbPrUF153eDuDqGH8rPCt5FR2zaw8+lDlPiSs NX3uWC05DQrt1iIDBm9RE58dWZkheUmYYpFm X-Google-Smtp-Source: ABdhPJxcGr/OmLdUqoLXpvwEgXi0BoVKKSThkxapz/AetA2kHbhAGHm57xFsueZIFSJ6gejNwDw3Og== X-Received: by 2002:a63:5323:0:b0:375:9c2b:9716 with SMTP id h35-20020a635323000000b003759c2b9716mr4953847pgb.150.1645799237649; Fri, 25 Feb 2022 06:27:17 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:17 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 13/50] grub: fix an unitialized token in gnulib Date: Fri, 25 Feb 2022 04:25:53 -1000 Message-Id: <301e2ff664409011d5650339ef22225cd2028041.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162359 From: Marta Rybczynska This change adds a fix for an unitialized token structure in gnulib. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...mp-Fix-uninitialized-token-structure.patch | 53 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch diff --git a/meta/recipes-bsp/grub/files/0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch b/meta/recipes-bsp/grub/files/0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch new file mode 100644 index 0000000000..b6e3c7edbe --- /dev/null +++ b/meta/recipes-bsp/grub/files/0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch @@ -0,0 +1,53 @@ +From 2af8df02cca7fd4b584575eac304cd03fa23f5cc Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 22 Oct 2020 13:54:06 +0000 +Subject: [PATCH] gnulib/regcomp: Fix uninitialized token structure + +The code is assuming that the value of br_token.constraint was +initialized to zero when it wasn't. + +While some compilers will ensure that, not all do, so it is better to +fix this explicitly than leave it to chance. + +Fixes: CID 73749 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=75c3d3cec4f408848f575d6d5e30a95bd6313db0] +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.extra-dist | 1 + + .../lib/gnulib-patches/fix-uninit-structure.patch | 11 +++++++++++ + 2 files changed, 12 insertions(+) + create mode 100644 grub-core/lib/gnulib-patches/fix-uninit-structure.patch + +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index 9b01152..9e55458 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -29,6 +29,7 @@ EXTRA_DIST += grub-core/genemuinit.sh + EXTRA_DIST += grub-core/genemuinitheader.sh + + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch ++EXTRA_DIST += grub-core/lib/gnulib-patches/fix-uninit-structure.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/no-abort.patch +diff --git a/grub-core/lib/gnulib-patches/fix-uninit-structure.patch b/grub-core/lib/gnulib-patches/fix-uninit-structure.patch +new file mode 100644 +index 0000000..7b4d9f6 +--- /dev/null ++++ b/grub-core/lib/gnulib-patches/fix-uninit-structure.patch +@@ -0,0 +1,11 @@ ++--- a/lib/regcomp.c 2020-10-22 13:49:06.770168928 +0000 +++++ b/lib/regcomp.c 2020-10-22 13:50:37.026528298 +0000 ++@@ -3662,7 +3662,7 @@ ++ Idx alloc = 0; ++ #endif /* not RE_ENABLE_I18N */ ++ reg_errcode_t ret; ++- re_token_t br_token; +++ re_token_t br_token = {0}; ++ bin_tree_t *tree; ++ ++ sbcset = (re_bitset_ptr_t) calloc (sizeof (bitset_t), 1); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index d2a1502d56..df2c8b8a16 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -55,6 +55,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0006-kern-efi-Fix-memory-leak-on-failure.patch \ file://0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch \ file://0008-gnulib-regexec-Resolve-unused-variable.patch \ + file://0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4268 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A004C433F5 for ; Fri, 25 Feb 2022 14:27:21 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.web12.6893.1645799240885817912 for ; Fri, 25 Feb 2022 06:27:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=2HPoSP/S; spf=softfail (domain: sakoman.com, ip: 209.85.215.175, mailfrom: steve@sakoman.com) Received: by mail-pg1-f175.google.com with SMTP id o23so4767849pgk.13 for ; Fri, 25 Feb 2022 06:27:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=khJyXlze8+n+Yqg+hQnC2MQMdC56jNApVNEL1TcFlco=; b=2HPoSP/SKQPn5x2rcfzgp+EBc/MD4coAGDJ7YvNbiI6j3K1RYfZ8B8lDEVBHFqYnYq kxvGDUd5lNbsdRQMN37JSNiV9VVZOWedNpaul8DpOkKkVaEvn+5+seYSrOC5OdYQrYgt CluD4D5M40FlEXgIYSPtH2NNpzblF1wrzPBGFgBp9jkWp4is6yfU5bUBJDfnr4WFGeRD 6FFbu6vRDp1WO42nzE+1DBjM/1FHqJoJBPDpseyDhUYcqOd0FvM5n8VqgPz6e48k6Bjb eKB4eyGqF5PIhh1L+J4/e/AIRimgw1P80PLGqvLBrgOlEJMvtS/w7qnees6n0GLEG+Nk qljw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=khJyXlze8+n+Yqg+hQnC2MQMdC56jNApVNEL1TcFlco=; b=6F16Pl2KAldK0vmws4fuwGv3fbB7i8RC88fzbnwhspPdHzlSVT0In/8MqdjSzT2b5l Xq2M3bEJ/bc7UcWVOHiGj+c3reng8/2ieHwtRmW8RuO7BcSJQpz5O5NhffHOZF5GyF2g R/FjVADqUaf7yXL92y6zfxHLYHiqdK8aSQCm04LuJfvCzLwr/ujAG3pRqjEtxBKcPDQJ USjf3hRonQ7iVw3vhY61I9T2WkRubuGe4G0UlXNdhUjXgrm/B855a2p/bFV/1LSetdoI YUa4Cg16LyWj57XbkJaIpCJdRwckJI+CpM2W8W1bNNo61lrGPC6Txedv8KuCt25usnUA jKUw== X-Gm-Message-State: AOAM530ODUT9w+j87McduCi+mnFqoaviwxdxZjPQM26Jw0E5+uRNznNn SUrtfXN9Gr1JKqtwnyM+e6YsCdb8LuG+Vpad X-Google-Smtp-Source: ABdhPJwlLYC9PEQ68A4uTukKVeug30bZXMTDxMcFmwa8R0J7qGmG3zrNbNQUP3Pfxyd7yjpvETubUA== X-Received: by 2002:a63:e84b:0:b0:372:a079:302 with SMTP id a11-20020a63e84b000000b00372a0790302mr6365304pgk.272.1645799239837; Fri, 25 Feb 2022 06:27:19 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:19 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 14/50] grub: add a fix a NULL pointer dereference in gnulib Date: Fri, 25 Feb 2022 04:25:54 -1000 Message-Id: <37900e0b112bfd66ae61c03470fd32f77dee1aac.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162360 From: Marta Rybczynska This change adds a fix for a NULL pointer dereference of state in gnulib. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...-Fix-dereference-of-a-possibly-NULL-.patch | 52 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch diff --git a/meta/recipes-bsp/grub/files/0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch b/meta/recipes-bsp/grub/files/0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch new file mode 100644 index 0000000000..102a494561 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch @@ -0,0 +1,52 @@ +From eaf9da8b5f8349c51cfc89dd8e39a1a61f89790a Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Wed, 28 Oct 2020 14:43:01 +0000 +Subject: [PATCH] gnulib/argp-help: Fix dereference of a possibly NULL state + +All other instances of call to __argp_failure() where there is +a dgettext() call is first checking whether state is NULL before +attempting to dereference it to get the root_argp->argp_domain. + +Fixes: CID 292436 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=3a37bf120a9194c373257c70175cdb5b337bc107] +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.extra-dist | 1 + + .../lib/gnulib-patches/fix-null-state-deref.patch | 12 ++++++++++++ + 2 files changed, 13 insertions(+) + create mode 100644 grub-core/lib/gnulib-patches/fix-null-state-deref.patch + +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index 9e55458..96d7e69 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -29,6 +29,7 @@ EXTRA_DIST += grub-core/genemuinit.sh + EXTRA_DIST += grub-core/genemuinitheader.sh + + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch ++EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-state-deref.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-uninit-structure.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch +diff --git a/grub-core/lib/gnulib-patches/fix-null-state-deref.patch b/grub-core/lib/gnulib-patches/fix-null-state-deref.patch +new file mode 100644 +index 0000000..813ec09 +--- /dev/null ++++ b/grub-core/lib/gnulib-patches/fix-null-state-deref.patch +@@ -0,0 +1,12 @@ ++--- a/lib/argp-help.c 2020-10-28 14:32:19.189215988 +0000 +++++ b/lib/argp-help.c 2020-10-28 14:38:21.204673940 +0000 ++@@ -145,7 +145,8 @@ ++ if (*(int *)((char *)upptr + up->uparams_offs) >= upptr->rmargin) ++ { ++ __argp_failure (state, 0, 0, ++- dgettext (state->root_argp->argp_domain, +++ dgettext (state == NULL ? NULL +++ : state->root_argp->argp_domain, ++ "\ ++ ARGP_HELP_FMT: %s value is less than or equal to %s"), ++ "rmargin", up->name); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index df2c8b8a16..94873475c1 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -56,6 +56,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0007-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch \ file://0008-gnulib-regexec-Resolve-unused-variable.patch \ file://0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch \ + file://0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4269 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77ABDC433F5 for ; Fri, 25 Feb 2022 14:27:23 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.web11.6917.1645799243030317555 for ; Fri, 25 Feb 2022 06:27:23 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=MDmc11ny; spf=softfail (domain: sakoman.com, ip: 209.85.214.175, mailfrom: steve@sakoman.com) Received: by mail-pl1-f175.google.com with SMTP id s1so4923273plg.12 for ; Fri, 25 Feb 2022 06:27:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=sAn8Dvn5II+QBF41imp4j/CupvLugcgNLRbyYfIGWXg=; b=MDmc11nyJX8Xw6IrlVLwqyuCuYETfXeJPsBNO/5oJGKIEe45lFr7XHnpPuARrlR+k2 aEIX0pq3HuMzT5KADRF7bRKaqIOi1132ny30M1+vSMnprCAxEIsi/hKF/EkAog3jxSUM pWprQf1X5ejhnke3cmuKV5gjw1xMyrV6k8hHLZpZkrDANTlSLuvuwajqFw7MdAWFoY1q PnQki9rKds+jHbG2dT0tNAgqBxHgV9zjsSvQwJrYmQ/0qGUWH2/P8csz1BTJbBxKfb4d IrbeXybSW5QEYk2p6bWdkocGpS0oA4+h0fUMP9T5ZmbSYE3qNQRJYg3OCg5Fk04C9AVX fvqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=sAn8Dvn5II+QBF41imp4j/CupvLugcgNLRbyYfIGWXg=; b=Q4IkRyUBzwDtSs/dRoysJSmEkaZFCM8cV4gSK0d0ORTrez6LU+rb7OrF6O4yefbKnH PWS7nrFRZDtAD+Zy7wj6m/5VFSv/FWiHeyFjxtIuh0i+qq/+VXJGnx9Yrn4pfOqsofld ySfhvkgHzZA7J88Vx5Jwfgt/VtKFTgS7G0m4YLpRIHWS4J4CbxAVPcYbnZz/O3AKnctj slp3kQZLfDIcLODP0StaSbuPBT4eUtvs9X0J6yWNjEY9/sbo//H21YQS3Mn0nUvJffy+ 6uCiw13EYZUZLA/DhGaR3VsbMdu+q15uxX4M7qLGz1lM/zESvAkokrWXxFrEFb19aIr+ MWZg== X-Gm-Message-State: AOAM530uSiI7cdf9ILINkHBEpw7Hja1+M/nfVVEDoPDV7gfyGYZWQzTF 2SOnIuUAegAZvzsNNh8mCsq4rxyVPIclaBK/ X-Google-Smtp-Source: ABdhPJyBGzfvGN2yW2BrDprRjVjw6CbbGkSIzcM8vtBNz3FAxIPvgFBNcFxmAG2xBjoJGcQWtZRgvg== X-Received: by 2002:a17:90a:a887:b0:1bc:388a:329f with SMTP id h7-20020a17090aa88700b001bc388a329fmr3429915pjq.17.1645799242090; Fri, 25 Feb 2022 06:27:22 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:21 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 15/50] grub: add a fix for NULL pointer dereference Date: Fri, 25 Feb 2022 04:25:55 -1000 Message-Id: <133759837a226d70b77f9bc7757c293664c3a018.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162361 From: Marta Rybczynska Add a fix for gnulib's regexec NULL pointer dereference. This patch a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...egexec-Fix-possible-null-dereference.patch | 53 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0011-gnulib-regexec-Fix-possible-null-dereference.patch diff --git a/meta/recipes-bsp/grub/files/0011-gnulib-regexec-Fix-possible-null-dereference.patch b/meta/recipes-bsp/grub/files/0011-gnulib-regexec-Fix-possible-null-dereference.patch new file mode 100644 index 0000000000..4f43fcf7d5 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0011-gnulib-regexec-Fix-possible-null-dereference.patch @@ -0,0 +1,53 @@ +From 244dc2b1f518635069a556c424b2e7627f0cf036 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 5 Nov 2020 10:57:14 +0000 +Subject: [PATCH] gnulib/regexec: Fix possible null-dereference + +It appears to be possible that the mctx->state_log field may be NULL, +and the name of this function, clean_state_log_if_needed(), suggests +that it should be checking that it is valid to be cleaned before +assuming that it does. + +Fixes: CID 86720 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0b7f347638153e403ee2dd518af3ce26f4f99647] +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.extra-dist | 1 + + .../lib/gnulib-patches/fix-regexec-null-deref.patch | 12 ++++++++++++ + 2 files changed, 13 insertions(+) + create mode 100644 grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch + +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index 96d7e69..d27d3a9 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -30,6 +30,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh + + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-state-deref.patch ++EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-uninit-structure.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch +diff --git a/grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch b/grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch +new file mode 100644 +index 0000000..db6dac9 +--- /dev/null ++++ b/grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch +@@ -0,0 +1,12 @@ ++--- a/lib/regexec.c 2020-10-21 14:25:35.310195912 +0000 +++++ b/lib/regexec.c 2020-11-05 10:55:09.621542984 +0000 ++@@ -1692,6 +1692,9 @@ ++ { ++ Idx top = mctx->state_log_top; ++ +++ if (mctx->state_log == NULL) +++ return REG_NOERROR; +++ ++ if ((next_state_log_idx >= mctx->input.bufs_len ++ && mctx->input.bufs_len < mctx->input.len) ++ || (next_state_log_idx >= mctx->input.valid_len diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 94873475c1..e7168e75ea 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -57,6 +57,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0008-gnulib-regexec-Resolve-unused-variable.patch \ file://0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch \ file://0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch \ + file://0011-gnulib-regexec-Fix-possible-null-dereference.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4270 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 774C4C433EF for ; Fri, 25 Feb 2022 14:27:25 +0000 (UTC) Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by mx.groups.io with SMTP id smtpd.web09.6934.1645799245121720969 for ; Fri, 25 Feb 2022 06:27:25 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=6F1NBSRO; spf=softfail (domain: sakoman.com, ip: 209.85.215.181, mailfrom: steve@sakoman.com) Received: by mail-pg1-f181.google.com with SMTP id 75so4804414pgb.4 for ; Fri, 25 Feb 2022 06:27:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=cx2b/ieFMl1it9QL1AQQ4QyMzEqpI+3IBXcbQporKXk=; b=6F1NBSRO7pYeHeJAfCifs7pCEEwFT7HX7UWcG/3h0RygJhTUEJWWHdQ/Itaewtf7RK Fyw8s8Yi9h4MAvtSnqC5zHC4wLM7jUTdsH/o5RcOY14wdbBb43UkNqrjSkPSq+ekqpTg PS38CBh3xDIwdl0R7P2Fw/Uva4koWhwyuHh7YJFowpAknL1okn16/zrMjUDiyN9Hz9hH IimgBnSVItgDl85UPvP789UQhKtJxw/cGe2AR2GD16AFGAkmaBYVxLZmKmHdOT4Hby1m 2bgNyPryOs+YBUx0UgadbRY48DXZ/wDPXB5DmuXVbmfza53g1iQ6xh8ulSH2VJgIGyp8 LOHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=cx2b/ieFMl1it9QL1AQQ4QyMzEqpI+3IBXcbQporKXk=; b=n32/a90fSzjPuUHmIpoy1Ebjb49OMU6Udm5/sIoZvl5js8IoOyTq2edBmxm+rkrHKD ob//g1lXlOCkiNHo9vRyrdLOmMcmmW1Ovv1FFvSgSLvUmJdZlkMMxFfyBJS01iSkZ8NF +2cSqb3rXKQ8LXBPbFFRPTOkmkqmnvh7ygfs3pATzn68EIPNCoVmlnKBHAkzgUoe1irS iLRUH0ubinmTOYKkVRzG+q+m5/69s7dVJdnGHKFqV56MMeL2Rjz9S2ew+5WE66GjMEJh X54og6KSo089GHFTLHpkzZvZMKRFBN1C0RwTuZIeci8WErg0PseeTV3q1p3jL+jeqFWK pxuQ== X-Gm-Message-State: AOAM5306Vf0OVezZh+yr7VZj3m0gqOY/oEBg45OjqRnf1nKOpQPz77RR YZ2bvgCux8i7Bl25codI1pnsZHF/p+wIo2C3 X-Google-Smtp-Source: ABdhPJwyrGIe6Zi1M+g6znkwoaBmy2VxGvhrFXdeWt0+NfGnLC5mMjzeQxdZi0Y8rjCvKXMd/LGGZQ== X-Received: by 2002:a63:7e44:0:b0:378:5645:90f6 with SMTP id o4-20020a637e44000000b00378564590f6mr615404pgn.505.1645799244100; Fri, 25 Feb 2022 06:27:24 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:23 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 16/50] grub: fix an unitialized re_token in gnulib Date: Fri, 25 Feb 2022 04:25:56 -1000 Message-Id: <0ce9c21b776ef6bfeaef665829324d7a04c22ce9.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162362 From: Marta Rybczynska This patch adds a fix for an unitialized re_token in grub's gnulib. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...b-regcomp-Fix-uninitialized-re_token.patch | 55 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 56 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0012-gnulib-regcomp-Fix-uninitialized-re_token.patch diff --git a/meta/recipes-bsp/grub/files/0012-gnulib-regcomp-Fix-uninitialized-re_token.patch b/meta/recipes-bsp/grub/files/0012-gnulib-regcomp-Fix-uninitialized-re_token.patch new file mode 100644 index 0000000000..0507e0cd66 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0012-gnulib-regcomp-Fix-uninitialized-re_token.patch @@ -0,0 +1,55 @@ +From 512b6bb380a77233b88c84b7a712896c70281d2f Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 24 Nov 2020 18:04:22 +0000 +Subject: [PATCH] gnulib/regcomp: Fix uninitialized re_token + +This issue has been fixed in the latest version of gnulib, so to +maintain consistency, I've backported that change rather than doing +something different. + +Fixes: CID 73828 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=03477085f9a33789ba6cca7cd49ab9326a1baa0e] +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.extra-dist | 1 + + .../gnulib-patches/fix-regcomp-uninit-token.patch | 15 +++++++++++++++ + 2 files changed, 16 insertions(+) + create mode 100644 grub-core/lib/gnulib-patches/fix-regcomp-uninit-token.patch + +diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist +index d27d3a9..ffe6829 100644 +--- a/conf/Makefile.extra-dist ++++ b/conf/Makefile.extra-dist +@@ -30,6 +30,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh + + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-deref.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-null-state-deref.patch ++EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regcomp-uninit-token.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regexec-null-deref.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-uninit-structure.patch + EXTRA_DIST += grub-core/lib/gnulib-patches/fix-unused-value.patch +diff --git a/grub-core/lib/gnulib-patches/fix-regcomp-uninit-token.patch b/grub-core/lib/gnulib-patches/fix-regcomp-uninit-token.patch +new file mode 100644 +index 0000000..02e0631 +--- /dev/null ++++ b/grub-core/lib/gnulib-patches/fix-regcomp-uninit-token.patch +@@ -0,0 +1,15 @@ ++--- a/lib/regcomp.c 2020-11-24 17:06:08.159223858 +0000 +++++ b/lib/regcomp.c 2020-11-24 17:06:15.630253923 +0000 ++@@ -3808,11 +3808,7 @@ ++ create_tree (re_dfa_t *dfa, bin_tree_t *left, bin_tree_t *right, ++ re_token_type_t type) ++ { ++- re_token_t t; ++-#if defined GCC_LINT || defined lint ++- memset (&t, 0, sizeof t); ++-#endif ++- t.type = type; +++ re_token_t t = { .type = type }; ++ return create_token_tree (dfa, left, right, &t); ++ } ++ diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index e7168e75ea..4ddb9fc4f1 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -58,6 +58,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0009-gnulib-regcomp-Fix-uninitialized-token-structure.patch \ file://0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch \ file://0011-gnulib-regexec-Fix-possible-null-dereference.patch \ + file://0012-gnulib-regcomp-Fix-uninitialized-re_token.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4271 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78012C433EF for ; Fri, 25 Feb 2022 14:27:28 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.web11.6920.1645799247244459042 for ; Fri, 25 Feb 2022 06:27:27 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=jvCS8q81; spf=softfail (domain: sakoman.com, ip: 209.85.215.178, mailfrom: steve@sakoman.com) Received: by mail-pg1-f178.google.com with SMTP id 132so4791993pga.5 for ; Fri, 25 Feb 2022 06:27:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=Q4HJYj5pB9kLQtJrMHOTf9cbyDICmr+tLzJLMhS6Osw=; b=jvCS8q81aRFs2Y/lZ+GnkeqXwe8Zn1cYLsSKg7RYEnNY8c7WqPtBLUuaNhbwn7KFew 3Tpp9G1mwkTQyc5/q49KegiN/VThPJsQf4j3l9+3Ps4AZgBowMaUTvRFlT5uWYXgzc1i Q7n3EtfoQOLqEKbM2Q4JpdQLGakDP5jognyqn1ghs47cvELe1RX1g97sQc0Sw3Ur0TQc EOdx2mLnZLbvTnvbbSTJ+Tmg2OepCV10094iZjQXXIid8MLIXJ7Wpggi10CoK/sqeWm5 EookJwUxTYFDCXslqoVzS3dJxFrg5TRR2olVuyMEpFOVAFajixMjvReAXxY0J1FkZc4+ Tt4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Q4HJYj5pB9kLQtJrMHOTf9cbyDICmr+tLzJLMhS6Osw=; b=iz0ghcCbmYX9Q4AQ4u8rLAG8x+b7AilOmj6o5bFaCIh6naoh9uLydref4Q4VRD+Xo/ HyGtdaCvvp5W4pItl2p3FZ8FUW3sq55AA/8cx5sb2ROWmvAu+niGnKgMdQ7DZkBFhxnb na/fVfxeJK1lyGf+SWPq0STwaa3iNmR+VJDzJmqtXYqp5BgS8EZUnDg3guyyvCIDEoEf emNOaOgZuZwamAyms5+BwI5ESenHDQngGYCCJ0uFHaX5/SBvc+SNJh/WhbkIhAu3TyNQ gBjhpXhOChffrppgJvogNN2xUNZGyrR4zWspHYFMiIg9QSRFRRAkcBjy7EqgmfAWcK8K myVQ== X-Gm-Message-State: AOAM530pDTUcyGOY3hVMCqUOREXS2QWSuAwTouITXqczy8mMI98XND1t OnyJW2JMmGTmJ6sqJxdC0jVARnm2u7wHXKjh X-Google-Smtp-Source: ABdhPJzHuxzD4gklpQzGbSZZTK+8GdPHeHQLPvy74ZtWD3z5jr8dHNjSmASucc9hkf0yOEZ6jLDGNg== X-Received: by 2002:a63:510c:0:b0:378:4f82:9448 with SMTP id f12-20020a63510c000000b003784f829448mr1006848pgb.69.1645799246192; Fri, 25 Feb 2022 06:27:26 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:25 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 17/50] grub: add a fix for unnecessary assignements Date: Fri, 25 Feb 2022 04:25:57 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162363 From: Marta Rybczynska Add a fix for unnecessary assignements grub's io/lzopio. This patch is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...e-unnecessary-self-assignment-errors.patch | 41 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch diff --git a/meta/recipes-bsp/grub/files/0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch b/meta/recipes-bsp/grub/files/0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch new file mode 100644 index 0000000000..1190b0d090 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch @@ -0,0 +1,41 @@ +From c529ca446424f1a9c64f0007dfe31fa7645d13ac Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Wed, 21 Oct 2020 14:44:10 +0000 +Subject: [PATCH] io/lzopio: Resolve unnecessary self-assignment errors + +These 2 assignments are unnecessary since they are just assigning +to themselves. + +Fixes: CID 73643 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=59666e520f44177c97b82a44c169b3b315d63b42] +Signed-off-by: Marta Rybczynska +--- + grub-core/io/lzopio.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/grub-core/io/lzopio.c b/grub-core/io/lzopio.c +index 3014485..a7d4425 100644 +--- a/grub-core/io/lzopio.c ++++ b/grub-core/io/lzopio.c +@@ -125,8 +125,6 @@ read_block_header (struct grub_lzopio *lzopio) + sizeof (lzopio->block.ucheck)) != + sizeof (lzopio->block.ucheck)) + return -1; +- +- lzopio->block.ucheck = lzopio->block.ucheck; + } + + /* Read checksum of compressed data. */ +@@ -143,8 +141,6 @@ read_block_header (struct grub_lzopio *lzopio) + sizeof (lzopio->block.ccheck)) != + sizeof (lzopio->block.ccheck)) + return -1; +- +- lzopio->block.ccheck = lzopio->block.ccheck; + } + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 4ddb9fc4f1..1906a28f30 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -59,6 +59,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0010-gnulib-argp-help-Fix-dereference-of-a-possibly-NULL-.patch \ file://0011-gnulib-regexec-Fix-possible-null-dereference.patch \ file://0012-gnulib-regcomp-Fix-uninitialized-re_token.patch \ + file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4272 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7641EC433EF for ; Fri, 25 Feb 2022 14:27:30 +0000 (UTC) Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by mx.groups.io with SMTP id smtpd.web12.6895.1645799249330348663 for ; Fri, 25 Feb 2022 06:27:29 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=JqhifpZk; spf=softfail (domain: sakoman.com, ip: 209.85.210.181, mailfrom: steve@sakoman.com) Received: by mail-pf1-f181.google.com with SMTP id z15so4816704pfe.7 for ; Fri, 25 Feb 2022 06:27:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=11y0IcI9MD5WAvmDLwpnpqXhhyIRvIkiEgulKl5kXo0=; b=JqhifpZkDEqZ39nspPBgQ8i6zHVNLTp1bhMkzSb5EI2ZNrbj2bZipyxuiPl9rKhpTv I3bOoKddHxSUNVBNJSajJhbC5guUaOuzEao32A8qZIVkgbj045cakwsYsL6qH/jQIjXq +GWdly+6T6y2xEsbN8DdiOxp3ST20lb/+m4RfONUOA8d9cOrjIUP4kWPA+7R9Rn81S8b qoFUdI2MLkVW3aSPiD3LLlD/3y/YLz7dcliORUwuUa0TVfHXRqyEOhpF+h+B82wLC3X9 VEDcP5UNFBkUumPy7r8pFaJ+68R/hV7CpiD8y/eSDakgrZPcHwSUoTss+zqKp45BYRa+ SqiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=11y0IcI9MD5WAvmDLwpnpqXhhyIRvIkiEgulKl5kXo0=; b=ZqHaiBXo8Qm3G/95PfWhyyos1diybs/n70SEs7cHBtgNVp6nzLdsFZQx1MYbbpRotS rMHVjITfhJv4s+tMPwctGU2uFsJH58jOvoN89zI5f6U3WepiKOs8nLXwk7btPShl0g4t 8agj5dNBv85HnFsAPyPasKoZxO8fBra8Zzq2sYFvsnGp3jwkoxN/WsyYYPEa6mSabKxD 1Qhg8x5bLQK0eBLNpUSJYsZQl4f++ZyQhQwkHSxuYQdiig2j4Fu6E3eoy6NZIp+t8rS5 Gyl4wtHgrLf6d9bj4L9bJ5wSwI299MzS2kJJRPn7qQ/FbId/lZF1pSHYGOlmmOXl6O7h FPlg== X-Gm-Message-State: AOAM530+PXtIlcGdOP/J120RoXE7cT5BqxVdecm/0KXUWsyQOqR9WTfk femXjIeg1T3DMccgNujbFY2BSvlGpP9MLIvO X-Google-Smtp-Source: ABdhPJyi1Yg8iZcMqPZ9Z7yQBdKRk/ft0nD2XA5V8pzGeVbWcctdvuenViG4zJBORHhijnvYcWlkPg== X-Received: by 2002:a62:aa19:0:b0:4f1:1cff:faa8 with SMTP id e25-20020a62aa19000000b004f11cfffaa8mr7851080pff.25.1645799248355; Fri, 25 Feb 2022 06:27:28 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:27 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 18/50] grub: add structure initialization in zstd Date: Fri, 25 Feb 2022 04:25:58 -1000 Message-Id: <370ea660d476bda0d4f45520815396036648d87a.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162364 From: Marta Rybczynska This patch adds initialization of a structure in grub's zstd, which might be left uninitialized by the compiler. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...std-Initialize-seq_t-structure-fully.patch | 34 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0014-zstd-Initialize-seq_t-structure-fully.patch diff --git a/meta/recipes-bsp/grub/files/0014-zstd-Initialize-seq_t-structure-fully.patch b/meta/recipes-bsp/grub/files/0014-zstd-Initialize-seq_t-structure-fully.patch new file mode 100644 index 0000000000..19d881c1ca --- /dev/null +++ b/meta/recipes-bsp/grub/files/0014-zstd-Initialize-seq_t-structure-fully.patch @@ -0,0 +1,34 @@ +From f55ffe6bd8b844a8cd9956702f42ac2eb96ad56f Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 5 Nov 2020 10:29:59 +0000 +Subject: [PATCH] zstd: Initialize seq_t structure fully + +While many compilers will initialize this to zero, not all will, so it +is better to be sure that fields not being explicitly set are at known +values, and there is code that checks this fields value elsewhere in the +code. + +Fixes: CID 292440 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2777cf4466719921dbe4b30af358a75e7d76f217] +Signed-off-by: Marta Rybczynska +--- + grub-core/lib/zstd/zstd_decompress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/lib/zstd/zstd_decompress.c b/grub-core/lib/zstd/zstd_decompress.c +index 711b5b6..e4b5670 100644 +--- a/grub-core/lib/zstd/zstd_decompress.c ++++ b/grub-core/lib/zstd/zstd_decompress.c +@@ -1325,7 +1325,7 @@ typedef enum { ZSTD_lo_isRegularOffset, ZSTD_lo_isLongOffset=1 } ZSTD_longOffset + FORCE_INLINE_TEMPLATE seq_t + ZSTD_decodeSequence(seqState_t* seqState, const ZSTD_longOffset_e longOffsets) + { +- seq_t seq; ++ seq_t seq = {0}; + U32 const llBits = seqState->stateLL.table[seqState->stateLL.state].nbAdditionalBits; + U32 const mlBits = seqState->stateML.table[seqState->stateML.state].nbAdditionalBits; + U32 const ofBits = seqState->stateOffb.table[seqState->stateOffb.state].nbAdditionalBits; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 1906a28f30..7cf4d64149 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -60,6 +60,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0011-gnulib-regexec-Fix-possible-null-dereference.patch \ file://0012-gnulib-regcomp-Fix-uninitialized-re_token.patch \ file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ + file://0014-zstd-Initialize-seq_t-structure-fully.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:25:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4273 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79272C433EF for ; Fri, 25 Feb 2022 14:27:32 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.web09.6937.1645799251450035242 for ; Fri, 25 Feb 2022 06:27:31 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=YcgJnMCY; spf=softfail (domain: sakoman.com, ip: 209.85.214.181, mailfrom: steve@sakoman.com) Received: by mail-pl1-f181.google.com with SMTP id bd1so4924414plb.13 for ; Fri, 25 Feb 2022 06:27:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=Qmm7xv46iSCaOORd7DaSRNIYPdt9jw0CL8Qfc2zJzuE=; b=YcgJnMCYZhkC1aRgGWvcyjb9JWDA/+nEwGwNW7kTB/CL0ctEAml4WaAHgO+f6m4+Zi 3KIIl9jzMJ3tQUw3RNlf6pMjacSEQ8a765q0FiE39QGNyMuydNSeOwxF1wGd6CVU05pK XRB6sBFz4L4Iv9yqCGeVyME5dTFJVRypxVLX7ZFEuhyVCqaemHHwzV5MxkCnKJxJMDgN wS9v2dQdAyR9WkpkqFRqgJoqanUx/O92iOdAl8ivFoyycKfjEWv5EtFkUECyc9ILgYWo o+PzZkE1QHura+cPpCE+zz14ntFu1NT+/PCtug8tA2FMeIXXyKD/nFqwhpeeCnGbzHGy 9SZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Qmm7xv46iSCaOORd7DaSRNIYPdt9jw0CL8Qfc2zJzuE=; b=r7lEua/+BgFDv21Km2Q9damhAkGh03wt8OBxWZI1Y+pxT9GGAqZlq4y/IDKR5c5/Kf vJakmodQJdUFMu44f3Fl9b+9I4TgJn31up4VcUGMkQnCB+V8KphZwWhEhRDH6iMZPPVQ 2IYphfGmHzrgPQLJ9dGRMHJokXr3sq1SDpV3d5bukiXRa+bsPSCFslO3A/OLHyUiQ1QF /8YSUXosGSHFrGcSvuADsgMzZQqAwDB2Rep/itJ/gxY0FDXaWcL7g0YuXArhqO8oLuxG zHtfkx9oqDLeoi1ioR5eRk+r9hkvHXvCmQWYlE7oSQ+k68TlQDD7cd+AthGu1mpiuN8P MuMA== X-Gm-Message-State: AOAM532xOmIMpVMVqCUaH4acQmsyOclic0mwiza6kOjwIaJWmiDXwZAD LXtlQ5n3H6+z4g6CrhOpKlqx2EmtV/svkosC X-Google-Smtp-Source: ABdhPJwnB82FnMsrBYXixxPbQnOw5tWVi4DKFnZd3FnjCC60a1yiPAL53mKKUKm7cEfWJdKKw9D6Xw== X-Received: by 2002:a17:90a:c08a:b0:1bc:b573:2fe4 with SMTP id o10-20020a17090ac08a00b001bcb5732fe4mr3420339pjs.194.1645799250529; Fri, 25 Feb 2022 06:27:30 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:29 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 19/50] grub: add a missing NULL check Date: Fri, 25 Feb 2022 04:25:59 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162365 From: Marta Rybczynska This fix adds a missing check for NULL pointer from an external source in grub's kern/partition. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...heck-for-NULL-before-dereferencing-i.patch | 43 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch diff --git a/meta/recipes-bsp/grub/files/0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch b/meta/recipes-bsp/grub/files/0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch new file mode 100644 index 0000000000..af9fcd45cc --- /dev/null +++ b/meta/recipes-bsp/grub/files/0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch @@ -0,0 +1,43 @@ +From 0da8ef2e03a8591586b53a29af92d2ace76a04e3 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 23 Oct 2020 09:49:59 +0000 +Subject: [PATCH] kern/partition: Check for NULL before dereferencing input + string + +There is the possibility that the value of str comes from an external +source and continuing to use it before ever checking its validity is +wrong. So, needs fixing. + +Additionally, drop unneeded part initialization. + +Fixes: CID 292444 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=bc9c468a2ce84bc767234eec888b71f1bc744fff] +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/partition.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index e499147..b10a184 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -109,11 +109,14 @@ grub_partition_map_probe (const grub_partition_map_t partmap, + grub_partition_t + grub_partition_probe (struct grub_disk *disk, const char *str) + { +- grub_partition_t part = 0; ++ grub_partition_t part; + grub_partition_t curpart = 0; + grub_partition_t tail; + const char *ptr; + ++ if (str == NULL) ++ return 0; ++ + part = tail = disk->partition; + + for (ptr = str; *ptr;) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 7cf4d64149..94b89aa643 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -61,6 +61,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0012-gnulib-regcomp-Fix-uninitialized-re_token.patch \ file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ file://0014-zstd-Initialize-seq_t-structure-fully.patch \ + file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4274 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A0F7C433F5 for ; Fri, 25 Feb 2022 14:27:34 +0000 (UTC) Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by mx.groups.io with SMTP id smtpd.web11.6923.1645799253678200773 for ; Fri, 25 Feb 2022 06:27:33 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=drjKGtdE; spf=softfail (domain: sakoman.com, ip: 209.85.215.173, mailfrom: steve@sakoman.com) Received: by mail-pg1-f173.google.com with SMTP id 12so4834937pgd.0 for ; Fri, 25 Feb 2022 06:27:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=5FjLs2nlW2dIsfM91POnsjp1TYob1Ym9totJzJW1ng0=; b=drjKGtdEp69bivkwkikZav0pjrQZbrXlzIrLPrhFCSBqaFroMYGK7Q1CpWX4K5SpCk ekb/J/jmOZWCW3/Zr3vepZG8aOxyMF+4gRLc/LSWYzhxq/ErSpVaAkBaAPP1RVlK1G6x I992dFQBw9Z7evbsO2T73OAT05uihbqc1Zo6aPlH8oW4z5n7U29mqPjioI5pIijYL7gg itP4EfvOJkehxRup1RVA1IccPdYNsRBF2W8EnV2rIuhjdfRvUGtSAytqVU6EC2M/kK5i C2lTW6IfVwsJroegSg8mlttYhtcHlQWKIUWX66wNmz9m3LRN2XKuCmq28Qm4cXpQntEO xbEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=5FjLs2nlW2dIsfM91POnsjp1TYob1Ym9totJzJW1ng0=; b=hCCgUbj/UZOUPbyvv8wz0bgLe9XiUhAWXD3SkooYZvbAWes3xBzfZLcirUkyR3pHOY e5BkiDtEgSAx6FFdtHBErLOrVFhbaZmbcRGSUX7+fCRzMmd2h164Oa61qwQLU+64x2/j THreNsfOuQO9D9f/Dzj0X6WbgZ0Y7Sg3PpG6+EjBprMu+24NDAl6C+PnrUBV1kkOqVlL TUc2KzC028GCLnJEGvLVzQ5+pQsbWF8mr4u8fvzK+jKB1MPyq4RU3mKnkVEGdqVNutKR +orNvCk+DLuf1y0a5uw1zWMhmApF3FZkE+qYgdSZ/k9fytB23JOZpMgNdWz2H03ZYePc y+JA== X-Gm-Message-State: AOAM5314NQ27D0RapIywc/Xx7rOL+UzFF3v6M2asWi06ZaRgMRGMaZ7B CfspvSeRMkgW/1+IM3+7PLn8AMiw12ju49lt X-Google-Smtp-Source: ABdhPJwhc3lSskRzf3ebiXY4DKNmDw1CvlmDSk2Cbxu08EdNxSunZtOiXKzr89pyIGPKGXYMco/XJw== X-Received: by 2002:a63:b47:0:b0:373:cbfb:f4c8 with SMTP id a7-20020a630b47000000b00373cbfbf4c8mr6244839pgl.328.1645799252652; Fri, 25 Feb 2022 06:27:32 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:32 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 20/50] grub: fix a memory leak Date: Fri, 25 Feb 2022 04:26:00 -1000 Message-Id: <9fa41d5fbd1de899d1242c31d427262cd041d47c.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162366 From: Marta Rybczynska Add a fix for a memory leak in grub's disk/ldm. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...re-comp-data-is-freed-before-exiting.patch | 128 ++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 129 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch diff --git a/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch new file mode 100644 index 0000000000..c1687c75d0 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch @@ -0,0 +1,128 @@ +From 0c5d0fd796e6cafba179321de396681a493c4158 Mon Sep 17 00:00:00 2001 +From: Marco A Benatto +Date: Mon, 7 Dec 2020 11:53:03 -0300 +Subject: [PATCH] disk/ldm: Make sure comp data is freed before exiting from + make_vg() + +Several error handling paths in make_vg() do not free comp data before +jumping to fail2 label and returning from the function. This will leak +memory. So, let's fix all issues of that kind. + +Fixes: CID 73804 + +Signed-off-by: Marco A Benatto +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=23e39f50ca7a107f6b66396ed4d177a914dee035] +Signed-off-by: Marta Rybczynska +--- + grub-core/disk/ldm.c | 51 ++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 44 insertions(+), 7 deletions(-) + +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 58f8a53..428415f 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -554,7 +554,11 @@ make_vg (grub_disk_t disk, + comp->segments = grub_calloc (comp->segment_alloc, + sizeof (*comp->segments)); + if (!comp->segments) +- goto fail2; ++ { ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + } + else + { +@@ -562,7 +566,11 @@ make_vg (grub_disk_t disk, + comp->segment_count = 1; + comp->segments = grub_malloc (sizeof (*comp->segments)); + if (!comp->segments) +- goto fail2; ++ { ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + comp->segments->start_extent = 0; + comp->segments->extent_count = lv->size; + comp->segments->layout = 0; +@@ -574,15 +582,26 @@ make_vg (grub_disk_t disk, + comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK; + } + else +- goto fail2; ++ { ++ grub_free (comp->segments); ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + ptr += *ptr + 1; + ptr++; + if (!(vblk[i].flags & 0x10)) +- goto fail2; ++ { ++ grub_free (comp->segments); ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic) + || ptr + *ptr + 1 >= vblk[i].dynamic + + sizeof (vblk[i].dynamic)) + { ++ grub_free (comp->segments); + grub_free (comp->internal_id); + grub_free (comp); + goto fail2; +@@ -592,6 +611,7 @@ make_vg (grub_disk_t disk, + if (ptr + *ptr + 1 >= vblk[i].dynamic + + sizeof (vblk[i].dynamic)) + { ++ grub_free (comp->segments); + grub_free (comp->internal_id); + grub_free (comp); + goto fail2; +@@ -601,7 +621,12 @@ make_vg (grub_disk_t disk, + comp->segments->nodes = grub_calloc (comp->segments->node_alloc, + sizeof (*comp->segments->nodes)); + if (!lv->segments->nodes) +- goto fail2; ++ { ++ grub_free (comp->segments); ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + } + + if (lv->segments->node_alloc == lv->segments->node_count) +@@ -611,11 +636,23 @@ make_vg (grub_disk_t disk, + + if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || + grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) +- goto fail2; ++ { ++ grub_free (comp->segments->nodes); ++ grub_free (comp->segments); ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + + t = grub_realloc (lv->segments->nodes, sz); + if (!t) +- goto fail2; ++ { ++ grub_free (comp->segments->nodes); ++ grub_free (comp->segments); ++ grub_free (comp->internal_id); ++ grub_free (comp); ++ goto fail2; ++ } + lv->segments->nodes = t; + } + lv->segments->nodes[lv->segments->node_count].pv = 0; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 94b89aa643..479e2f71f2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -62,6 +62,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ file://0014-zstd-Initialize-seq_t-structure-fully.patch \ file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ + file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4275 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 782A6C433EF for ; Fri, 25 Feb 2022 14:27:36 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.web08.6789.1645799255818207572 for ; Fri, 25 Feb 2022 06:27:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=7xLlR0aE; spf=softfail (domain: sakoman.com, ip: 209.85.215.178, mailfrom: steve@sakoman.com) Received: by mail-pg1-f178.google.com with SMTP id o23so4768447pgk.13 for ; Fri, 25 Feb 2022 06:27:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=PE1DK3ihqqy59je06Pqm+YFKqGLn12qn3Ws2xH/fezk=; b=7xLlR0aEoOVw0C15erF7zQDtjUMO33qmTEeCFh9X53hLuqKyPPNd2UZoWonRKS2cKJ ZmZs41gn2kqpSfEdyQZ7AtbFWVXnXVfnhvVGbF+5T2gtOyjGSy7QHlMLUIZ6x5ZnU5ql A/2M4z7yi2fgaA4C9zTWH8ARIHnwv7xXBpf//JV72x1tkIjzoz3OMlr+bQED+Z8nIkYd AUr/c+UAONI6VaCTYlBB2N8+0dKL8sx3c8M3A/poqtI2LZ5Jqh/a5DVpOJ4IwFRs0/8c 3UwMsi0J3LKxiTG3v9kSbOPSPNrQ02mXZbss8kEXVNeTfNhrg68BI7REdjLB9rhSPZmq dtmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=PE1DK3ihqqy59je06Pqm+YFKqGLn12qn3Ws2xH/fezk=; b=GfWLsDXXivRuFPFGhG9irUMqim/7mmAsu+WfjUyVgxkayo/+7c6yP6kDksuPYdx6Bq NXA4OowETPtJ2zNw0YGntN4KZYeYKNE+MTLnESQMxjxSxj1XPWD7zsGW1f2UgYfMDLit yJBpkP0BsZIbJM/T1e1lgjRJM76UTdr4tYIXAAKTFseoH5AxWe0CTnObUtgpRCAySjye YgFWrG3J9aVWVLVU+krqT5JwY+qM9Hc0yzQNq8LQYujXyoNAJ3ImQRiXPxqi2CEVLXMd 4RblpZSeVKlN2bIDWiJ32qwO66I3QO/HiIcFkNLJnEWOcveqUTlNo+sdVEOgaLpb/fAz m17Q== X-Gm-Message-State: AOAM530h51MJR5mYT0C9TRh0Ygk8gmMIa+e3h/j79h+ZWJLjm2kZM6Ck vWs3PovtxIRswpSmER/PVXLfBZLb5iuVo+gA X-Google-Smtp-Source: ABdhPJxnQiJg3/pJOnDYTsjhnOwaV6nZe/kLzorJHEUetsNCWCZ5clC0CpIYZXzEoI0xsoYFwgmxgg== X-Received: by 2002:a65:4144:0:b0:374:315a:7dff with SMTP id x4-20020a654144000000b00374315a7dffmr6413524pgp.506.1645799254895; Fri, 25 Feb 2022 06:27:34 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:34 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 21/50] grub: fix a memory leak Date: Fri, 25 Feb 2022 04:26:01 -1000 Message-Id: <444a690c28fa78147273213f2ae19b1a67027a71.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162367 From: Marta Rybczynska This patch adds a fix for a memory leak in grub's disk/ldm. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...-If-failed-then-free-vg-variable-too.patch | 28 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0017-disk-ldm-If-failed-then-free-vg-variable-too.patch diff --git a/meta/recipes-bsp/grub/files/0017-disk-ldm-If-failed-then-free-vg-variable-too.patch b/meta/recipes-bsp/grub/files/0017-disk-ldm-If-failed-then-free-vg-variable-too.patch new file mode 100644 index 0000000000..ecdb230f76 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0017-disk-ldm-If-failed-then-free-vg-variable-too.patch @@ -0,0 +1,28 @@ +From 253485e8df3c9dedac848567e638157530184295 Mon Sep 17 00:00:00 2001 +From: Paulo Flabiano Smorigo +Date: Mon, 7 Dec 2020 10:07:47 -0300 +Subject: [PATCH] disk/ldm: If failed then free vg variable too + +Fixes: CID 73809 + +Signed-off-by: Paulo Flabiano Smorigo +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=e0b83df5da538d2a38f770e60817b3a4b9d5b4d7] +Signed-off-by: Marta Rybczynska +--- + grub-core/disk/ldm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 428415f..54713f4 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -199,6 +199,7 @@ make_vg (grub_disk_t disk, + { + grub_free (vg->uuid); + grub_free (vg->name); ++ grub_free (vg); + return NULL; + } + grub_memcpy (vg->uuid, label->group_guid, LDM_GUID_STRLEN); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 479e2f71f2..a8ee0dd68a 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -63,6 +63,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0014-zstd-Initialize-seq_t-structure-fully.patch \ file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \ + file://0017-disk-ldm-If-failed-then-free-vg-variable-too.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4276 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A1E8C433EF for ; Fri, 25 Feb 2022 14:27:38 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.web10.7068.1645799258038303979 for ; Fri, 25 Feb 2022 06:27:38 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Z77XP3Jr; spf=softfail (domain: sakoman.com, ip: 209.85.214.169, mailfrom: steve@sakoman.com) Received: by mail-pl1-f169.google.com with SMTP id bd1so4924740plb.13 for ; Fri, 25 Feb 2022 06:27:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=gbtQoLwzdjzGJl9NfehiaTdhD8sKcyw3PxN3k6xx56w=; b=Z77XP3Jr8CAyrXReJoN8zVGxvD7I4Nur7mZzKLRCrtREkGItTYBMIVlsHjhOKVlMpv 7WNcc+RkmgRe2uWHWeT9h2EoDkmohSPRwOAL4OT7HmeCReez6r5FqMVlP/jmU61TqAIQ /kBUwNYrJ6m/nQyisW+jaBq4Aa+D9Ih40Ox4iRzABA3c63B6IdiIpnW5VS7hAM7chP7k RhomfODahRhqmz/GuWAyYZs5MGF0+Xz195kUBt8U+2tTiBjVo+mIuprWSIUQSifgKwFy 5uGqocb6mCSWWgU6NkAUBQLx27jR3RgqKpoBC85rsnADOfaC7ok/M/7q3tjzBzd1FFbl LtLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=gbtQoLwzdjzGJl9NfehiaTdhD8sKcyw3PxN3k6xx56w=; b=X7xd4GWb289QZ320wPjp/yZHAPNBa9JbNe+6BHH6R+mtEmBBXKW9VI0FXgILyp5kv2 iLxDhMzBO7YChItXcs1E6ZaHbkmHnCth1VzVvxEU6PEM7dvDLUlVUmGV77DK1ObC6UWs JAGU001wQ8KH+puJ1G430DMgAMPvEyxf9wYFkAvFOR32hxHkD+VlHsCriTBvbke/sZYP LwmEWgaRpwTKI/PvRRi7UY4OnOgzpy0IMF1CHdW6pl+44Y7XSSNG1JQaaWkNDBz5XRyk tDYa3btwfMvujshkaZGxKDIF0qQLBoENDHzaKR5a//sSfw7eLc7ndJr9NRZNr7OU4hMG UWbA== X-Gm-Message-State: AOAM53384Rbq37XuR/TWvgh7YEtThOJGsuCrNp8Nb1bxg2fRVTayAfYF XqHD9qGbk9KBvYqGP4CMGlKdQip0lVjs35QN X-Google-Smtp-Source: ABdhPJwcPDxPlZG8WMLI6PYlOAGbR2ivh4uga/zklzqF5szJnlZMsQe46M+83N6H18mJbQBzBoGdKA== X-Received: by 2002:a17:902:da88:b0:150:f47:24ac with SMTP id j8-20020a170902da8800b001500f4724acmr7647261plx.73.1645799256962; Fri, 25 Feb 2022 06:27:36 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:36 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 22/50] grub: fix a memory leak Date: Fri, 25 Feb 2022 04:26:02 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162368 From: Marta Rybczynska Add a fix for a memory leak in grub'd disk/ldm. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ory-leak-on-uninserted-lv-references.patch | 50 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch diff --git a/meta/recipes-bsp/grub/files/0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch b/meta/recipes-bsp/grub/files/0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch new file mode 100644 index 0000000000..26932f674c --- /dev/null +++ b/meta/recipes-bsp/grub/files/0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch @@ -0,0 +1,50 @@ +From 3e1d2f1959acbe5152cdd5818d495f6455d1a158 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 8 Dec 2020 10:00:51 +0000 +Subject: [PATCH] disk/ldm: Fix memory leak on uninserted lv references + +The problem here is that the memory allocated to the variable lv is not +yet inserted into the list that is being processed at the label fail2. + +As we can already see at line 342, which correctly frees lv before going +to fail2, we should also be doing that at these earlier jumps to fail2. + +Fixes: CID 73824 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=156c281a1625dc73fd350530630c6f2d5673d4f6] +Signed-off-by: Marta Rybczynska +--- + grub-core/disk/ldm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 54713f4..e82e989 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -321,7 +321,10 @@ make_vg (grub_disk_t disk, + lv->visible = 1; + lv->segments = grub_zalloc (sizeof (*lv->segments)); + if (!lv->segments) +- goto fail2; ++ { ++ grub_free (lv); ++ goto fail2; ++ } + lv->segments->start_extent = 0; + lv->segments->type = GRUB_DISKFILTER_MIRROR; + lv->segments->node_count = 0; +@@ -329,7 +332,10 @@ make_vg (grub_disk_t disk, + lv->segments->nodes = grub_calloc (lv->segments->node_alloc, + sizeof (*lv->segments->nodes)); + if (!lv->segments->nodes) +- goto fail2; ++ { ++ grub_free (lv); ++ goto fail2; ++ } + ptr = vblk[i].dynamic; + if (ptr + *ptr + 1 >= vblk[i].dynamic + + sizeof (vblk[i].dynamic)) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index a8ee0dd68a..2fccdc2d62 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -64,6 +64,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \ file://0017-disk-ldm-If-failed-then-free-vg-variable-too.patch \ + file://0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4277 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79D14C433EF for ; Fri, 25 Feb 2022 14:27:40 +0000 (UTC) Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mx.groups.io with SMTP id smtpd.web09.6938.1645799260016664588 for ; Fri, 25 Feb 2022 06:27:40 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=f75lo3Su; spf=softfail (domain: sakoman.com, ip: 209.85.210.176, mailfrom: steve@sakoman.com) Received: by mail-pf1-f176.google.com with SMTP id i21so4786810pfd.13 for ; Fri, 25 Feb 2022 06:27:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=MNiFk+E4qJ7JRG2Vbbp5YSM8ZZsr/4/KtS9YxCMdlvg=; b=f75lo3SuTqeMof8I6kjbgaJOlM1Et+IyFvdE+x+SWwR8AYgTbdn7eJ9cntGcAiazxi vNGFSKbJS3k7Fc0wAEqCjronBz1UzWvkTjy0+KmF+qeWqDX1dgPkIo9syx3XhXaA09bW WlrtpDZangBintoO0ILtrrnRZMIOKod1gEpAV8pPg7sCh7glTK2aCTYKExIgkDvhmnl0 B/pXWm8bBNSHPMNQEUDEM9Q6NMFg1eV3LRond8dr9XWAyYAoruomrkAesgf3F0KB/42l 9L8pHQtRbHg7Twg5lNEm8pR0/r3eHpjpKJoDpfD+BcDpfXhfikI6J3Z4aiLgz+TB+qRb FW5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=MNiFk+E4qJ7JRG2Vbbp5YSM8ZZsr/4/KtS9YxCMdlvg=; b=kJDRcbUHZydFJuel2GgoH3x/ScII8YjYftwuvAVpXrxC2P0fzxkKaYRB6g389SK65T n08TqWfp5EkbP+/Yl1/mYkKaWzqfIT3svWbgxTAHr5DENgIV4shc0hQROIB1lU8Lboua ZFYc6JRSrYkiZrb5NUC7+khPTeJZopv2W42CGzqYSHYnEFTkdZ3k0uKnzR79SUJfyL/m Gpqd+oFaUgWCRBUWTcqqiIWZgv85RAVECTok/8iJ+Hi4CzTdRzZPh2OsAoYZC9+byis/ O+/OmCsFouFaZrzzGmgF9ZWzvoWl5x+3w2d6c7fmwp0pKUACzf/9Z0Xpx3KfpR93rn2J joXQ== X-Gm-Message-State: AOAM532tRf6H+c/LauazF9l1rzsW8cuOOvnUGW/BoEn1W0R2dAe6+tQk dmv+i2qJcSV2Rl2lRXOB8uXxYPB5NomTaiXp X-Google-Smtp-Source: ABdhPJxyTsejdHzJLkA2mG9Ln+GA15tTfXk33KnWI9i6k6OwnLbFOYL9u5RdR1Hy5Xyp3CIilVwx+g== X-Received: by 2002:a05:6a00:24ca:b0:4e1:cb76:32da with SMTP id d10-20020a056a0024ca00b004e1cb7632damr7734925pfv.81.1645799259088; Fri, 25 Feb 2022 06:27:39 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:38 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 23/50] grub: fix an integer overflow Date: Fri, 25 Feb 2022 04:26:03 -1000 Message-Id: <85405f0d3a4b844f7bbb34717bd5f88b81acb074.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162369 From: Marta Rybczynska This patch fixes a potential overflow in grub's disk/cryptodisk. It is a part of a security series [1] [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...odisk-Fix-potential-integer-overflow.patch | 50 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0019-disk-cryptodisk-Fix-potential-integer-overflow.patch diff --git a/meta/recipes-bsp/grub/files/0019-disk-cryptodisk-Fix-potential-integer-overflow.patch b/meta/recipes-bsp/grub/files/0019-disk-cryptodisk-Fix-potential-integer-overflow.patch new file mode 100644 index 0000000000..dd7fda357d --- /dev/null +++ b/meta/recipes-bsp/grub/files/0019-disk-cryptodisk-Fix-potential-integer-overflow.patch @@ -0,0 +1,50 @@ +From 2550aaa0c23fdf8b6c54e00c6b838f2e3aa81fe2 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 21 Jan 2021 11:38:31 +0000 +Subject: [PATCH] disk/cryptodisk: Fix potential integer overflow + +The encrypt and decrypt functions expect a grub_size_t. So, we need to +ensure that the constant bit shift is using grub_size_t rather than +unsigned int when it is performing the shift. + +Fixes: CID 307788 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=a201ad17caa430aa710654fdf2e6ab4c8166f031] +Signed-off-by: Marta Rybczynska +--- + grub-core/disk/cryptodisk.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 5037768..6883f48 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -311,10 +311,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, + case GRUB_CRYPTODISK_MODE_CBC: + if (do_encrypt) + err = grub_crypto_cbc_encrypt (dev->cipher, data + i, data + i, +- (1U << dev->log_sector_size), iv); ++ ((grub_size_t) 1 << dev->log_sector_size), iv); + else + err = grub_crypto_cbc_decrypt (dev->cipher, data + i, data + i, +- (1U << dev->log_sector_size), iv); ++ ((grub_size_t) 1 << dev->log_sector_size), iv); + if (err) + return err; + break; +@@ -322,10 +322,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, + case GRUB_CRYPTODISK_MODE_PCBC: + if (do_encrypt) + err = grub_crypto_pcbc_encrypt (dev->cipher, data + i, data + i, +- (1U << dev->log_sector_size), iv); ++ ((grub_size_t) 1 << dev->log_sector_size), iv); + else + err = grub_crypto_pcbc_decrypt (dev->cipher, data + i, data + i, +- (1U << dev->log_sector_size), iv); ++ ((grub_size_t) 1 << dev->log_sector_size), iv); + if (err) + return err; + break; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 2fccdc2d62..130f32551b 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -65,6 +65,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \ file://0017-disk-ldm-If-failed-then-free-vg-variable-too.patch \ file://0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch \ + file://0019-disk-cryptodisk-Fix-potential-integer-overflow.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4278 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79684C433F5 for ; Fri, 25 Feb 2022 14:27:44 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.web10.7071.1645799263553326301 for ; Fri, 25 Feb 2022 06:27:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Y1GwIoXb; spf=softfail (domain: sakoman.com, ip: 209.85.216.43, mailfrom: steve@sakoman.com) Received: by mail-pj1-f43.google.com with SMTP id ev16-20020a17090aead000b001bc3835fea8so4986168pjb.0 for ; Fri, 25 Feb 2022 06:27:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=DxxDZiJkw/acCsQwZeJVkECaLUvPDldCVJ4FHBLZonM=; b=Y1GwIoXbzTYPH1c+dBhIt7jIVHVIaIjXL4c1igKhYquVrAdSrp5LvRAFM/FuUCyCxe 30D36ymGHVCsb7VFT5EYKx4a22PudnjXJFlHwb7gob754PIu9pYQz7jVA162edsMPs47 0z8sKApSYMo8hdyxg40VmwR+7+uCUDDZrRkfxOfgoTc0z18eicZRu6ITbHY8cUiImfT3 9SdyWsPj0dcG1L9PY9kJ/NM0eqMlktJkQfbPkcnvRJLU9XaNPfzd1vHSk+TkazCJSiVp 5b17PH2PFaz/eGoRLt1tJj7ouhXE1EfiykWtX16Q7fL2peE74wIR3lWrKIv44YfhwJ9u /e5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=DxxDZiJkw/acCsQwZeJVkECaLUvPDldCVJ4FHBLZonM=; b=dcX04Y4KLJFKSBO0pt+namMLCalzaMsazRkldNYcJHjwGm/GBrnpSBjl1O30XXL57i 9RpA9VmHU1FyeOE09XkWsPjCgRpUJjuE7cLy8XpfRt+9XmV5iF67MBsxfzQmy5U9FN7h 4jdTtz34nD0a1aZ+wQE7MS2o8g6kk3S1TUN49Yujit6Wd+dX83QPyBk3BoEQpMOZZAWI 343afF2fXq1X4LIFZgLEUZatJgdcLdGvTw5JfphM5jj2w3glklJGcpdx4zSt/ut1HEdP YivKRNbWWNQTep6aQTLjuXU4SYfLyrpmqvd4c7oymKVc5+yIpUyAwpHGIyfEBZ5kkxcq zqUw== X-Gm-Message-State: AOAM531cOhPfysUyDRls+GpJAJC/4uRW3bQYCz9ybJD4sWOHSfXS5vW1 oKkZcOLauAQK9kYpYF+tcyYs1e+PutFiMBPn X-Google-Smtp-Source: ABdhPJyqZZjPQBqjyqZbiKXoAh5+2yyvexk371RakQILgldweoSt+vdQvFxbVwavy3g9/C2AO8qp+Q== X-Received: by 2002:a17:90b:1713:b0:1bc:3eca:627c with SMTP id ko19-20020a17090b171300b001bc3eca627cmr3398754pjb.144.1645799262452; Fri, 25 Feb 2022 06:27:42 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:41 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 24/50] grub: add a fix for a length check Date: Fri, 25 Feb 2022 04:26:04 -1000 Message-Id: <29470a74b944921641cd5d84b88c359acba26ad4.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162370 From: Marta Rybczynska This patch adds a fix for a volume name length check in grub's hfsplus. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...that-the-volume-name-length-is-valid.patch | 43 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch diff --git a/meta/recipes-bsp/grub/files/0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch b/meta/recipes-bsp/grub/files/0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch new file mode 100644 index 0000000000..eb459c547f --- /dev/null +++ b/meta/recipes-bsp/grub/files/0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch @@ -0,0 +1,43 @@ +From 7c1813eeec78892fa651046cc224ae4e80d0c94d Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 23 Oct 2020 17:09:31 +0000 +Subject: [PATCH] hfsplus: Check that the volume name length is valid + +HFS+ documentation suggests that the maximum filename and volume name is +255 Unicode characters in length. + +So, when converting from big-endian to little-endian, we should ensure +that the name of the volume has a length that is between 0 and 255, +inclusive. + +Fixes: CID 73641 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2298f6e0d951251bb9ca97d891d1bc8b74515f8c] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/hfsplus.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index dae43be..03c3c4c 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -1007,6 +1007,15 @@ grub_hfsplus_label (grub_device_t device, char **label) + grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr); + + label_len = grub_be_to_cpu16 (catkey->namelen); ++ ++ /* Ensure that the length is >= 0. */ ++ if (label_len < 0) ++ label_len = 0; ++ ++ /* Ensure label length is at most 255 Unicode characters. */ ++ if (label_len > 255) ++ label_len = 255; ++ + label_name = grub_calloc (label_len, sizeof (*label_name)); + if (!label_name) + { diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 130f32551b..3c5274fd96 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -66,6 +66,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0017-disk-ldm-If-failed-then-free-vg-variable-too.patch \ file://0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch \ file://0019-disk-cryptodisk-Fix-potential-integer-overflow.patch \ + file://0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4279 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B687C433F5 for ; Fri, 25 Feb 2022 14:27:46 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.web09.6940.1645799266133441620 for ; Fri, 25 Feb 2022 06:27:46 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=YK7SVqXl; spf=softfail (domain: sakoman.com, ip: 209.85.214.181, mailfrom: steve@sakoman.com) Received: by mail-pl1-f181.google.com with SMTP id e13so4962549plh.3 for ; Fri, 25 Feb 2022 06:27:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=fGnPFmoilQaM2FP9RwblpfFoJaSJBxXu/BvgTrXqG1M=; b=YK7SVqXlLasMVxSekbaNejIE+aYbsjAceZ9LgsSstitzUZn2koy169aObr9aMzIb41 LpuJ3kwRl4/R1b2tHQzbRyzrQce5jddajJxrA5L4M0j+YWMa6VcR0nzqEs0PRXu2POoE gG3xb9c0/dIz5JmhWI3jRdi3kIRZiUlDdm6i84W0nXYB5zeE4bmCE+2fnYw3gGJEdpCD 1hoYnDDyhkcObyGCEa2aZtTmVIuiXmrhSeKU4BS+WuxzXZHWH5eLZgqzCmorcwh2GnV5 zyCxMQS0hZcChEgAtEP6DZzhkt56b/JvLUR8m2jj1z0p486mzjbFAceIvfKyBXj3uUDw TmHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=fGnPFmoilQaM2FP9RwblpfFoJaSJBxXu/BvgTrXqG1M=; b=dqH7wEKLGDWJuq5NSiweB5Ph7cajZbJoNHfg8xN3ywd70sMIHx2MyyPTNPfdMnulJr 9dzMMPJsbZy3D2XUM6DZXL60Fq5HmFq+ZwTEdKGGGqowVgNIsAv9Kl63Bj7rD3yWliOz FXwnNQraeZvz4vwcz/5n/w/qgQ8Sj78BpXFsBaXKUMnnT0gPKlDK4PSVVT0CIZbtcMeJ +kIjoAPmPxgY1dgj2KXcvQrFqDI46pSqI232gosRZmuBFPmnwkOS7g9ke6RK4LTiCnDv h/JzpHQcyxO3Qwd3PZ3zXsnVE9pEiOFXo10iN4rQ3F+/gt/KNxi3+uzBoBCfPTWp/oAn KvaQ== X-Gm-Message-State: AOAM532rZ0SBV4Y8fUAxyO2IyPYusgDnxsCt9yro2zWuZF0UrT9tZJrg Tcjn8w1f53HJiUceru29hJw8qOY2T4x+QaB7 X-Google-Smtp-Source: ABdhPJw948huytVkaEhIIbNTMSsvDUImd3THd/0JYBic7UjjdUyoWcTtKss9p9aRLqrRBW0FKsO+vQ== X-Received: by 2002:a17:90a:528b:b0:1bc:c5f9:82a with SMTP id w11-20020a17090a528b00b001bcc5f9082amr3417076pjh.210.1645799265079; Fri, 25 Feb 2022 06:27:45 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:44 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 25/50] grub: add a fix for a possible negative shift Date: Fri, 25 Feb 2022 04:26:05 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162371 From: Marta Rybczynska This patch adds a fix for a possible negative shift in grub's zfs. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ix-possible-negative-shift-operation.patch | 42 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0021-zfs-Fix-possible-negative-shift-operation.patch diff --git a/meta/recipes-bsp/grub/files/0021-zfs-Fix-possible-negative-shift-operation.patch b/meta/recipes-bsp/grub/files/0021-zfs-Fix-possible-negative-shift-operation.patch new file mode 100644 index 0000000000..12418858f9 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0021-zfs-Fix-possible-negative-shift-operation.patch @@ -0,0 +1,42 @@ +From c757779e5d09719666c3b155afd2421978a107bd Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 24 Nov 2020 16:41:49 +0000 +Subject: [PATCH] zfs: Fix possible negative shift operation + +While it is possible for the return value from zfs_log2() to be zero +(0), it is quite unlikely, given that the previous assignment to blksz +is shifted up by SPA_MINBLOCKSHIFT (9) before 9 is subtracted at the +assignment to epbs. + +But, while unlikely during a normal operation, it may be that a carefully +crafted ZFS filesystem could result in a zero (0) value to the +dn_datalbkszsec field, which means that the shift left does nothing +and assigns zero (0) to blksz, resulting in a negative epbs value. + +Fixes: CID 73608 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=a02091834d3e167320d8a262ff04b8e83c5e616d] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/zfs/zfs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 36d0373..0c42cba 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -2667,6 +2667,11 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type, + blksz = grub_zfs_to_cpu16 (mdn->dn.dn_datablkszsec, + mdn->endian) << SPA_MINBLOCKSHIFT; + epbs = zfs_log2 (blksz) - DNODE_SHIFT; ++ ++ /* While this should never happen, we should check that epbs is not negative. */ ++ if (epbs < 0) ++ epbs = 0; ++ + blkid = objnum >> epbs; + idx = objnum & ((1 << epbs) - 1); + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 3c5274fd96..360e86685b 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -67,6 +67,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0018-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch \ file://0019-disk-cryptodisk-Fix-potential-integer-overflow.patch \ file://0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch \ + file://0021-zfs-Fix-possible-negative-shift-operation.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4280 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A10DC433F5 for ; Fri, 25 Feb 2022 14:27:49 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.web10.7074.1645799268565479172 for ; Fri, 25 Feb 2022 06:27:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Rgv+wp21; spf=softfail (domain: sakoman.com, ip: 209.85.215.170, mailfrom: steve@sakoman.com) Received: by mail-pg1-f170.google.com with SMTP id 12so4835548pgd.0 for ; Fri, 25 Feb 2022 06:27:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=6IEfsP6tnfxlyz1yicSEulfAJxBLkCOgheOwjUbxRTA=; b=Rgv+wp219qHysZz5ecpkutJoa06ezaGc0DGe+1oaB3btGHYJr0KBIAwX//So7CHX9i ofp2PPgLs73vgo9xALUws8AtfurPjdBFD+QtwC394rfW0RDv03TYBhGrnTi5KgKb/ISj O87sDoH6Vdbu/KzSlxn4H809pTGb6vfDeOXOxB3RMlDrH+F9vX6HoAK+Fdm8BupTru0m 0u7VcI4BGd2BmOvvzchB+2T/FBLmWo0RhrLTAIQhSHuT9KmxEWrjxJ66SAx0DH4SxSNF eX8XtG2/wA6BnDT4oJhngDwf6INvbWzcSZgH4+FLqrQviBmxLV02PwAKl4EcBU+V1UQ6 epTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=6IEfsP6tnfxlyz1yicSEulfAJxBLkCOgheOwjUbxRTA=; b=rxRcctL73Jc859iBN7jteBmzmp6WdmW9Kox2bl9/EunErBa/m5PI113Y2ejJ7bWM6e aBpQ+yuhnLSf6H9ZRjat45hzLyW9y2+AaVYXAdxfVX8gnqMgn1LqKn138ZEgMoEOtOAu KuTAr7t5o36DUXQXgFhH92AOI59ovRta9ABwlHoSTgXg1KXCIaMQZVRyKJN7YozHXeEV qURQvPZUppSE7Wi01XZ8g7fguVtdhT3KMj5MRWhQ8O2Sqwef4E/P+W6UNOf9As1lVKLr 75BROKWoiygj/colRBqpfLA3xa9IKfscS1FM1MktI0vad/SdFAyOidfudHCPttZkaOt9 qGTw== X-Gm-Message-State: AOAM530UeZsWSaAZY5owqmWCkjdfciZZCwjSyxqNIPB7lO8wL66DSsew wruhyhayh4kFteoGheB5GBcYF/z/N9RZ/8Qp X-Google-Smtp-Source: ABdhPJwCXcJyrNL9Jytj7ludyA8bBejIwyy982Y8tQP9lT3xO947LgMR/Bx3tOMfJN2/od8+bt9wtg== X-Received: by 2002:a62:7c41:0:b0:4e1:3185:cb21 with SMTP id x62-20020a627c41000000b004e13185cb21mr8067619pfc.82.1645799267539; Fri, 25 Feb 2022 06:27:47 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:46 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 26/50] grub: add a fix for a memory leak Date: Fri, 25 Feb 2022 04:26:06 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162372 From: Marta Rybczynska This patch adds a fix for a memory leak in grub's path construction in zfs. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...source-leaks-while-constructing-path.patch | 121 ++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 122 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0022-zfs-Fix-resource-leaks-while-constructing-path.patch diff --git a/meta/recipes-bsp/grub/files/0022-zfs-Fix-resource-leaks-while-constructing-path.patch b/meta/recipes-bsp/grub/files/0022-zfs-Fix-resource-leaks-while-constructing-path.patch new file mode 100644 index 0000000000..5ded5520e9 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0022-zfs-Fix-resource-leaks-while-constructing-path.patch @@ -0,0 +1,121 @@ +From 83fdffc07ec4586b375ab36189f255ffbd8f99c2 Mon Sep 17 00:00:00 2001 +From: Paulo Flabiano Smorigo +Date: Mon, 14 Dec 2020 18:54:49 -0300 +Subject: [PATCH] zfs: Fix resource leaks while constructing path + +There are several exit points in dnode_get_path() that are causing possible +memory leaks. + +In the while(1) the correct exit mechanism should not be to do a direct return, +but to instead break out of the loop, setting err first if it is not already set. + +The reason behind this is that the dnode_path is a linked list, and while doing +through this loop, it is being allocated and built up - the only way to +correctly unravel it is to traverse it, which is what is being done at the end +of the function outside of the loop. + +Several of the existing exit points correctly did a break, but not all so this +change makes that more consistent and should resolve the leaking of memory as +found by Coverity. + +Fixes: CID 73741 + +Signed-off-by: Paulo Flabiano Smorigo +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=89bdab965805e8d54d7f75349024e1a11cbe2eb8] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/zfs/zfs.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 0c42cba..9087a72 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -2836,8 +2836,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + + if (dnode_path->dn.dn.dn_type != DMU_OT_DIRECTORY_CONTENTS) + { +- grub_free (path_buf); +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory")); ++ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a directory")); ++ break; + } + err = zap_lookup (&(dnode_path->dn), cname, &objnum, + data, subvol->case_insensitive); +@@ -2879,11 +2879,18 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + << SPA_MINBLOCKSHIFT); + + if (blksz == 0) +- return grub_error(GRUB_ERR_BAD_FS, "0-sized block"); ++ { ++ err = grub_error (GRUB_ERR_BAD_FS, "0-sized block"); ++ break; ++ } + + sym_value = grub_malloc (sym_sz); + if (!sym_value) +- return grub_errno; ++ { ++ err = grub_errno; ++ break; ++ } ++ + for (block = 0; block < (sym_sz + blksz - 1) / blksz; block++) + { + void *t; +@@ -2893,7 +2900,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + if (err) + { + grub_free (sym_value); +- return err; ++ break; + } + + movesize = sym_sz - block * blksz; +@@ -2903,6 +2910,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + grub_memcpy (sym_value + block * blksz, t, movesize); + grub_free (t); + } ++ if (err) ++ break; + free_symval = 1; + } + path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); +@@ -2911,7 +2920,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + grub_free (oldpathbuf); + if (free_symval) + grub_free (sym_value); +- return grub_errno; ++ err = grub_errno; ++ break; + } + grub_memcpy (path, sym_value, sym_sz); + if (free_symval) +@@ -2949,11 +2959,12 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + + err = zio_read (bp, dnode_path->dn.endian, &sahdrp, NULL, data); + if (err) +- return err; ++ break; + } + else + { +- return grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt"); ++ err = grub_error (GRUB_ERR_BAD_FS, "filesystem is corrupt"); ++ break; + } + + hdrsize = SA_HDR_SIZE (((sa_hdr_phys_t *) sahdrp)); +@@ -2974,7 +2985,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + if (!path_buf) + { + grub_free (oldpathbuf); +- return grub_errno; ++ err = grub_errno; ++ break; + } + grub_memcpy (path, sym_value, sym_sz); + path [sym_sz] = 0; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 360e86685b..1630235edd 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -68,6 +68,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0019-disk-cryptodisk-Fix-potential-integer-overflow.patch \ file://0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch \ file://0021-zfs-Fix-possible-negative-shift-operation.patch \ + file://0022-zfs-Fix-resource-leaks-while-constructing-path.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4281 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BAB6C433EF for ; Fri, 25 Feb 2022 14:27:51 +0000 (UTC) Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by mx.groups.io with SMTP id smtpd.web08.6795.1645799270717650099 for ; Fri, 25 Feb 2022 06:27:50 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=iWczxnIE; spf=softfail (domain: sakoman.com, ip: 209.85.210.180, mailfrom: steve@sakoman.com) Received: by mail-pf1-f180.google.com with SMTP id g1so4833140pfv.1 for ; Fri, 25 Feb 2022 06:27:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=7KNAqP7de0bBVkhdAWYfQWUCpUuyo6VZmANyRf49S1g=; b=iWczxnIEwJ16ORlcoWxWeLut+sImYjAWXH914BqsowobGEYqJ4lritPQSE7Fp4bWCo 6vcZqOIERvyJXN4H7CEaTCiQIfXxY8nZ/CZKUwFPHyDmyAcngH7P22cLCML91OfWNsXS /TVJO7GDvxDRGw0V+++PoTG54gvbc57EXPUSjfnn+F7a0N7A+KnmFxLq7VqdcHnRgdZp TsmjVnJIfy8VkZt+Pad0GcHGIIY0fMcAESVn0yCvzTUpNY6MD6+cj9yAlOfoYGo1b4us nqT+dOWh/6o/ZwhMoL7n6i4y1oNjv9yEoMshjI8BMveAB37VUVqcsikkIvlFlCJBxwea qWSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=7KNAqP7de0bBVkhdAWYfQWUCpUuyo6VZmANyRf49S1g=; b=d3MGsX9bpIesVjMRX9cWvTGSa3E/Z29wjnu5ybOgjZaLOilJdYjbiqHnWJ5WnQZvgD QgNea3ZvQIQ0eRlN0rm1A9waqrCagbMnEWUTTHDsxZarfMtQKyusNXboOXeGBmDEuPWX 3KGRNWTvau0WBAUkrF2VwPLR+I1zDn/29mkxtcy9AWsEjpaATRVvVHdBGQeE+22n88s9 D8VK2iR7Gs36AAZIVCuEsVWfYKuhMvm1wmayHWLeYiVqrDrf/1O7/wN2xfrhDxwvm3rN BB9s8QNcIBI+tJsLWbNA/Ki85Ugk3JtGnsSI7A5zS57yIKur+GpO0TbICjJVfP7Ffo3X rcDw== X-Gm-Message-State: AOAM5301BqmaBth08udjBvRj5TYa3iF6rEE7o1aerhGofPnAac70jYcf BtIzW+8Fzhop/wHdhpJIx5nivvK3quRUD6b9 X-Google-Smtp-Source: ABdhPJz8Tlyo8SDjCrNmnggfJZ50bHukJ9iAVoPn3LhPcF6eVQflTJoY2IOWQMMehx4MrUaMPDH1kw== X-Received: by 2002:a05:6a00:139e:b0:4f1:37e5:c350 with SMTP id t30-20020a056a00139e00b004f137e5c350mr8049046pfg.27.1645799269647; Fri, 25 Feb 2022 06:27:49 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:49 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 27/50] grub: add a fix for possible integer overflows Date: Fri, 25 Feb 2022 04:26:07 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162373 From: Marta Rybczynska This patch adds a fix for a possible integer overflows in grub's zfs. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...3-zfs-Fix-possible-integer-overflows.patch | 56 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0023-zfs-Fix-possible-integer-overflows.patch diff --git a/meta/recipes-bsp/grub/files/0023-zfs-Fix-possible-integer-overflows.patch b/meta/recipes-bsp/grub/files/0023-zfs-Fix-possible-integer-overflows.patch new file mode 100644 index 0000000000..8df758b41f --- /dev/null +++ b/meta/recipes-bsp/grub/files/0023-zfs-Fix-possible-integer-overflows.patch @@ -0,0 +1,56 @@ +From ec35d862f3567671048aa0d0d8ad1ded1fd25336 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 8 Dec 2020 22:17:04 +0000 +Subject: [PATCH] zfs: Fix possible integer overflows + +In all cases the problem is that the value being acted upon by +a left-shift is a 32-bit number which is then being used in the +context of a 64-bit number. + +To avoid overflow we ensure that the number being shifted is 64-bit +before the shift is done. + +Fixes: CID 73684, CID 73695, CID 73764 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=302c12ff5714bc455949117c1c9548ccb324d55b] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/zfs/zfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 9087a72..b078ccc 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -564,7 +564,7 @@ find_bestub (uberblock_phys_t * ub_array, + ubptr = (uberblock_phys_t *) ((grub_properly_aligned_t *) ub_array + + ((i << ub_shift) + / sizeof (grub_properly_aligned_t))); +- err = uberblock_verify (ubptr, offset, 1 << ub_shift); ++ err = uberblock_verify (ubptr, offset, (grub_size_t) 1 << ub_shift); + if (err) + { + grub_errno = GRUB_ERR_NONE; +@@ -1543,7 +1543,7 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc, + + high = grub_divmod64 ((offset >> desc->ashift) + c, + desc->n_children, &devn); +- csize = bsize << desc->ashift; ++ csize = (grub_size_t) bsize << desc->ashift; + if (csize > len) + csize = len; + +@@ -1635,8 +1635,8 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc, + + while (len > 0) + { +- grub_size_t csize; +- csize = ((s / (desc->n_children - desc->nparity)) ++ grub_size_t csize = s; ++ csize = ((csize / (desc->n_children - desc->nparity)) + << desc->ashift); + if (csize > len) + csize = len; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 1630235edd..9158fc7f50 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -69,6 +69,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0020-hfsplus-Check-that-the-volume-name-length-is-valid.patch \ file://0021-zfs-Fix-possible-negative-shift-operation.patch \ file://0022-zfs-Fix-resource-leaks-while-constructing-path.patch \ + file://0023-zfs-Fix-possible-integer-overflows.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4282 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CCF7C433F5 for ; Fri, 25 Feb 2022 14:27:53 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.web12.6900.1645799272848162178 for ; Fri, 25 Feb 2022 06:27:52 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=ORfXhnpd; spf=softfail (domain: sakoman.com, ip: 209.85.216.53, mailfrom: steve@sakoman.com) Received: by mail-pj1-f53.google.com with SMTP id h17-20020a17090acf1100b001bc68ecce4aso8568068pju.4 for ; Fri, 25 Feb 2022 06:27:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=mT+RrHO+HGc69wyWwuuwhbYFrcGBZZ9vJtHTzqxpw+0=; b=ORfXhnpdYoiP/K1TY1wefbjyEO1e2nF0qhmwLc3WZp4zDwvaYoGJGsakVt51qwXdEZ q0JdinJQIt5/bJS5DfAFNr4oqm86SV0zB3/6Me1e+A0oQerGyF18fsVOzHA9lRBLZKI6 zV9loS4vfU6mIqEt/GBqq8VZsf1yeIEVNwByw/d6Z1/L5Gz7QNiUuWbjCe/lGhUovN7J sT2H0oKRE7rhwUJPl5x5fwuppji/cxl7g1fl8jg3N6SF2sDbOnprZ04hD1pPf8s5SaZy z6+BPsMZF5aEgi0dAQo+EAlaYI2obHADpzXn46JyopdaywFZkXtepUWaPen4G4XHwDg5 glfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=mT+RrHO+HGc69wyWwuuwhbYFrcGBZZ9vJtHTzqxpw+0=; b=sg0Z8eSH8eHK83iAiBFcQlS+jxhVljc8f/t8nQPSl/cwqSCzoNMfVcFR20leM/Kk52 UW201orh0jW9roIhYYVrLtDh35/W5ak6SVUKyGPSsuG5edTVF2JjK5MEP5SaF8BpmodJ M9NL2VsgSH3dVF0dbSFEGf32Jn/fh+EW/M9g+gMy8QNHeesv91XsZqT3YssypYMG76Kc cA+kADAqr8Y5PlHUXa8qXj/oIx9u0Ms/FpVKWvAYIbgAI8fNR1czC/+TaZqenvHoEhA8 eEYb52Y3eHKXYtONj2iYYXkQyOH6WtSBF5ZYrBH5ZmVuCHKA7tYJLqcczRzOCvznb9gx 6D8Q== X-Gm-Message-State: AOAM530gVF0ietINZUZGFu4PtDrMgTl++iceTXeIOh3dLyrGpq3DP0BQ u4b86QY2LicRI1MHwyekpUSSxF3W3XGDndtp X-Google-Smtp-Source: ABdhPJwxWEg0I5ai7HK/HU04Qua0knB4u7jnIIb9Cz58pjit2pizyWoh/KobpHZi99XR0IxgspT+Fw== X-Received: by 2002:a17:903:2041:b0:14f:b0a6:18f5 with SMTP id q1-20020a170903204100b0014fb0a618f5mr7834159pla.50.1645799271756; Fri, 25 Feb 2022 06:27:51 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:51 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 28/50] grub: fix an error check Date: Fri, 25 Feb 2022 04:26:08 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162374 From: Marta Rybczynska This patch fixes an error check in grub's zfsinfo. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...-a-check-for-error-allocating-memory.patch | 35 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch diff --git a/meta/recipes-bsp/grub/files/0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch b/meta/recipes-bsp/grub/files/0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch new file mode 100644 index 0000000000..555dc19168 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch @@ -0,0 +1,35 @@ +From b085da8efda9b81f94aa197ee045226563554fdf Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 26 Nov 2020 10:56:45 +0000 +Subject: [PATCH] zfsinfo: Correct a check for error allocating memory + +While arguably the check for grub_errno is correct, we should really be +checking the return value from the function since it is always possible +that grub_errno was set elsewhere, making this code behave incorrectly. + +Fixes: CID 73668 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7aab03418ec6a9b991aa44416cb2585aff4e7972] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/zfs/zfsinfo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/zfs/zfsinfo.c b/grub-core/fs/zfs/zfsinfo.c +index c8a28ac..bf29180 100644 +--- a/grub-core/fs/zfs/zfsinfo.c ++++ b/grub-core/fs/zfs/zfsinfo.c +@@ -358,8 +358,8 @@ grub_cmd_zfs_bootfs (grub_command_t cmd __attribute__ ((unused)), int argc, + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected")); + + devname = grub_file_get_device_name (args[0]); +- if (grub_errno) +- return grub_errno; ++ if (devname == NULL) ++ return GRUB_ERR_OUT_OF_MEMORY; + + dev = grub_device_open (devname); + grub_free (devname); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 9158fc7f50..a660c069db 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -70,6 +70,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0021-zfs-Fix-possible-negative-shift-operation.patch \ file://0022-zfs-Fix-resource-leaks-while-constructing-path.patch \ file://0023-zfs-Fix-possible-integer-overflows.patch \ + file://0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4283 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DE05C433EF for ; Fri, 25 Feb 2022 14:27:55 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.web11.6925.1645799274954503757 for ; Fri, 25 Feb 2022 06:27:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=sfKGzLAX; spf=softfail (domain: sakoman.com, ip: 209.85.215.179, mailfrom: steve@sakoman.com) Received: by mail-pg1-f179.google.com with SMTP id t14so1864772pgr.3 for ; Fri, 25 Feb 2022 06:27:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=oe5Oa5nkex5THWKsGDQRT7l00B/23k/RrVBbkJUUlEU=; b=sfKGzLAX9wI/T+pPnPiPg772wr3DRbYVZifMG5iy15Fk36iK353rVYFKRs45OuEeUy +KM5n+sFgdTuAD/u4O30nPmmNubKqPi6U/QEvLtMTUU3wxFBn0Es5XAL7fBJ4mkFedG+ ScxkOAG2nTpMK3xQie3QW2wxIuu1vI5Ak3diIH2tsteokJmNTWF/PzmWYS9awEic2Amv kXQaP9TG3JuFtf6YU/CariZzTfGOVk965FxKAemrxSlDUUz+10m3fVdbdAAbmXAKb3zX aCg+WG/lht9kWGv7JazgUvGgdLAhbrUZVQdktGE37w0kD3IybBzg2rLXrKFaWnopT8y9 KoOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oe5Oa5nkex5THWKsGDQRT7l00B/23k/RrVBbkJUUlEU=; b=vn25En8BSbNhONxdouO/85UljFJrV8udCWFwTAgkrXU1n2OGgzLCGOpqr/P8ENlZE9 0z9lDiGJugI7Ncnkd0hXeEQzmiv5CklbqIg99Yt0WpNld3Td+iREPFMRzteFFiSO0n4s KFyynO8WbUMKYsKtUpWW0ffarnJ9BoQo7k1ZkfVZKBjsSdwt8KWk2LP2ajEzG3pkpJc3 qXsv18t83/WMBCTnkoGz8v6Pmch/ii1fB7d8E23ruE4K8DSow+ES5ZigwjGiR5ciEY3L tJGIWVojUTTDNTN+WZ7cpn2MePwXUST+OVgJW3Vh9gZJD/SXkR40QghncY6gso6YLArV NahQ== X-Gm-Message-State: AOAM530RTkRt6XrbIZIgwGic1R3UWXgZI47FBPYHUzLBsNRmjuNM0JFm 7QmY+AI2hcaaHXlrEzZlIbbm0oxWcjj4QL3z X-Google-Smtp-Source: ABdhPJwKx8qO2ZZGaToV06L14dVEAdaRRqSR9t0xNWHBUI43lZmrc4aPSHo8Y5nalVu15amzdYkkRw== X-Received: by 2002:a63:d74f:0:b0:374:5bda:909d with SMTP id w15-20020a63d74f000000b003745bda909dmr6252538pgi.215.1645799273929; Fri, 25 Feb 2022 06:27:53 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:53 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 29/50] grub: add a fix for a memory leak Date: Fri, 25 Feb 2022 04:26:09 -1000 Message-Id: <95d61effb17a6f11abbaec6ba48cb3fa4926efb0.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162375 From: Marta Rybczynska This patch fixes a memory leak in grub's affs. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- .../files/0025-affs-Fix-memory-leaks.patch | 82 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0025-affs-Fix-memory-leaks.patch diff --git a/meta/recipes-bsp/grub/files/0025-affs-Fix-memory-leaks.patch b/meta/recipes-bsp/grub/files/0025-affs-Fix-memory-leaks.patch new file mode 100644 index 0000000000..435130516c --- /dev/null +++ b/meta/recipes-bsp/grub/files/0025-affs-Fix-memory-leaks.patch @@ -0,0 +1,82 @@ +From 929c2ce8214c53cb95abff57a89556cd18444097 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 26 Nov 2020 12:48:07 +0000 +Subject: [PATCH] affs: Fix memory leaks + +The node structure reference is being allocated but not freed if it +reaches the end of the function. If any of the hooks had returned +a non-zero value, then node would have been copied in to the context +reference, but otherwise node is not stored and should be freed. + +Similarly, the call to grub_affs_create_node() replaces the allocated +memory in node with a newly allocated structure, leaking the existing +memory pointed by node. + +Finally, when dir->parent is set, then we again replace node with newly +allocated memory, which seems unnecessary when we copy in the values +from dir->parent immediately after. + +Fixes: CID 73759 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=178ac5107389f8e5b32489d743d6824a5ebf342a] +Signed-off-by: Marta Rybczynska +--- + grub-core/fs/affs.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index 220b371..230e26a 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -400,12 +400,12 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir, + { + unsigned int i; + struct grub_affs_file file; +- struct grub_fshelp_node *node = 0; ++ struct grub_fshelp_node *node, *orig_node; + struct grub_affs_data *data = dir->data; + grub_uint32_t *hashtable; + + /* Create the directory entries for `.' and `..'. */ +- node = grub_zalloc (sizeof (*node)); ++ node = orig_node = grub_zalloc (sizeof (*node)); + if (!node) + return 1; + +@@ -414,9 +414,6 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir, + return 1; + if (dir->parent) + { +- node = grub_zalloc (sizeof (*node)); +- if (!node) +- return 1; + *node = *dir->parent; + if (hook ("..", GRUB_FSHELP_DIR, node, hook_data)) + return 1; +@@ -456,17 +453,18 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir, + + if (grub_affs_create_node (dir, hook, hook_data, &node, &hashtable, + next, &file)) +- return 1; ++ { ++ /* Node has been replaced in function. */ ++ grub_free (orig_node); ++ return 1; ++ } + + next = grub_be_to_cpu32 (file.next); + } + } + +- grub_free (hashtable); +- return 0; +- + fail: +- grub_free (node); ++ grub_free (orig_node); + grub_free (hashtable); + return 0; + } diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index a660c069db..13e2b1600d 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -71,6 +71,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0022-zfs-Fix-resource-leaks-while-constructing-path.patch \ file://0023-zfs-Fix-possible-integer-overflows.patch \ file://0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch \ + file://0025-affs-Fix-memory-leaks.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4284 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DDCBC433EF for ; Fri, 25 Feb 2022 14:27:58 +0000 (UTC) Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by mx.groups.io with SMTP id smtpd.web08.6796.1645799277727009662 for ; Fri, 25 Feb 2022 06:27:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=n27W9H+M; spf=softfail (domain: sakoman.com, ip: 209.85.210.181, mailfrom: steve@sakoman.com) Received: by mail-pf1-f181.google.com with SMTP id x18so4819260pfh.5 for ; Fri, 25 Feb 2022 06:27:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=35w9N6PzfzO3X/ru84lKTxONi2CNnoFoRgWUrYeAR+E=; b=n27W9H+MEFZASLtbum1qpBlrT21sfns9yaEx2ud57eVnK8mVbKq9iHHMRCai2V9xEq dIe17jWSF8rvnSn2ecm+b1VEVsS56RS4EzcTfLccRLkdu/rvaN0dcKi4dW37hAD2Eh// O8t1KXB6hZJXkZbXqMcm9n3LoNUmslG3MQGt7Xnzi9HV2q/Q0GcH2ylG/MrlMCSVstvj AveSfZBGBmSP1xVXLiWES3Z8IragWHy02GyTt7irDNAnrNc1wL63/pLGWKGiM9QJvIDW gBXT6ix8e7np1hdGuqh37LNzxMbnS4yKCpqNneSDB/l2dy24rPHzBurKHBmxX1ekgZXa 793w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=35w9N6PzfzO3X/ru84lKTxONi2CNnoFoRgWUrYeAR+E=; b=qcSq4yKWEgtKniCUWLUryVe4n5PLhW0a+LDCsbapKgotcIPBP1ubbmQEvoK17tKedQ ekd5be5bYc9nTKhCU9XdhJF6Zeb1dVVNrZGRre/AWOmqY8gTAjJ/VHmfT7knMWlo1/xd /2DXuVYXRRYfxGNTeS/Se0ekz62EbqjYIrBvQOwrn9W+vKW63ewMUP7Hq/EmdTX6EIuU y/PuwS1sIaPm/6k8l/btNEdfP11f0PwTKkbVNcEHou5BO/T2h6t704GEbG2MyS31Ie9L vVosLXvYqQLNOQ0CJl7ZBPPQrr0GS/i/BvEnYAn2kmodjbkGJHWIKIpExu77B8KQYqZd M7rw== X-Gm-Message-State: AOAM532C7xHr00YBVs3wpkTwnty0OBgEVZGdD9hZT+/1wQw82rWuO1m0 1U7I+AS/h6LBStx9fBa7F2WDnc+YBGAGlmLr X-Google-Smtp-Source: ABdhPJyxlPVnmqd5HwWCXYDgllSyWWzQA+tV8VJDqN9jDgB7XqFe1ne1vUP8VfJwQ+Bzc2e76iYa6w== X-Received: by 2002:a05:6a00:3018:b0:4e1:de9a:a5a3 with SMTP id ay24-20020a056a00301800b004e1de9aa5a3mr8002832pfb.80.1645799276815; Fri, 25 Feb 2022 06:27:56 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:56 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 30/50] grub: add a fix for a possible unintended sign extension Date: Fri, 25 Feb 2022 04:26:10 -1000 Message-Id: <69f6ae604b857eea93022d73fad668df07a7a056.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:27:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162376 From: Marta Rybczynska This patch fixes a possible unintended sign extension in grub's libgcrypt/mpi. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...x-possible-unintended-sign-extension.patch | 36 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch diff --git a/meta/recipes-bsp/grub/files/0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch b/meta/recipes-bsp/grub/files/0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch new file mode 100644 index 0000000000..f500f1a296 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch @@ -0,0 +1,36 @@ +From 9b16d7bcad1c7fea7f26eb2fb3af1a5ca70ba34e Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 3 Nov 2020 16:43:37 +0000 +Subject: [PATCH] libgcrypt/mpi: Fix possible unintended sign extension + +The array of unsigned char gets promoted to a signed 32-bit int before +it is finally promoted to a size_t. There is the possibility that this +may result in the signed-bit being set for the intermediate signed +32-bit int. We should ensure that the promotion is to the correct type +before we bitwise-OR the values. + +Fixes: CID 96697 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=e8814c811132a70f9b55418f7567378a34ad3883] +Signed-off-by: Marta Rybczynska + +--- + grub-core/lib/libgcrypt/mpi/mpicoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c +index a3435ed..7ecad27 100644 +--- a/grub-core/lib/libgcrypt/mpi/mpicoder.c ++++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c +@@ -458,7 +458,7 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, + if (len && len < 4) + return gcry_error (GPG_ERR_TOO_SHORT); + +- n = (s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]); ++ n = ((size_t)s[0] << 24 | (size_t)s[1] << 16 | (size_t)s[2] << 8 | (size_t)s[3]); + s += 4; + if (len) + len -= 4; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 13e2b1600d..be35ac04ef 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -72,6 +72,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0023-zfs-Fix-possible-integer-overflows.patch \ file://0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch \ file://0025-affs-Fix-memory-leaks.patch \ + file://0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4285 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EAE9C433EF for ; Fri, 25 Feb 2022 14:28:01 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.web12.6903.1645799280198085559 for ; Fri, 25 Feb 2022 06:28:00 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=7gFj3WdW; spf=softfail (domain: sakoman.com, ip: 209.85.214.172, mailfrom: steve@sakoman.com) Received: by mail-pl1-f172.google.com with SMTP id x11so4936096pll.10 for ; Fri, 25 Feb 2022 06:28:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=tz9gUFjfnP8Zyv1nXiRmx//dv3iunHUd4fQCsRWJgns=; b=7gFj3WdWCDqjwVC1bfDavTD2n7fMNN1kUtX8+6SDURL+fAf7V1lRG5d8Kzr8GYRjhV Tt4x+DYMH2K+qKprtEQub2i1xwFTHABlfCMtONOvKsYIDznffItn5f+B7v4gTfpHU33y oGg/MBqwlPFwGzdTwTqJyl50F7pwk5Komrt64oF2YjGRYwlwk7FcKDiJ6A83YZfx/847 3O7HmwbFKDOQMNDJ8phlvUNM05RBZOuvRo//kNissAWb4sQszvaPUjUpj45MLl6MrOVH jvp3ESqew+sMYRO62InSdtc/TWH0BiEXQYDER8l7/RaVQpS3HcnJJLlI2sH4CzH0Vw4e Sc5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=tz9gUFjfnP8Zyv1nXiRmx//dv3iunHUd4fQCsRWJgns=; b=58AvzTTm5yBpNM0thYU2j5nh+9REfLFB50G235MRWsqMG6W0J7TE2o11pTMmoUlu6z IjmaqOBmEvQBv44uQF2yClJ64zlL3M43FeMsB4x4Yh0Cx+2Slm1LdrHL3/DDpzTRwuy4 s5OIUE2M9+0uQi8UVEL16MllD5Id5Cjp0szirjtdqOztee+NCVi0tsUS24OZXhn6UiNv UvQwFL7W3h8gqactirn2QSS5O+FC33i0/VtPwp+BBAyZlNxcyBzkjzo3DnAH8cOQi/BO ByQILB2hZqjTl9LMnWJj2fZRET8Aw/L/UdWnYLWNr/V3HEPM62pZyfKuy64HuwZgeW3U RReA== X-Gm-Message-State: AOAM53318vK3FXuqdaom6L2UQ+jbGIK/URqsKie9O7vvggEcsIyWp5qN Iw+r5oClHcKPEgoshpOGibYEUG6iP4EJosbJ X-Google-Smtp-Source: ABdhPJzTaKWhnmVsPGxvT6LhtlG9M0L/pM7qCMgWiw/CdWpzvxXJg3RU22Va6M1ZIQCqYYRTmYKILA== X-Received: by 2002:a17:90b:1104:b0:1b8:b90b:22c7 with SMTP id gi4-20020a17090b110400b001b8b90b22c7mr3445067pjb.45.1645799279245; Fri, 25 Feb 2022 06:27:59 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.27.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:27:58 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 31/50] grub: add a fix for a possible NULL dereference Date: Fri, 25 Feb 2022 04:26:11 -1000 Message-Id: <33aa1a133cf2893a6d3a1f94bd098ee1c16a8abc.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162377 From: Marta Rybczynska This patch adds a fix for a possible NULL dereference in grub's libgcrypt/mpi. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...pt-mpi-Fix-possible-NULL-dereference.patch | 33 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch diff --git a/meta/recipes-bsp/grub/files/0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch b/meta/recipes-bsp/grub/files/0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch new file mode 100644 index 0000000000..08299d021e --- /dev/null +++ b/meta/recipes-bsp/grub/files/0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch @@ -0,0 +1,33 @@ +From d26c8771293637b0465f2cb67d97cb58bacc62da Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 26 Nov 2020 10:41:54 +0000 +Subject: [PATCH] libgcrypt/mpi: Fix possible NULL dereference + +The code in gcry_mpi_scan() assumes that buffer is not NULL, but there +is no explicit check for that, so we add one. + +Fixes: CID 73757 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ae0f3fabeba7b393113d5dc185b6aff9b728136d] +Signed-off-by: Marta Rybczynska +--- + grub-core/lib/libgcrypt/mpi/mpicoder.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/lib/libgcrypt/mpi/mpicoder.c b/grub-core/lib/libgcrypt/mpi/mpicoder.c +index 7ecad27..6fe3891 100644 +--- a/grub-core/lib/libgcrypt/mpi/mpicoder.c ++++ b/grub-core/lib/libgcrypt/mpi/mpicoder.c +@@ -379,6 +379,9 @@ gcry_mpi_scan (struct gcry_mpi **ret_mpi, enum gcry_mpi_format format, + unsigned int len; + int secure = (buffer && gcry_is_secure (buffer)); + ++ if (!buffer) ++ return gcry_error (GPG_ERR_INV_ARG); ++ + if (format == GCRYMPI_FMT_SSH) + len = 0; + else diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index be35ac04ef..ef409bdd6a 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -73,6 +73,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0024-zfsinfo-Correct-a-check-for-error-allocating-memory.patch \ file://0025-affs-Fix-memory-leaks.patch \ file://0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch \ + file://0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4286 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C47DC433F5 for ; Fri, 25 Feb 2022 14:28:03 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.web11.6927.1645799282405963714 for ; Fri, 25 Feb 2022 06:28:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=3JMX4qfQ; spf=softfail (domain: sakoman.com, ip: 209.85.216.49, mailfrom: steve@sakoman.com) Received: by mail-pj1-f49.google.com with SMTP id bx5so4902450pjb.3 for ; Fri, 25 Feb 2022 06:28:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=w6JmQYre9/lrWXUqoX0HnjhrQqkbQ59kfkuwPElkG0w=; b=3JMX4qfQxsXc9XZull1tcrHvNOkLjVo7m27CQIFNWbl5VKdoSMKTtcYornsoHAUJh3 Pwd7U2gMFxlihKjhwXsctN7Tk1i/SlnMfUt0G9VblSTg2bePdgffcTDiaftJtZ4WzLM0 XoCdciYoDUh/Cm8dRi3dPhf+aXolCovuIuGBVXEeIj/gM1Y1v/dMcEvUWU84bwEagTnQ CpUoFZOoONvJH0PfpxT3O/H+lo85Ec3nZugMsoiznEqZVapT1jhxROIWMumNll+n2q0B Cl8RnzizfW0nAlJZZuvI2HyZmZnfyVZnBOj2qVrRRV/t8V2HSVjb0qCx1T304i6DQAvU 7N4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=w6JmQYre9/lrWXUqoX0HnjhrQqkbQ59kfkuwPElkG0w=; b=23bIzOzKwH9lT5kCng9DHzKmpPNo7ERpajLg4sf3kc2g/rT4UNxk/Ueoc9/QwAc29B rsGkUSNdC3ISoRZerFQ+wjZHrO3QNrwmH1RSwyINk5F8tsodFcRkBjzoWEVOMxeeU8Rd kWlENmdv82cgMGC2wBDmubtSGcKqb+/otCdthUoY/5np0tjGA7lAvUUBfIyEPyP10CbV QtdePlFk69r3C2+omG2kRsS2Ne6WjW/UZMs5q+YoNuwEIC9bORnTz05uiqxWCj9zsyat WWkK2C44plazIebcZ8GDPpD+yEIbJReYcYJ+xaEGQ+hNp5ARclS6hCFZjD67eiPjK11+ 28fQ== X-Gm-Message-State: AOAM533xdxPHG6CWSTKKENonL9BEL7LlvXi7PpVYwYsMeSgMOli8NwLw AoKgO6VRRsrC9Epf7HM4V7MUv9ZgIr9Gi+GP X-Google-Smtp-Source: ABdhPJzhnjQ3jSSptMTa4qstvTCtzE/qjLpgkdtM90ZKwZbKVC6KjcQ1XlnDCX6C8sSHoGpxdc9rSw== X-Received: by 2002:a17:90a:aa98:b0:1b8:5adb:e35f with SMTP id l24-20020a17090aaa9800b001b85adbe35fmr3405093pjq.192.1645799281437; Fri, 25 Feb 2022 06:28:01 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:00 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 32/50] grub: add a fix for a memory leak Date: Fri, 25 Feb 2022 04:26:12 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162378 From: Marta Rybczynska This patch fixes a memory leak in grub's syslinux parsing. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...slinux-Fix-memory-leak-while-parsing.patch | 43 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0028-syslinux-Fix-memory-leak-while-parsing.patch diff --git a/meta/recipes-bsp/grub/files/0028-syslinux-Fix-memory-leak-while-parsing.patch b/meta/recipes-bsp/grub/files/0028-syslinux-Fix-memory-leak-while-parsing.patch new file mode 100644 index 0000000000..d8c21d88f7 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0028-syslinux-Fix-memory-leak-while-parsing.patch @@ -0,0 +1,43 @@ +From ea12feb69b6af93c7e2fa03df7ac3bd1f4edd599 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 26 Nov 2020 15:31:53 +0000 +Subject: [PATCH] syslinux: Fix memory leak while parsing + +In syslinux_parse_real() the 2 points where return is being called +didn't release the memory stored in buf which is no longer required. + +Fixes: CID 176634 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=95bc016dba94cab3d398dd74160665915cd08ad6] +Signed-off-by: Marta Rybczynska +--- + grub-core/lib/syslinux_parse.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/grub-core/lib/syslinux_parse.c b/grub-core/lib/syslinux_parse.c +index 4afa992..3acc6b4 100644 +--- a/grub-core/lib/syslinux_parse.c ++++ b/grub-core/lib/syslinux_parse.c +@@ -737,7 +737,10 @@ syslinux_parse_real (struct syslinux_menu *menu) + && grub_strncasecmp ("help", ptr3, ptr4 - ptr3) == 0)) + { + if (helptext (ptr5, file, menu)) +- return 1; ++ { ++ grub_free (buf); ++ return 1; ++ } + continue; + } + +@@ -757,6 +760,7 @@ syslinux_parse_real (struct syslinux_menu *menu) + } + fail: + grub_file_close (file); ++ grub_free (buf); + return err; + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index ef409bdd6a..c965f0fd15 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -74,6 +74,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0025-affs-Fix-memory-leaks.patch \ file://0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch \ file://0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch \ + file://0028-syslinux-Fix-memory-leak-while-parsing.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4287 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F13DC433EF for ; Fri, 25 Feb 2022 14:28:05 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.web12.6905.1645799284530948992 for ; Fri, 25 Feb 2022 06:28:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Dqs2jLj3; spf=softfail (domain: sakoman.com, ip: 209.85.216.42, mailfrom: steve@sakoman.com) Received: by mail-pj1-f42.google.com with SMTP id j10-20020a17090a94ca00b001bc2a9596f6so4927487pjw.5 for ; Fri, 25 Feb 2022 06:28:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=6LfYOjSHVLKQmxvnol4xKm4mgMWT3i2z+az0A6MkCR8=; b=Dqs2jLj3q6ONl/VYTjJSbILJd3vjEJVcYN9kg8SHyp8bW20N9pHrHitU851HikYoWe mjs0Hzh977xkKK5rFO2+H1Sg+EtK1zsvI5r6jsMDXa6y/UM4nr2OrkzETaWPItEdzbik thc1NYktXKWoLiKGDXHrBlN0Rsfata+ala8U3PP/bVtE8KlH/bCoK0nLmVDPxNAcU8Se fGVGXC7Stryi+XShkDVxslfYxI+Gwp1OO1K+Au7AxcQzCF8AvZi6ls5fdKdwCXvT1VOA 0RwJ+L0ME1zAPPp+7ZEM58ZgdK2WetYFt3WvdmjBsSuW3UDkgjQEi3ZEXC9GF91nFNPy 239Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=6LfYOjSHVLKQmxvnol4xKm4mgMWT3i2z+az0A6MkCR8=; b=TYrcLDqacmj2UoNxzBDVyq3V+BMDZagc1KSxn0zK2Hvhr/P7+ajoPV3Fi83yJyHiZu eR/0gRyxgLhVdaF2Q98Yep8IltAOpBO2Su+CclWipNqklTL2f7ydaacaZ8WtF6+leIv/ 5GAYGEeJLwCSolQAo5ZSoKR5f7YlSSulKuffQKvCRJQ/KyF1jwFIQfMbKpvX+PGdxEX3 At3WwiWyeTJjHPm9Ub8p6ToZcClCSasqNFmChhctUpZgpvNWwyPclenOw+ddfnq3H4Uq udhSXJdYJSGP85fpPgMc1/ERlUrEjBEqNInz0wlHq8BR/MgYUmGL9HD26CwVp0HyYp7d zEzA== X-Gm-Message-State: AOAM531n30FjbBymXwfCqzPuT5N7gtpGWW0j8c4LBYQtk0sQIa3j36ds uKvuQQPwx7ny0n9/J4LZXrPaQR443keKGgDf X-Google-Smtp-Source: ABdhPJzc4Q9FJnYM+XHbTTuCoVqA5Npz4as8QTcxxn/eWvO1XL1/CUJBCS+yyQ9D5jzh1LUT6A1CEg== X-Received: by 2002:a17:90a:2e0e:b0:1bc:dbe:2d04 with SMTP id q14-20020a17090a2e0e00b001bc0dbe2d04mr3466595pjd.74.1645799283552; Fri, 25 Feb 2022 06:28:03 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:03 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 33/50] grub: add a fix for a memory leak Date: Fri, 25 Feb 2022 04:26:13 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162379 From: Marta Rybczynska This patch adds a fix for a memory leak in grub's normal/completion. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...n-Fix-leaking-of-memory-when-process.patch | 52 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0029-normal-completion-Fix-leaking-of-memory-when-process.patch diff --git a/meta/recipes-bsp/grub/files/0029-normal-completion-Fix-leaking-of-memory-when-process.patch b/meta/recipes-bsp/grub/files/0029-normal-completion-Fix-leaking-of-memory-when-process.patch new file mode 100644 index 0000000000..8a26e5bc5b --- /dev/null +++ b/meta/recipes-bsp/grub/files/0029-normal-completion-Fix-leaking-of-memory-when-process.patch @@ -0,0 +1,52 @@ +From 2367049d2021e00d82d19cee923e06a4b04ebc30 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 4 Dec 2020 18:56:48 +0000 +Subject: [PATCH] normal/completion: Fix leaking of memory when processing a + completion + +It is possible for the code to reach the end of the function without +freeing the memory allocated to argv and argc still to be 0. + +We should always call grub_free(argv). The grub_free() will handle +a NULL argument correctly if it reaches that code without the memory +being allocated. + +Fixes: CID 96672 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9213575b7a95b514bce80be5964a28d407d7d56d] +Signed-off-by: Marta Rybczynska +--- + grub-core/normal/completion.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/grub-core/normal/completion.c b/grub-core/normal/completion.c +index 5961028..46e473c 100644 +--- a/grub-core/normal/completion.c ++++ b/grub-core/normal/completion.c +@@ -400,8 +400,8 @@ char * + grub_normal_do_completion (char *buf, int *restore, + void (*hook) (const char *, grub_completion_type_t, int)) + { +- int argc; +- char **argv; ++ int argc = 0; ++ char **argv = NULL; + + /* Initialize variables. */ + match = 0; +@@ -516,10 +516,8 @@ grub_normal_do_completion (char *buf, int *restore, + + fail: + if (argc != 0) +- { +- grub_free (argv[0]); +- grub_free (argv); +- } ++ grub_free (argv[0]); ++ grub_free (argv); + grub_free (match); + grub_errno = GRUB_ERR_NONE; + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index c965f0fd15..1460e559b9 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -75,6 +75,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0026-libgcrypt-mpi-Fix-possible-unintended-sign-extension.patch \ file://0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch \ file://0028-syslinux-Fix-memory-leak-while-parsing.patch \ + file://0029-normal-completion-Fix-leaking-of-memory-when-process.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4288 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CDD3C433EF for ; Fri, 25 Feb 2022 14:28:07 +0000 (UTC) Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by mx.groups.io with SMTP id smtpd.web11.6928.1645799286744115681 for ; Fri, 25 Feb 2022 06:28:06 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=IP/y4zF+; spf=softfail (domain: sakoman.com, ip: 209.85.210.170, mailfrom: steve@sakoman.com) Received: by mail-pf1-f170.google.com with SMTP id z16so4834363pfh.3 for ; Fri, 25 Feb 2022 06:28:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=0jiF8oVkVd7mgs9s4ZJJcz+a4pH2dFWABa0KuJRrY7o=; b=IP/y4zF+T9qI+trbzDFQKRKYMFicP6hjPXSimTE+O9bY0oNEW1RKroZ7/oPLbpgygO ZNeJbV6VBWhQLJAvHRjSkaPxM0SNI/zvSn1MMqEjNrkiGbXLaUkMdjYn8qvrws+qclyp 5OpPxUVLwsIGGjmGZ7UxTs3gCs09oHB+INRt3IIZzC1CHh/T/ga0McwB7karsKqfZAUf 2ajToOUM7DSF3GA0mUjz8y4aP1QTtwqsTIcVofJbqbPS4wvLsIh/UNpVd6SexhFGehFG LDwTYw03eO2YqT2Vq1o9FBX08hehTSwJ3TmwIvzZDwDZcYWszk3cyhBJSK6oPaSBK5oZ V0Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0jiF8oVkVd7mgs9s4ZJJcz+a4pH2dFWABa0KuJRrY7o=; b=Oy/86B/Pi1PQTfR3XTCAYas19/QU6yYYnd/YzwmGbkcQriDVlwDwrc/rp+7e/LYbrr clwUjOT5PxDDYEiadfL2sMRawlewp6TXlWGc48l91tPpjg48AJzR3L9eQcODZoZnVr5E GC3gE5e6KjUt09zyGGOpu5x6gitYZ11aso7Btx08sxVHybmIgi/BE3erXlmqmwsYMVLK pMPAAMwK7CHkOLofa8E7GSO5mNmAEbKtDd/9Mz9vVygfhGKtyZ7gxHjxfJsRGfAPk+Q+ 0+IXwJ7HrLUtwL3SIP7yOMPoA4QRwtB9u1xawmhq+1uKQyWlZ6svJTwcF6qkakDZHjQp Z6Cg== X-Gm-Message-State: AOAM532stG0OCdnHsoA9j17/ywfR9Mq0iITtmWZN4Ln7SFOLiQ2mZbHy 9sECTrp1xoGIC+GUq1InjQWKo6thytnujEws X-Google-Smtp-Source: ABdhPJy8igm7BtuesF841W9be526OSqDoLwqjFx9DC7Zjf0JA31Glsl8tmjpNEjnNEDXZmAm4EaZ/Q== X-Received: by 2002:a63:4d52:0:b0:343:8d41:eb12 with SMTP id n18-20020a634d52000000b003438d41eb12mr6452059pgl.527.1645799285729; Fri, 25 Feb 2022 06:28:05 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:05 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 34/50] grub: fix a memory leak Date: Fri, 25 Feb 2022 04:26:14 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162380 From: Marta Rybczynska Add a fix of a memory leak in grub's commands/hashsum. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...0-commands-hashsum-Fix-a-memory-leak.patch | 56 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0030-commands-hashsum-Fix-a-memory-leak.patch diff --git a/meta/recipes-bsp/grub/files/0030-commands-hashsum-Fix-a-memory-leak.patch b/meta/recipes-bsp/grub/files/0030-commands-hashsum-Fix-a-memory-leak.patch new file mode 100644 index 0000000000..e34a19e12c --- /dev/null +++ b/meta/recipes-bsp/grub/files/0030-commands-hashsum-Fix-a-memory-leak.patch @@ -0,0 +1,56 @@ +From b136fa14d26d1833ffcb852f86e65da5960cfb99 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Tue, 1 Dec 2020 23:41:24 +0000 +Subject: [PATCH] commands/hashsum: Fix a memory leak + +check_list() uses grub_file_getline(), which allocates a buffer. +If the hash list file contains invalid lines, the function leaks +this buffer when it returns an error. + +Fixes: CID 176635 + +Signed-off-by: Chris Coulson +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=8b6f528e52e18b7a69f90b8dc3671d7b1147d9f3] +Signed-off-by: Marta Rybczynska +--- + grub-core/commands/hashsum.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c +index 456ba90..b8a22b0 100644 +--- a/grub-core/commands/hashsum.c ++++ b/grub-core/commands/hashsum.c +@@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, + high = hextoval (*p++); + low = hextoval (*p++); + if (high < 0 || low < 0) +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); ++ { ++ grub_free (buf); ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); ++ } + expected[i] = (high << 4) | low; + } + if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t')) +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); ++ { ++ grub_free (buf); ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); ++ } + p += 2; + if (prefix) + { +@@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, + + filename = grub_xasprintf ("%s/%s", prefix, p); + if (!filename) +- return grub_errno; ++ { ++ grub_free (buf); ++ return grub_errno; ++ } + file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH + | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS + : GRUB_FILE_TYPE_NONE)); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 1460e559b9..d18e329b96 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -76,6 +76,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0027-libgcrypt-mpi-Fix-possible-NULL-dereference.patch \ file://0028-syslinux-Fix-memory-leak-while-parsing.patch \ file://0029-normal-completion-Fix-leaking-of-memory-when-process.patch \ + file://0030-commands-hashsum-Fix-a-memory-leak.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4289 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F84FC433EF for ; Fri, 25 Feb 2022 14:28:09 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.web10.7076.1645799289056520439 for ; Fri, 25 Feb 2022 06:28:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=XxWdIQHK; spf=softfail (domain: sakoman.com, ip: 209.85.216.43, mailfrom: steve@sakoman.com) Received: by mail-pj1-f43.google.com with SMTP id g7-20020a17090a708700b001bb78857ccdso8589520pjk.1 for ; Fri, 25 Feb 2022 06:28:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=Mj6Vl0noIwZlnL3Y/wdBHSrp37IpXYQYsiMgdEIJC9g=; b=XxWdIQHKPqXEg3Fgzrv3Y/yNgweoHBc9RVTyylmAaH0ma60eqzrTl43kMYW+NGym9f 7jzPaUXjVtu5MbI8rHv9L3M8lqbW8RzSuOSYQSCFy9yzeSy9+IodLysLtdimklLnp1iv mnw183IPLnAc4BIDs8X978ltwyUfH6iL57lGLFMe2RrUYPP5ifwDAhcm5kmMPX+FAtKE G5c1sKNOS7Ta9xsrzfknHe2cPyhQTVQBfpuSnZ88Y2NIwYzZyWMGLJu69K0Hhusz8y8D cvoAybAzPFD7iSBfvFoW9BLX0V9TI9BDQnA9rH2SrzBEIOLys4kjxztzkihGU0sRtWOs zdwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Mj6Vl0noIwZlnL3Y/wdBHSrp37IpXYQYsiMgdEIJC9g=; b=a29vIur/OATyUCqhk6YZ2p/qfV5jJU1MYrgorvvhuIrc63+W6GYiDAW6qnSxc6E3JE Tkai6eXPPcCe7g0HDTGTwm95ufNZlZsNR57AQVabKpIIEX8hpK1MwYiWsTnyB55oW2my 3mHJjXofrdKMg45cI9f0SlpU9HbglzMnuNIqPG+oTVer7VZdw756mFoeFpC2DRPCUDb0 5svDmp0yLoBLTeESmagBl20iZjGCjA1TUvbDHGEDNWuNK8q8kSNJG6GSazEPRJ8tjUFu A9W1o5HJWLsAzuSKYkzQN7RLyAzGLEw+OeY/CahEsdtnXA95fbr6onA02HQLrmuv+Cnm q3cA== X-Gm-Message-State: AOAM531j97U/LvCEVmLlWSLxEibdtADeCiqbHvJ4eepO9yLqTtTjuJTT 8BYcLFgIda/YtvcXZq0XsMrk+kc57VTBVLlh X-Google-Smtp-Source: ABdhPJyBWo4CW1sZVm8oyPF99eM2qW08UrlIAd8xYJL49rQD/p4vFkcs2daajyF5qYMZo+XKSEDhLA== X-Received: by 2002:a17:902:7043:b0:14f:47:a455 with SMTP id h3-20020a170902704300b0014f0047a455mr7829111plt.44.1645799288049; Fri, 25 Feb 2022 06:28:08 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:07 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 35/50] grub: remove unneeded return value Date: Fri, 25 Feb 2022 04:26:15 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162381 From: Marta Rybczynska This patch removes an uneeded return value in grub's (static) grub_video_gop_fill_mode_info(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...move-unnecessary-return-value-of-gru.patch | 94 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 95 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch diff --git a/meta/recipes-bsp/grub/files/0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch b/meta/recipes-bsp/grub/files/0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch new file mode 100644 index 0000000000..7e4e951245 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch @@ -0,0 +1,94 @@ +From 2a1e5659763790201a342f8a897c8c9d8d91b1cc Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 8 Dec 2020 21:14:31 +0000 +Subject: [PATCH] video/efi_gop: Remove unnecessary return value of + grub_video_gop_fill_mode_info() + +The return value of grub_video_gop_fill_mode_info() is never able to be +anything other than GRUB_ERR_NONE. So, rather than continue to return +a value and checking it each time, it is more correct to redefine the +function to not return anything and remove checks of its return value +altogether. + +Fixes: CID 96701 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=fc5951d3b1616055ef81a019a5affc09d13344d0] +Signed-off-by: Marta Rybczynska +--- + grub-core/video/efi_gop.c | 25 ++++++------------------- + 1 file changed, 6 insertions(+), 19 deletions(-) + +diff --git a/grub-core/video/efi_gop.c b/grub-core/video/efi_gop.c +index 7f9d1c2..db2ee98 100644 +--- a/grub-core/video/efi_gop.c ++++ b/grub-core/video/efi_gop.c +@@ -227,7 +227,7 @@ grub_video_gop_fill_real_mode_info (unsigned mode, + return GRUB_ERR_NONE; + } + +-static grub_err_t ++static void + grub_video_gop_fill_mode_info (unsigned mode, + struct grub_efi_gop_mode_info *in, + struct grub_video_mode_info *out) +@@ -252,8 +252,6 @@ grub_video_gop_fill_mode_info (unsigned mode, + out->blit_format = GRUB_VIDEO_BLIT_FORMAT_BGRA_8888; + out->mode_type |= (GRUB_VIDEO_MODE_TYPE_DOUBLE_BUFFERED + | GRUB_VIDEO_MODE_TYPE_UPDATING_SWAP); +- +- return GRUB_ERR_NONE; + } + + static int +@@ -266,7 +264,6 @@ grub_video_gop_iterate (int (*hook) (const struct grub_video_mode_info *info, vo + grub_efi_uintn_t size; + grub_efi_status_t status; + struct grub_efi_gop_mode_info *info = NULL; +- grub_err_t err; + struct grub_video_mode_info mode_info; + + status = efi_call_4 (gop->query_mode, gop, mode, &size, &info); +@@ -277,12 +274,7 @@ grub_video_gop_iterate (int (*hook) (const struct grub_video_mode_info *info, vo + continue; + } + +- err = grub_video_gop_fill_mode_info (mode, info, &mode_info); +- if (err) +- { +- grub_errno = GRUB_ERR_NONE; +- continue; +- } ++ grub_video_gop_fill_mode_info (mode, info, &mode_info); + if (hook (&mode_info, hook_arg)) + return 1; + } +@@ -466,13 +458,8 @@ grub_video_gop_setup (unsigned int width, unsigned int height, + + info = gop->mode->info; + +- err = grub_video_gop_fill_mode_info (gop->mode->mode, info, +- &framebuffer.mode_info); +- if (err) +- { +- grub_dprintf ("video", "GOP: couldn't fill mode info\n"); +- return err; +- } ++ grub_video_gop_fill_mode_info (gop->mode->mode, info, ++ &framebuffer.mode_info); + + framebuffer.ptr = (void *) (grub_addr_t) gop->mode->fb_base; + framebuffer.offscreen +@@ -486,8 +473,8 @@ grub_video_gop_setup (unsigned int width, unsigned int height, + { + grub_dprintf ("video", "GOP: couldn't allocate shadow\n"); + grub_errno = 0; +- err = grub_video_gop_fill_mode_info (gop->mode->mode, info, +- &framebuffer.mode_info); ++ grub_video_gop_fill_mode_info (gop->mode->mode, info, ++ &framebuffer.mode_info); + buffer = framebuffer.ptr; + } + diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index d18e329b96..24a269d90d 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -77,6 +77,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0028-syslinux-Fix-memory-leak-while-parsing.patch \ file://0029-normal-completion-Fix-leaking-of-memory-when-process.patch \ file://0030-commands-hashsum-Fix-a-memory-leak.patch \ + file://0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4290 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F531C433EF for ; Fri, 25 Feb 2022 14:28:12 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.web09.6943.1645799291292771947 for ; Fri, 25 Feb 2022 06:28:11 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Szh615ya; spf=softfail (domain: sakoman.com, ip: 209.85.216.44, mailfrom: steve@sakoman.com) Received: by mail-pj1-f44.google.com with SMTP id gl14-20020a17090b120e00b001bc2182c3d5so7567119pjb.1 for ; Fri, 25 Feb 2022 06:28:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=r3T4N70ecjrvua634zK2XaxpdIvLazkCiTvVrSdTOp4=; b=Szh615yaWicdPgwSYN4YW/phzQSz4TtLj2jm11r/Kwbfn2MVGsTtGXcKeEX94AaC/y cJMV5bePiORZOtNuyWBIetZpE4lHbPqJ9bwnGoCmDJ3TgqcjppCnzc1aVNksRGwpkgYh BTMuKnBEp5QNFbHtPMJFh+BYUboMp0VWVs6Mu5ybg1Ietkwif9u3BMiQnW5X7pRN8cyA 13x0sfTBu/XKcXE+jTaNy2dhBizGwzGfrcrlJ3VzGTw3FMyTsH1LXm01mGSpAvcjLVVU uVm9QIt7eikLuAyJ5oq7GUIXitzNf3TfKepqIo4fb6FhmnvpxggRvGMrkv9R/HazlAwm 44aQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=r3T4N70ecjrvua634zK2XaxpdIvLazkCiTvVrSdTOp4=; b=DmPIzphAiwsQI9VOoSnENM8j234sgbErJlx8lSz3F9xw4Dw3v+orsm2jW8n0sxMxI1 xTGjOLkRnbrMPBir7dToMVy0LUrycWmQoLToaGWkIBZovALJIfQ7wi3wYfEaIwbABaRt woZ1ivgYBYYVCLJ4UmuO7435ymVBQg/jTccHuv/9nhVFNX1UVdqngd+B5qWWFMIUgWi+ D40yqdrpWIlvBADWAHw3oUt3qVnErDgSAVW80rgYCQm0Ly9Ia5j6paXrQ9/Dfzsyc8Kv v41hFZhiY+jK2WC2z6qbn+7ZQdEDKOapjtrXTCjPjukix3Vx3mqhkLU/WhlN8r4QL6W2 SjIA== X-Gm-Message-State: AOAM530yqwP3wdpV75lBmBvCdNorsIOIhJIUzN2cu9eqDCRyrEDEs8AC snyZcfDjGBTl2oUBYCJPy+Jcy6eCuAM82QHE X-Google-Smtp-Source: ABdhPJxFcrXmdnRFcZZV1bSDBgiaGZay4htm3Zz3SJPoExamigJ576wpIqOGBlQtZ/RguKobhwn7rQ== X-Received: by 2002:a17:903:2301:b0:150:140:c69e with SMTP id d1-20020a170903230100b001500140c69emr7637331plh.82.1645799290311; Fri, 25 Feb 2022 06:28:10 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:09 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 36/50] grub: fix an integer overflow Date: Fri, 25 Feb 2022 04:26:16 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162382 From: Marta Rybczynska This patch adds a fix for a potential integer overflow in grub's video/fb/fbfill. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...bfill-Fix-potential-integer-overflow.patch | 78 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0032-video-fb-fbfill-Fix-potential-integer-overflow.patch diff --git a/meta/recipes-bsp/grub/files/0032-video-fb-fbfill-Fix-potential-integer-overflow.patch b/meta/recipes-bsp/grub/files/0032-video-fb-fbfill-Fix-potential-integer-overflow.patch new file mode 100644 index 0000000000..8165ea3f71 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0032-video-fb-fbfill-Fix-potential-integer-overflow.patch @@ -0,0 +1,78 @@ +From 99ecf5a44b99d529a6405fe276bedcefa3657a0a Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Wed, 4 Nov 2020 15:10:51 +0000 +Subject: [PATCH] video/fb/fbfill: Fix potential integer overflow + +The multiplication of 2 unsigned 32-bit integers may overflow before +promotion to unsigned 64-bit. We should ensure that the multiplication +is done with overflow detection. Additionally, use grub_sub() for +subtraction. + +Fixes: CID 73640, CID 73697, CID 73702, CID 73823 + +Signed-off-by: Darren Kenny +Signed-off-by: Marco A Benatto +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7ce3259f67ac2cd93acb0ec0080c24b3b69e66c6] +Signed-off-by: Marta Rybczynska +--- + grub-core/video/fb/fbfill.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/grub-core/video/fb/fbfill.c b/grub-core/video/fb/fbfill.c +index 11816d0..a37acd1 100644 +--- a/grub-core/video/fb/fbfill.c ++++ b/grub-core/video/fb/fbfill.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + + /* Generic filler that works for every supported mode. */ +@@ -61,7 +62,9 @@ grub_video_fbfill_direct32 (struct grub_video_fbblit_info *dst, + + /* Calculate the number of bytes to advance from the end of one line + to the beginning of the next line. */ +- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; ++ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || ++ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) ++ return; + + /* Get the start address. */ + dstptr = grub_video_fb_get_video_ptr (dst, x, y); +@@ -98,7 +101,9 @@ grub_video_fbfill_direct24 (struct grub_video_fbblit_info *dst, + #endif + /* Calculate the number of bytes to advance from the end of one line + to the beginning of the next line. */ +- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; ++ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || ++ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) ++ return; + + /* Get the start address. */ + dstptr = grub_video_fb_get_video_ptr (dst, x, y); +@@ -131,7 +136,9 @@ grub_video_fbfill_direct16 (struct grub_video_fbblit_info *dst, + + /* Calculate the number of bytes to advance from the end of one line + to the beginning of the next line. */ +- rowskip = (dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width); ++ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || ++ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) ++ return; + + /* Get the start address. */ + dstptr = grub_video_fb_get_video_ptr (dst, x, y); +@@ -161,7 +168,9 @@ grub_video_fbfill_direct8 (struct grub_video_fbblit_info *dst, + + /* Calculate the number of bytes to advance from the end of one line + to the beginning of the next line. */ +- rowskip = dst->mode_info->pitch - dst->mode_info->bytes_per_pixel * width; ++ if (grub_mul (dst->mode_info->bytes_per_pixel, width, &rowskip) || ++ grub_sub (dst->mode_info->pitch, rowskip, &rowskip)) ++ return; + + /* Get the start address. */ + dstptr = grub_video_fb_get_video_ptr (dst, x, y); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 24a269d90d..710ab5e361 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -78,6 +78,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0029-normal-completion-Fix-leaking-of-memory-when-process.patch \ file://0030-commands-hashsum-Fix-a-memory-leak.patch \ file://0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch \ + file://0032-video-fb-fbfill-Fix-potential-integer-overflow.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4291 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7E3EEC433FE for ; Fri, 25 Feb 2022 14:28:14 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.web08.6803.1645799293583789461 for ; Fri, 25 Feb 2022 06:28:13 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=vA6SW+lq; spf=softfail (domain: sakoman.com, ip: 209.85.210.173, mailfrom: steve@sakoman.com) Received: by mail-pf1-f173.google.com with SMTP id y11so4828523pfa.6 for ; Fri, 25 Feb 2022 06:28:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=UmEFm+PeLKofsBoD5GPzIpJfqv9yZHUopXYH05z+2a8=; b=vA6SW+lqamFBwq/T8V0M07+Dg5mTzCtQWQ/9OyzOOLeEXqeCwCfFwEKZP8P7+XJ2V1 XQuCRjFuqAJdyn3SyMm4Vjux5gyu2hrjRMeOKnFqxRQ296QAH/y64GRLFJ1IGSH1yfn+ F22qT78SRprEdx5nHi2mvTRLaxdx4OyiwM13HGrelcEd0Yyzc8lpt17YmLsv+wNEY2aK CsdCAi4bU7ZJYnnTZXs/grYHMjwBtUCw/g0bgbu/CQ6NL35mdWe59qsThSdiXmpfHpBX vMNqe84mueBA+UR+cN8VYvZrzz/hvw3CDyznDnXNeaEz+OpbXA26lt+yqvHfihzcgCE0 dX2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=UmEFm+PeLKofsBoD5GPzIpJfqv9yZHUopXYH05z+2a8=; b=lCx/YegIwJ0+WhVn3fM5aBlXnq0MgCWqcKS7o3HnZZEokt5aA8ZhT8w5ggLLlGcICu v1z9nLmoJYYsZ12iPY11N5xuMd7/QqvFE+P84NWXbhENASg1YhJOrgcEFqphwTALGu/S q9kIXIL4pmFExE/D1WRAMQGAmtWeMuwy//PKKSOkBg0BmJdkP+8pk4A8cdRL/6y6VVMa Ik3+PdEdr7HbL3eqTA7Ckd32ZWJ91ZKxhVwNi3RcZB2p9Y/Zs0fj3qE40UyoIBjq8q/V c8upo3ZNQsHZotg7hQN1Lpw9l+yvEARm04mZ0OGQ6ZIQNfs6HENKzmRP4INieQLRcGTc 5Pig== X-Gm-Message-State: AOAM532DrGukZufI88H1jPIDcsJPbxGBgYpU9aEh+w6HF1TZ3vSfhqqT 2WadBT+ib5qEu6nvJ6fYErx+AOBFP0JH6tVP X-Google-Smtp-Source: ABdhPJx++RoN4f6TVDKfvqbwpBmR6rFe58W7O0FV01+djzjR6rLPq9CiSpvF93aFLFm3I2IiGQnaOg== X-Received: by 2002:a05:6a02:193:b0:375:65a5:2fcd with SMTP id bj19-20020a056a02019300b0037565a52fcdmr6344765pgb.288.1645799292580; Fri, 25 Feb 2022 06:28:12 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:11 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 37/50] grub: fix multiple integer overflows Date: Fri, 25 Feb 2022 04:26:17 -1000 Message-Id: <68b91792ed00f9decc85f300eefe0b7e8f80c98b.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162383 From: Marta Rybczynska This patch adds a fix for multiple integer overflows in grub's video/fb/video_fb. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...eo_fb-Fix-multiple-integer-overflows.patch | 104 ++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 105 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch diff --git a/meta/recipes-bsp/grub/files/0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch b/meta/recipes-bsp/grub/files/0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch new file mode 100644 index 0000000000..544e7f31ae --- /dev/null +++ b/meta/recipes-bsp/grub/files/0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch @@ -0,0 +1,104 @@ +From 69b91f7466a5ad5fb85039a5b4118efb77ad6347 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Wed, 4 Nov 2020 14:43:44 +0000 +Subject: [PATCH] video/fb/video_fb: Fix multiple integer overflows + +The calculation of the unsigned 64-bit value is being generated by +multiplying 2, signed or unsigned, 32-bit integers which may overflow +before promotion to unsigned 64-bit. Fix all of them. + +Fixes: CID 73703, CID 73767, CID 73833 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=08e098b1dbf01e96376f594b337491bc4cfa48dd] +Signed-off-by: Marta Rybczynska +--- + grub-core/video/fb/video_fb.c | 52 ++++++++++++++++++++++++----------- + 1 file changed, 36 insertions(+), 16 deletions(-) + +diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c +index 1a602c8..1c9a138 100644 +--- a/grub-core/video/fb/video_fb.c ++++ b/grub-core/video/fb/video_fb.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1417,15 +1418,23 @@ doublebuf_blit_update_screen (void) + { + if (framebuffer.current_dirty.first_line + <= framebuffer.current_dirty.last_line) +- grub_memcpy ((char *) framebuffer.pages[0] +- + framebuffer.current_dirty.first_line +- * framebuffer.back_target->mode_info.pitch, +- (char *) framebuffer.back_target->data +- + framebuffer.current_dirty.first_line +- * framebuffer.back_target->mode_info.pitch, +- framebuffer.back_target->mode_info.pitch +- * (framebuffer.current_dirty.last_line +- - framebuffer.current_dirty.first_line)); ++ { ++ grub_size_t copy_size; ++ ++ if (grub_sub (framebuffer.current_dirty.last_line, ++ framebuffer.current_dirty.first_line, ©_size) || ++ grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, ©_size)) ++ { ++ /* Shouldn't happen, but if it does we've a bug. */ ++ return GRUB_ERR_BUG; ++ } ++ ++ grub_memcpy ((char *) framebuffer.pages[0] + framebuffer.current_dirty.first_line * ++ framebuffer.back_target->mode_info.pitch, ++ (char *) framebuffer.back_target->data + framebuffer.current_dirty.first_line * ++ framebuffer.back_target->mode_info.pitch, ++ copy_size); ++ } + framebuffer.current_dirty.first_line + = framebuffer.back_target->mode_info.height; + framebuffer.current_dirty.last_line = 0; +@@ -1439,7 +1448,7 @@ grub_video_fb_doublebuf_blit_init (struct grub_video_fbrender_target **back, + volatile void *framebuf) + { + grub_err_t err; +- grub_size_t page_size = mode_info.pitch * mode_info.height; ++ grub_size_t page_size = (grub_size_t) mode_info.pitch * mode_info.height; + + framebuffer.offscreen_buffer = grub_zalloc (page_size); + if (! framebuffer.offscreen_buffer) +@@ -1482,12 +1491,23 @@ doublebuf_pageflipping_update_screen (void) + last_line = framebuffer.previous_dirty.last_line; + + if (first_line <= last_line) +- grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] +- + first_line * framebuffer.back_target->mode_info.pitch, +- (char *) framebuffer.back_target->data +- + first_line * framebuffer.back_target->mode_info.pitch, +- framebuffer.back_target->mode_info.pitch +- * (last_line - first_line)); ++ { ++ grub_size_t copy_size; ++ ++ if (grub_sub (last_line, first_line, ©_size) || ++ grub_mul (framebuffer.back_target->mode_info.pitch, copy_size, ©_size)) ++ { ++ /* Shouldn't happen, but if it does we've a bug. */ ++ return GRUB_ERR_BUG; ++ } ++ ++ grub_memcpy ((char *) framebuffer.pages[framebuffer.render_page] + first_line * ++ framebuffer.back_target->mode_info.pitch, ++ (char *) framebuffer.back_target->data + first_line * ++ framebuffer.back_target->mode_info.pitch, ++ copy_size); ++ } ++ + framebuffer.previous_dirty = framebuffer.current_dirty; + framebuffer.current_dirty.first_line + = framebuffer.back_target->mode_info.height; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 710ab5e361..8b5b9e3b3e 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -79,6 +79,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0030-commands-hashsum-Fix-a-memory-leak.patch \ file://0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch \ file://0032-video-fb-fbfill-Fix-potential-integer-overflow.patch \ + file://0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4292 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ED9FC433EF for ; Fri, 25 Feb 2022 14:28:16 +0000 (UTC) Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by mx.groups.io with SMTP id smtpd.web09.6944.1645799295800686790 for ; Fri, 25 Feb 2022 06:28:15 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=JWevXUAq; spf=softfail (domain: sakoman.com, ip: 209.85.210.172, mailfrom: steve@sakoman.com) Received: by mail-pf1-f172.google.com with SMTP id z15so4818493pfe.7 for ; Fri, 25 Feb 2022 06:28:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=RTspkjQd1CiMldzHPQwhpJgcOCqVY1CmuNAXM+mFUpg=; b=JWevXUAqZH+wa2EeitKDVczYF7hpikITbviAZgMO2Wx3o0/aozIWTC8FMPoycx7UpO f7czyFHrMV+LSP2MXZGwmYKI13M8IBD9cSITel0TUWp7ROM9UBTryHf4+rn3Z3PcHuBs Gb1CIOfE6j65/RLe2vpzrtSXajBcXOcSbtv+YI+0/BhIlFlZgD09SLlQblJJU3ZP5+8A sBaPfd7t23fYRVvo5B9WnPWpP58iaI+Vo5zBoEsBQa7Njc+e/9ZzKGIA2MPLhsaylO5a DurbpZTz2BsyyzVmi/+m5rzLerAoK+EL7IV2aDaB77vcmQJXKrk/I2uos7Td5nN0ohxB AjXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=RTspkjQd1CiMldzHPQwhpJgcOCqVY1CmuNAXM+mFUpg=; b=5zO5caHeVXp0ucM4kyjymfQVCsY0ckMFU6ESWehdnk/AmVuf+a1t0BA/Cx0sAzjSm/ 8gkyTMXdzZtOSDCbXrhuMJ+s7CaWKTG4vfTi0dEwi1lrdWurMJgGZY5SLSnk7TWsuNSr Q5qrcMh6bTe/4q8L1HglbI8MrPwlaXbY2jfMIb5V2pJeT8nYXK0QMw0F0EP3knbaL9g7 WaFC3HjfoQJD4jIah5HMQSuJ9k+qwvxoF+cGxxx2YUv9cfGpXSmN3fCHj02hrBGzrbmX tb9fAo3AFNcOAJL4moI/8KKRhUow+CLXcsKaUFKpW27b88E3YmRGYvGizsgOba9wo+Hy +XjQ== X-Gm-Message-State: AOAM533sQcxG8BihUXJYuRb0BhUkmJefq8iSMbnBaelbYLWQH12rPLfU 5nlfDlKEsghjcPI/P2mBhUrf7+/7IN0qE2QH X-Google-Smtp-Source: ABdhPJxl10i/oSoTeb7Rh9u8PCpvKbF6Jzz6iVYF0i5hM2h6r/+r5vnvJtUfz6Yjnm+iOQa4P+7svg== X-Received: by 2002:a63:5051:0:b0:374:5fd0:f131 with SMTP id q17-20020a635051000000b003745fd0f131mr6445530pgl.431.1645799294811; Fri, 25 Feb 2022 06:28:14 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:14 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 38/50] grub: fix a possible integer overflow Date: Fri, 25 Feb 2022 04:26:18 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162384 From: Marta Rybczynska This patch adds a fix for a possible integer overflow in grub's video/fb/video_fb. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...deo_fb-Fix-possible-integer-overflow.patch | 39 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0034-video-fb-video_fb-Fix-possible-integer-overflow.patch diff --git a/meta/recipes-bsp/grub/files/0034-video-fb-video_fb-Fix-possible-integer-overflow.patch b/meta/recipes-bsp/grub/files/0034-video-fb-video_fb-Fix-possible-integer-overflow.patch new file mode 100644 index 0000000000..c82b2c7df0 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0034-video-fb-video_fb-Fix-possible-integer-overflow.patch @@ -0,0 +1,39 @@ +From aac5574ff340a665ccc78d4c3d61596ac67acbbe Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 4 Dec 2020 14:51:30 +0000 +Subject: [PATCH] video/fb/video_fb: Fix possible integer overflow + +It is minimal possibility that the values being used here will overflow. +So, change the code to use the safemath function grub_mul() to ensure +that doesn't happen. + +Fixes: CID 73761 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=08413f2f4edec0e2d9bf15f836f6ee5ca2e379cb] +Signed-off-by: Marta Rybczynska +--- + grub-core/video/fb/video_fb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c +index 1c9a138..ae6b89f 100644 +--- a/grub-core/video/fb/video_fb.c ++++ b/grub-core/video/fb/video_fb.c +@@ -1537,7 +1537,13 @@ doublebuf_pageflipping_init (struct grub_video_mode_info *mode_info, + volatile void *page1_ptr) + { + grub_err_t err; +- grub_size_t page_size = mode_info->pitch * mode_info->height; ++ grub_size_t page_size = 0; ++ ++ if (grub_mul (mode_info->pitch, mode_info->height, &page_size)) ++ { ++ /* Shouldn't happen, but if it does we've a bug. */ ++ return GRUB_ERR_BUG; ++ } + + framebuffer.offscreen_buffer = grub_malloc (page_size); + if (! framebuffer.offscreen_buffer) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 8b5b9e3b3e..04c9b4c092 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -80,6 +80,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0031-video-efi_gop-Remove-unnecessary-return-value-of-gru.patch \ file://0032-video-fb-fbfill-Fix-potential-integer-overflow.patch \ file://0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch \ + file://0034-video-fb-video_fb-Fix-possible-integer-overflow.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4293 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8236DC433EF for ; Fri, 25 Feb 2022 14:28:18 +0000 (UTC) Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.web10.7079.1645799297866462815 for ; Fri, 25 Feb 2022 06:28:17 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=vKTPP++T; spf=softfail (domain: sakoman.com, ip: 209.85.215.177, mailfrom: steve@sakoman.com) Received: by mail-pg1-f177.google.com with SMTP id 195so4795473pgc.6 for ; Fri, 25 Feb 2022 06:28:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=T78WBh3TO3vj763d+pDDcIgHSfV3auRhaxGWyT80l34=; b=vKTPP++T7wWcPlzrAK+atG+Pu+7VJ8UXrD1z/I8hyGJIgF7ss37G4uLv6vhXXmpEi4 NEMWlMnwzMZLeit0f3P62jA3zWq82qFvCFlI86RxCE1ljjYBvwTDflfevLTz3Yp3delE Sdtr6PmA2Rh5ggF4D3OYzKfXs64LHfbUqzauS5AxZ+2JW+pKUcOZzKOiuukT9l5SPnmD rMFOnxNfdxHYwDaIiOGm7AtHOhOK+UU5dBM2SC9TxC37VUT5NmRoZvgP3hYPUOa4Nq5N nZVewHyT+RULO3pn+9QnYStNpCKH8DzxWgCQbUMebJjXvOpzpzB+L+gpOqlc+j/0CMvx uiZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=T78WBh3TO3vj763d+pDDcIgHSfV3auRhaxGWyT80l34=; b=o/UZsaI+9RaNObo33jTqFXqMJq+2uM8NXxommQAZxu5l5rwktOLGuAJMB55qUExUr4 1f3hZ5EOuRJ6Sm4XJWrZonYG3z/30Er4nw8Qy6SfoKEpc75IAyqrFH3ck485loik9JwU /pOlOsQAVhskkGCjv8k5kFP4cUc5uNca+5+xYgxcib7FOssZqeiMByXbSACCNYnxoYIc n1+dKE/QNZKL7yuHaNDX2NHZ68oH5Q3gWfr1VXeiVlwlrfnVG1eX4khvhI9nElXU/JX5 EeaXyjOQ/n+X54hiLpW8bPfqWVuXRfiVxmuTyDo3RSDB17Ufgih39LOkFuhXkeZAG9I2 KqgQ== X-Gm-Message-State: AOAM530h7dinfd5SBPzEfqQYvltFts13PuyiNPhNEKvwPHRy95WpMQgl CsVPZX4SZWMAzJ3RRqnNh2Zv/p93CKVyS+XU X-Google-Smtp-Source: ABdhPJysK/ZfvPiUPamEJAG26v0ag/5HPx4QnKNq9rCtlTIaKOzA+pdoUki3RF7AKhCLYZjqJaNcPA== X-Received: by 2002:a63:a545:0:b0:34c:9ba5:6125 with SMTP id r5-20020a63a545000000b0034c9ba56125mr6316323pgu.392.1645799296896; Fri, 25 Feb 2022 06:28:16 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:16 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 39/50] grub: test for malformed jpeg files Date: Fri, 25 Feb 2022 04:26:19 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162385 From: Marta Rybczynska This patch adds a fix for handling malformed JPEG files in grub's video/readers/jpeg. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...eg-Test-for-an-invalid-next-marker-r.patch | 38 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch diff --git a/meta/recipes-bsp/grub/files/0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch b/meta/recipes-bsp/grub/files/0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch new file mode 100644 index 0000000000..3fca2aecb5 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch @@ -0,0 +1,38 @@ +From 88361a7fd4e481a76e1159a63c9014fa997ef29c Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 4 Dec 2020 15:39:00 +0000 +Subject: [PATCH] video/readers/jpeg: Test for an invalid next marker reference + from a jpeg file + +While it may never happen, and potentially could be caught at the end of +the function, it is worth checking up front for a bad reference to the +next marker just in case of a maliciously crafted file being provided. + +Fixes: CID 73694 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5f5eb7ca8e971227e95745abe541df3e1509360e] +Signed-off-by: Marta Rybczynska +--- + grub-core/video/readers/jpeg.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c +index 31359a4..0b6ce3c 100644 +--- a/grub-core/video/readers/jpeg.c ++++ b/grub-core/video/readers/jpeg.c +@@ -253,6 +253,12 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data) + next_marker = data->file->offset; + next_marker += grub_jpeg_get_word (data); + ++ if (next_marker > data->file->size) ++ { ++ /* Should never be set beyond the size of the file. */ ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid next reference"); ++ } ++ + while (data->file->offset + sizeof (data->quan_table[id]) + 1 + <= next_marker) + { diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 04c9b4c092..75782b7eb2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -81,6 +81,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0032-video-fb-fbfill-Fix-potential-integer-overflow.patch \ file://0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch \ file://0034-video-fb-video_fb-Fix-possible-integer-overflow.patch \ + file://0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4294 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 819A1C433EF for ; Fri, 25 Feb 2022 14:28:20 +0000 (UTC) Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) by mx.groups.io with SMTP id smtpd.web11.6930.1645799299884985686 for ; Fri, 25 Feb 2022 06:28:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=lR1wYcI/; spf=softfail (domain: sakoman.com, ip: 209.85.215.180, mailfrom: steve@sakoman.com) Received: by mail-pg1-f180.google.com with SMTP id 12so4836695pgd.0 for ; Fri, 25 Feb 2022 06:28:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=zu2Ug7485p6yVcpFNr1vpMeeNEJD7vek6QWvEcSiRUc=; b=lR1wYcI/wRB5g2Gnfqv2g2vAeJ7jM6Brm+6quAQE/NvHbpeRRv/Pf8be6QWfgXgUXj 2Mt7mdx4qte5bANABYP8jpSV1SYegrzM8iL3WwvJrnfiDTt29Jg+nh4iBvMtoBmw+YAo UvQA51l+h5Pjn2yy7CmUqoDkzyCgcKczkne6A7Pvpvq35QaMH24V0zHfnjzL9MCbZdcU 80nl5eyMJP0sfM4U7iCUrPjke8kpSNpHNdge1WVr5AKY0aso5yKYuBrf44/MEDPWMVLP kWiqPAVNh6nfBLApK5MLBIFEzTrGj1E9rJ5+ulGx3ocqMHyQOgw5RFjbCuRor8WLfRzp 5mqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=zu2Ug7485p6yVcpFNr1vpMeeNEJD7vek6QWvEcSiRUc=; b=q/TnVTc84/3KyL297SxgxbLs/A6KzqqyHRtDj8CqIYrypuNJqAMVo4CFblFliobTXJ 49ClMYt0yAuW6C6ZGVwTewANUloGkeMD6H+5/TN7IYflLo0SAqhh+aXjW42n6JxAdccK yLKuTZsZcFe2XNYfXgkQS1sCWGVu6yEKYSnMqvVdY4F5JXQxHlchtsVYnKxJWxDLLlyX 2vN+yvaBfJ4TDZptylmctHXmXbpaXag/M/LSVL3BitfDL7/ByO05k9I2VvqGxhggyVKa 9PlAHDlP0AOsZPiGggTcmvxP8OnH1JoIEem+CuQOXtrBU8YpXXJ0zAAiLuuYwDrrKn7q Q9Tg== X-Gm-Message-State: AOAM530EbKqW/rRDMNZeC+2O0pKWVq5JRfvFWVvW+imcoXf1Wpy8pNcg kKLZAEtucFqPzagHlGlnx0/IVbs1B3G91wHo X-Google-Smtp-Source: ABdhPJzdk8bjgKOf/SwLsO09nJ5X3tc98HEdl/w0qQ5Zostnp1RcriRQAK4OaRY0CvQEq03SdmBT7g== X-Received: by 2002:a63:2b4d:0:b0:36c:7c39:b66c with SMTP id r74-20020a632b4d000000b0036c7c39b66cmr6377389pgr.583.1645799298952; Fri, 25 Feb 2022 06:28:18 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:18 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 40/50] grub: remove dead code Date: Fri, 25 Feb 2022 04:26:20 -1000 Message-Id: <0319465b022e211f2a98ba5cee13a68818f5cf87.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162386 From: Marta Rybczynska This patch removes dead code from grub's gfxmenu/gui_list. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...-Remove-code-that-coverity-is-flaggi.patch | 34 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch diff --git a/meta/recipes-bsp/grub/files/0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch b/meta/recipes-bsp/grub/files/0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch new file mode 100644 index 0000000000..61e5e5797d --- /dev/null +++ b/meta/recipes-bsp/grub/files/0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch @@ -0,0 +1,34 @@ +From 9433cb3a37c03f22c2fa769121f1f509fd031ae9 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Mon, 7 Dec 2020 14:44:47 +0000 +Subject: [PATCH] gfxmenu/gui_list: Remove code that coverity is flagging as + dead + +The test of value for NULL before calling grub_strdup() is not required, +since the if condition prior to this has already tested for value being +NULL and cannot reach this code if it is. + +Fixes: CID 73659 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=4a1aa5917595650efbd46b581368c470ebee42ab] +Signed-off-by: Marta Rybczynska +--- + grub-core/gfxmenu/gui_list.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/gfxmenu/gui_list.c b/grub-core/gfxmenu/gui_list.c +index 01477cd..df334a6 100644 +--- a/grub-core/gfxmenu/gui_list.c ++++ b/grub-core/gfxmenu/gui_list.c +@@ -771,7 +771,7 @@ list_set_property (void *vself, const char *name, const char *value) + { + self->need_to_recreate_boxes = 1; + grub_free (self->selected_item_box_pattern); +- self->selected_item_box_pattern = value ? grub_strdup (value) : 0; ++ self->selected_item_box_pattern = grub_strdup (value); + self->selected_item_box_pattern_inherit = 0; + } + } diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 75782b7eb2..1a4be33fca 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -82,6 +82,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0033-video-fb-video_fb-Fix-multiple-integer-overflows.patch \ file://0034-video-fb-video_fb-Fix-possible-integer-overflow.patch \ file://0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch \ + file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4295 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81BBDC433EF for ; Fri, 25 Feb 2022 14:28:22 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.web11.6931.1645799302037729106 for ; Fri, 25 Feb 2022 06:28:22 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=mOKo4mqG; spf=softfail (domain: sakoman.com, ip: 209.85.214.169, mailfrom: steve@sakoman.com) Received: by mail-pl1-f169.google.com with SMTP id e13so4964135plh.3 for ; Fri, 25 Feb 2022 06:28:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=3YqXd2gCh/j35avZ93e2pLFZOiTPC7a29C8nEUxLveA=; b=mOKo4mqG/s8vcJ0lpMbgcUQbBNhpYpZTqB/ZHmOJH5zIcL5IjbGVbcE1y4nEaOfWuB KeenEJsJJbkMQ2QMGGRFO3HpIklhUmAQQLP9e+Wgl7tXyeJdGrcDSzMUtRtKYukK1oXC oRw6er3/l8FcZWIi8U15iG6uYPt4qqO7AONJZ3KrpaJMv5myRBvw/UQS0Sbn7PwFtBXR 7mGbx8KfuifzMLIza8SKpPMl8B8J7uRtcVAfRYkTxoRB+cB86TaBGWp3q5mmZ9+lvozG yqY+sAlmTGWV5ZKPtsTWBmJPWjQOcJpF94QdXXx2SfXL/1JeMX0gmcgdFb0LZ2TrK0ZT 5orQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=3YqXd2gCh/j35avZ93e2pLFZOiTPC7a29C8nEUxLveA=; b=wgHwjGLHAO09PNbMpdCp6BZP09L5JnPwxznkzHUFL+xIExXxdmycEI31TedncqjrLL wD6vDTvEK5P6+0vFPMLnt5rsoe0Eq+rKUS0pbtUwML+8btsMZjS0KZZmxl96e6aRZSw0 bc8FSbVZE1OYqCVrRcraV+WGLaovZ/3sKuDijTSCimbkQjbUNxxEFMBmTzVV4QZP4QWe yhP50/8ypT9GlNOUkXsXf+Oq9nRq4wSaXkgrlJ4D6aOLdMY0+9zSRs2i+TcoK1sD4hGR P8U9mBg+TRqHXq/Mxaf0bLBd3hT/oM083NLMdI2qiJeXi8v650wztoHo5OQg1dv1g4VK 6QpA== X-Gm-Message-State: AOAM532MzRYir4pNkJA0/ZFL6zDlD/RkZDOXPMg4YwPhkgBbkkrzwNSy JLE0eZWCT3IqoI/tpPJ1CrPsrFIGu1joFWe/ X-Google-Smtp-Source: ABdhPJzbHfUy3LJ2N0XInlllLVw9myD59BhzbIMMQd3sBPI+dWjzKgGM7Ui4CmQ9KDwAJfqc9cohCQ== X-Received: by 2002:a17:90a:1548:b0:1b9:d1b7:bb1a with SMTP id y8-20020a17090a154800b001b9d1b7bb1amr3371065pja.125.1645799301022; Fri, 25 Feb 2022 06:28:21 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:20 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 41/50] grub: fix checking for NULL Date: Fri, 25 Feb 2022 04:26:21 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162387 From: Marta Rybczynska This patch adds a fix for checking for NULL in grub's loader/bsd. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ader-bsd-Check-for-NULL-arg-up-front.patch | 47 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0037-loader-bsd-Check-for-NULL-arg-up-front.patch diff --git a/meta/recipes-bsp/grub/files/0037-loader-bsd-Check-for-NULL-arg-up-front.patch b/meta/recipes-bsp/grub/files/0037-loader-bsd-Check-for-NULL-arg-up-front.patch new file mode 100644 index 0000000000..34643e10ab --- /dev/null +++ b/meta/recipes-bsp/grub/files/0037-loader-bsd-Check-for-NULL-arg-up-front.patch @@ -0,0 +1,47 @@ +From 7899384c8fdf9ed96566978c49b0c6e40e70703d Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Tue, 8 Dec 2020 21:47:13 +0000 +Subject: [PATCH] loader/bsd: Check for NULL arg up-front + +The code in the next block suggests that it is possible for .set to be +true but .arg may still be NULL. + +This code assumes that it is never NULL, yet later is testing if it is +NULL - that is inconsistent. + +So we should check first if .arg is not NULL, and remove this check that +is being flagged by Coverity since it is no longer required. + +Fixes: CID 292471 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5d5391b0a05abe76e04c1eb68dcc6cbef5326c4a] +Signed-off-by: Marta Rybczynska +--- + grub-core/loader/i386/bsd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index b92cbe9..8432283 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -1605,7 +1605,7 @@ grub_cmd_openbsd (grub_extcmd_context_t ctxt, int argc, char *argv[]) + kernel_type = KERNEL_TYPE_OPENBSD; + bootflags = grub_bsd_parse_flags (ctxt->state, openbsd_flags); + +- if (ctxt->state[OPENBSD_ROOT_ARG].set) ++ if (ctxt->state[OPENBSD_ROOT_ARG].set && ctxt->state[OPENBSD_ROOT_ARG].arg != NULL) + { + const char *arg = ctxt->state[OPENBSD_ROOT_ARG].arg; + unsigned type, unit, part; +@@ -1622,7 +1622,7 @@ grub_cmd_openbsd (grub_extcmd_context_t ctxt, int argc, char *argv[]) + "unknown disk type name"); + + unit = grub_strtoul (arg, (char **) &arg, 10); +- if (! (arg && *arg >= 'a' && *arg <= 'z')) ++ if (! (*arg >= 'a' && *arg <= 'z')) + return grub_error (GRUB_ERR_BAD_ARGUMENT, + "only device specifications of form " + " are supported"); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 1a4be33fca..8b55afccbb 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -83,6 +83,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0034-video-fb-video_fb-Fix-possible-integer-overflow.patch \ file://0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch \ file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \ + file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4296 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8233EC433EF for ; Fri, 25 Feb 2022 14:28:24 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.web10.7081.1645799304071898615 for ; Fri, 25 Feb 2022 06:28:24 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=75X5SHfu; spf=softfail (domain: sakoman.com, ip: 209.85.216.44, mailfrom: steve@sakoman.com) Received: by mail-pj1-f44.google.com with SMTP id b8so4888402pjb.4 for ; Fri, 25 Feb 2022 06:28:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=brPYRUfnLIuY9pX8ArqVwueidd6qcxJYFhWNI2Zyf0c=; b=75X5SHfuYkD8QTjmyJeeCz0+QXZ331OXu95pB03hm5t9hzy8nVn7qh4q8t3KR6jkug pPDIlckaS7EQEy5dsao5XJSOGWe6DHnoKwxpFJFnco8pO6qthtm/DieA5T6wWDX1/WQd Okb5A3/AQBTzVInu210qrgNWEMGq4eX2NOS83EWRV9WJZcElxWFyAlUEh89XqX6p8Pd7 IZH6UWRQHVDSIVoGij6Y+LlWEdI9ecaWbEXFk0xGFS0i73f5j5qSQyu/C/fc/4xocX0G 8t7mRP9NNtyhj734lNVCaYVKugLbpLidS1lYUTrmblmuj74YG9hP4R0JH3HMDimkb/kL 0lfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=brPYRUfnLIuY9pX8ArqVwueidd6qcxJYFhWNI2Zyf0c=; b=noLkPZVgT6m2NQ5oHB3Es2QQfbPHd1gLZu8J4nReea53R343AvCcK3V1Kd+WEUyRZR oTZcApvW1yYO6wcJBJmgi9Hw5hIwt2G3ZFQKT1da7CCP4y2Om40b6mNMZkUEQe9fDLO8 cTlj3kKLR7aDZRNvbjAbL2INyM21/eX0j86HE8aU8q1zJHCTP3lA+vo0J1dR3fT9N8AW 4w0DkOU39ftyaqu0Q8Mjo7I/zg5KPvND5yozj5h1ZKbdvhZgKV079UXTeYXFhcwhDmyu r5RU9YdAw8jRJl18IJmEPjq+5mBJZztgJkjPawHeLN5KHt7OJJqd7tKa+NBQyXATD7Pm Q93Q== X-Gm-Message-State: AOAM530BSCaf043aL6n8t0vf1+mN8zX88lbpzkMXyE1zTD+q7kCTKOIX EpL4VCR3qj1ZoGDIgWszwQtYjz+bjzfkLBJk X-Google-Smtp-Source: ABdhPJxVPTSxsVN7wueV9XI9jSopc14OIhXO0rFIkQEPZ/lGopN2i+loZh4a8rnY3CV1SljlGS3dEw== X-Received: by 2002:a17:902:ec92:b0:14f:e593:5e99 with SMTP id x18-20020a170902ec9200b0014fe5935e99mr7878071plg.42.1645799303106; Fri, 25 Feb 2022 06:28:23 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:22 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 42/50] grub: add a fix for a memory leak Date: Fri, 25 Feb 2022 04:26:22 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162388 From: Marta Rybczynska This patch adds a fix for a memory leak in grub's loader/xnu. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- .../0038-loader-xnu-Fix-memory-leak.patch | 38 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0038-loader-xnu-Fix-memory-leak.patch diff --git a/meta/recipes-bsp/grub/files/0038-loader-xnu-Fix-memory-leak.patch b/meta/recipes-bsp/grub/files/0038-loader-xnu-Fix-memory-leak.patch new file mode 100644 index 0000000000..41f09a22fc --- /dev/null +++ b/meta/recipes-bsp/grub/files/0038-loader-xnu-Fix-memory-leak.patch @@ -0,0 +1,38 @@ +From 0a4aa7c16f65cdfaa1013f0796afa929f8d6dc1a Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 26 Nov 2020 12:53:10 +0000 +Subject: [PATCH] loader/xnu: Fix memory leak + +The code here is finished with the memory stored in name, but it only +frees it if there curvalue is valid, while it could actually free it +regardless. + +The fix is a simple relocation of the grub_free() to before the test +of curvalue. + +Fixes: CID 96646 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=bcb59ece3263d118510c4440c4da0950f224bb7f] +Signed-off-by: Marta Rybczynska +--- + grub-core/loader/xnu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index 07232d2..b3029a8 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -1388,9 +1388,9 @@ grub_xnu_fill_devicetree (void) + name[len] = 0; + + curvalue = grub_xnu_create_value (curkey, name); ++ grub_free (name); + if (!curvalue) + return grub_errno; +- grub_free (name); + + data = grub_malloc (grub_strlen (var->value) + 1); + if (!data) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 8b55afccbb..c9e7a06a3f 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -84,6 +84,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0035-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch \ file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \ file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \ + file://0038-loader-xnu-Fix-memory-leak.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4297 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 828ABC433F5 for ; Fri, 25 Feb 2022 14:28:27 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.web08.6808.1645799306363082527 for ; Fri, 25 Feb 2022 06:28:26 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=r5ivn/OU; spf=softfail (domain: sakoman.com, ip: 209.85.215.179, mailfrom: steve@sakoman.com) Received: by mail-pg1-f179.google.com with SMTP id e6so3397786pgn.2 for ; Fri, 25 Feb 2022 06:28:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=eAHOlyKavLL/MuANQ9JIrL4rPw+3TZBCc6evPMFXlhk=; b=r5ivn/OUytNmDwYmgh+JlxNDf+b8KyYZTCpIEzCYWJAbFTf/spxmO1BPc3l5c7/4+m 20AnLlXyF+UHA2E+BlHbKCCFaffWpR7XoBo/JdEkxxuJzgSCQ/39nvdprD4taOeXf2CU To50CmYQ8QNqf+L0iXL6OPlRRsKI4ffZrn0LfcIN2YosB6ikTvuyWtgpOhg2Xft4ro6n a9luAKjRe8NZkzyS+PqY4F3ar1QL294yz5ts5xQoFI9cniSA0dcPJDBU6uUVOqNm9FkB zM0jhmx1tHDi7KRn9XCdgZMZ0xe0Ty2GYhGaqD6HlH2DWzb19lBUwVa1+aO0+oQBKZvi 4Acg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=eAHOlyKavLL/MuANQ9JIrL4rPw+3TZBCc6evPMFXlhk=; b=Kkv6xz54reYQn8wk7xJJW35XfXVlsKcdjY+autFUJfYhgMVhc1ikm8o4GcjvnkY4du ELYNfbshpviBkD3+ondW2fnXzdcwiQL1d+7vwXw/EsCuHNL6reauSsWWn/Y7ttVKSe/1 YaAlRXXztoo7QjqKb+PxvDpLzxBgyWU8wv1PYhHyXWGO4KWu5J2udBZzyA7hqEchPOUM l+BfCWeqwcnDY4V/0DecVlx8rlZWQUnxbfDeVrOQg5dctHQ0TZJ2Cej7b9MqMc2rS3VU xw1VhF499pQWBHvPK44KWBcTBET4CasfZxio7O5+w+iPpMVgzN12/txkhioydGqNrI4E XEog== X-Gm-Message-State: AOAM530p8Vhoa3Fncm/b8tGyxB8wpMzb9nC28AaUgwm+JjNEBr3n+XCu 5BHAlbo+40cNdbTCP3ys9IuWCHSrVebUxcpj X-Google-Smtp-Source: ABdhPJzjZ8zzHDeK98e/8JFOQKvctXrUTPwcyqzjIv0rqSyrnupkXXrwTEkN5w4Ak5rJAuh5DnwsaQ== X-Received: by 2002:aa7:8890:0:b0:4e1:b25b:634c with SMTP id z16-20020aa78890000000b004e1b25b634cmr8104268pfe.31.1645799305153; Fri, 25 Feb 2022 06:28:25 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:24 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 43/50] grub: avoid a memory leak Date: Fri, 25 Feb 2022 04:26:23 -1000 Message-Id: <265baabc6e7ce4962c22489158dba113e0d74b91.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162389 From: Marta Rybczynska This patch fixes a memory leak in grub's loader/xnu when an error is detected in grub_xnu_writetree_toheap(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...driverkey-data-when-an-error-is-dete.patch | 77 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch diff --git a/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch b/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch new file mode 100644 index 0000000000..f9ad0fc34c --- /dev/null +++ b/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch @@ -0,0 +1,77 @@ +From 81117a77a9e945ee5e7c1f12bd5667e2a16cbe32 Mon Sep 17 00:00:00 2001 +From: Marco A Benatto +Date: Mon, 30 Nov 2020 12:18:24 -0300 +Subject: [PATCH] loader/xnu: Free driverkey data when an error is detected in + grub_xnu_writetree_toheap() + +... to avoid memory leaks. + +Fixes: CID 96640 + +Signed-off-by: Marco A Benatto +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=4b4027b6b1c877d7ab467896b04c7bd1aadcfa15] +Signed-off-by: Marta Rybczynska +--- + grub-core/loader/xnu.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index b3029a8..39ceff8 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -224,26 +224,33 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size) + if (! memorymap) + return grub_errno; + +- driverkey = (struct grub_xnu_devtree_key *) grub_malloc (sizeof (*driverkey)); ++ driverkey = (struct grub_xnu_devtree_key *) grub_zalloc (sizeof (*driverkey)); + if (! driverkey) + return grub_errno; + driverkey->name = grub_strdup ("DeviceTree"); + if (! driverkey->name) +- return grub_errno; ++ { ++ err = grub_errno; ++ goto fail; ++ } ++ + driverkey->datasize = sizeof (*extdesc); + driverkey->next = memorymap->first_child; + memorymap->first_child = driverkey; + driverkey->data = extdesc + = (struct grub_xnu_extdesc *) grub_malloc (sizeof (*extdesc)); + if (! driverkey->data) +- return grub_errno; ++ { ++ err = grub_errno; ++ goto fail; ++ } + + /* Allocate the space based on the size with dummy value. */ + *size = grub_xnu_writetree_get_size (grub_xnu_devtree_root, "/"); + err = grub_xnu_heap_malloc (ALIGN_UP (*size + 1, GRUB_XNU_PAGESIZE), + &src, target); + if (err) +- return err; ++ goto fail; + + /* Put real data in the dummy. */ + extdesc->addr = *target; +@@ -252,6 +259,15 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size) + /* Write the tree to heap. */ + grub_xnu_writetree_toheap_real (src, grub_xnu_devtree_root, "/"); + return GRUB_ERR_NONE; ++ ++ fail: ++ memorymap->first_child = NULL; ++ ++ grub_free (driverkey->data); ++ grub_free (driverkey->name); ++ grub_free (driverkey); ++ ++ return err; + } + + /* Find a key or value in parent key. */ diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index c9e7a06a3f..eebe9a7233 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -85,6 +85,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \ file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \ file://0038-loader-xnu-Fix-memory-leak.patch \ + file://0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4298 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8020EC433EF for ; Fri, 25 Feb 2022 14:28:28 +0000 (UTC) Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by mx.groups.io with SMTP id smtpd.web10.7082.1645799308105425316 for ; Fri, 25 Feb 2022 06:28:28 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=736hGUEm; spf=softfail (domain: sakoman.com, ip: 209.85.210.175, mailfrom: steve@sakoman.com) Received: by mail-pf1-f175.google.com with SMTP id l19so4843260pfu.2 for ; Fri, 25 Feb 2022 06:28:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=GUKCIkM2lQIlLnuT8xl6BfYo2rcOXiOHuFOzeW+3xvg=; b=736hGUEmTGvZeqZp+fT037gknVJYPEyP6zhDaH6XwDGjQhlTpQnzQ6BCkaa++AGdBE 1vvL14E8NfwXRzJFEAAYHVriXS9eXHN3swmOhGbDIm65IXIZuYvhQKRlzgG+gQgWCG9T mVho/K6oJLGxl4KMrXxFmlvF7/utJ2NOktUfjqP/z+eKxpaX0C1P11u2LoaeOnWlVyAW iOUzp3CHF5QMppVHgGZLMGkYhJdHWBzKGbMoE1Kjfpz33DY9+MUPUjrT+k0toxFNbzWT gByWkZClLNL2moHuBdHW7lhBMKSPtfyAl/+EhHf/AipFfMkW0QomgLjOErKqPSOOZOh/ cJzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=GUKCIkM2lQIlLnuT8xl6BfYo2rcOXiOHuFOzeW+3xvg=; b=y5epbBVW0yHhrRoMRJtl2+YmOgSZ5I5ktmE2R5WG+pTXEusMUe5wjPwvGzVIGOktaT /4md66XqoGTRqaaj40SH/dDfQN0TKycHmJxpiDoA9uEtNzoC2Bq5A3rWQHamBBGY46uk KgtLWNrg55z6Q6dMLLdA9BVNoTiF7D1sfzSIljw2R1kkbDHIAG4ZzIxBV9Pbt1dbMqP2 RD/21JLobreM+vriVQFXErO84q5ACIYopECAvPVR9sSkMSvvcc4fBhDNZmatBXt2t1bJ 4e8LIg8ply7rRCeblgF9RIlS9o2xLxUIrZRG1PJ9znkwRYiOA8nHa1v+HzauA7tv4oTU ulpg== X-Gm-Message-State: AOAM530/nVlnGA7JOwOpg+YVl9az52bfNE4WvjZ+KJyAm8z4rAt0lARa nxFjngVt8G9RlYsgPHLiBRGIDiAlib6oUgXR X-Google-Smtp-Source: ABdhPJwvblfGKRjd3FH25i64agcdPAZux8fG3thOTUa8n9XVwJlVklXpMgedEYy2NP/Wfvca19vHNA== X-Received: by 2002:a63:5323:0:b0:375:9c2b:9716 with SMTP id h35-20020a635323000000b003759c2b9716mr4957256pgb.150.1645799307131; Fri, 25 Feb 2022 06:28:27 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:26 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 44/50] grub: add a check for a NULL pointer Date: Fri, 25 Feb 2022 04:26:24 -1000 Message-Id: <1d95061ecdc920835df44c0c3ed274193f26948e.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162390 From: Marta Rybczynska This patch adds a check for a NULL pointer before use in grub's loader/xnu. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...k-if-pointer-is-NULL-before-using-it.patch | 42 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch diff --git a/meta/recipes-bsp/grub/files/0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch b/meta/recipes-bsp/grub/files/0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch new file mode 100644 index 0000000000..8081f7763a --- /dev/null +++ b/meta/recipes-bsp/grub/files/0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch @@ -0,0 +1,42 @@ +From 778a3fffd19229e5650a1abfb06c974949991cd4 Mon Sep 17 00:00:00 2001 +From: Paulo Flabiano Smorigo +Date: Mon, 30 Nov 2020 10:36:00 -0300 +Subject: [PATCH] loader/xnu: Check if pointer is NULL before using it + +Fixes: CID 73654 + +Signed-off-by: Paulo Flabiano Smorigo +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7c8a2b5d1421a0f2a33d33531f7561f3da93b844] +Signed-off-by: Marta Rybczynska +--- + grub-core/loader/xnu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index 39ceff8..adc048c 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -667,6 +667,9 @@ grub_xnu_load_driver (char *infoplistname, grub_file_t binaryfile, + char *name, *nameend; + int namelen; + ++ if (infoplistname == NULL) ++ return grub_error (GRUB_ERR_BAD_FILENAME, N_("missing p-list filename")); ++ + name = get_name_ptr (infoplistname); + nameend = grub_strchr (name, '/'); + +@@ -698,10 +701,7 @@ grub_xnu_load_driver (char *infoplistname, grub_file_t binaryfile, + else + macho = 0; + +- if (infoplistname) +- infoplist = grub_file_open (infoplistname, GRUB_FILE_TYPE_XNU_INFO_PLIST); +- else +- infoplist = 0; ++ infoplist = grub_file_open (infoplistname, GRUB_FILE_TYPE_XNU_INFO_PLIST); + grub_errno = GRUB_ERR_NONE; + if (infoplist) + { diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index eebe9a7233..fad7415e0d 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -86,6 +86,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \ file://0038-loader-xnu-Fix-memory-leak.patch \ file://0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch \ + file://0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4299 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8305AC433F5 for ; Fri, 25 Feb 2022 14:28:31 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.web10.7084.1645799310819070901 for ; Fri, 25 Feb 2022 06:28:30 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=l5JmAaFN; spf=softfail (domain: sakoman.com, ip: 209.85.214.170, mailfrom: steve@sakoman.com) Received: by mail-pl1-f170.google.com with SMTP id c9so4994286pll.0 for ; Fri, 25 Feb 2022 06:28:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=xEvSBxA2a8OQEcjrliGI3HuzBSASancq468k0v/m300=; b=l5JmAaFNRzLNykRp/VQvio1eQ1PABlt9QvDp1BC9ErWq4Dh45NeFRApwS2DEpeYQXe r00CJ6AlZV3e6aFtY7K3hJvmfbX6+sjyeeKoidO4jp/MPmy5hx8lfYHGNxHWuG76tCLX QumJxp8T7V8KEkW/J35i9m3OXZV7I1pIBXVQKM2X9X90K1qkbgqRF29cdLHdLIQSJW34 XrLw79N60UxMZU/zKB+Twmd0d5VO6CrsanCkjpllhydOnmd0065EG9162+kI6wdEpWfc HfbtzWmmR9Aqg67kDBToYr52wL+uSBEF9e6Q4tUlLhcfjp7hLTnxoQsXshx0G3IYWzuN c67w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=xEvSBxA2a8OQEcjrliGI3HuzBSASancq468k0v/m300=; b=721KofcVBWen5bXKO6sYuuroOLvYOKvufmUueh3yc95Q8NtMZoh+jNBKmwX5mavV27 tAGtv81PJRUfeif1wf6Q+qCtO515ZGlzE/SEDIF5kwJ8Lkq4L8ZgN4k/Lwqwx2MPZ4jv R+pUa0BUcyqIE0b7ftwPYh1og4WHDPXdAjG9C+1UueMcYKLsxu8wxaur/9Ny05wB9v0L MoRBfFkc29xpfASIE7AwBVPFyka17K3A83Ei0Cyy+9r1eppGJYaJEcuFLFFZwDq7pFzr 5gNl05DuywsgMgIEWNilOFxxlWXY8t8sq01d2YV7hh1B2iSDhfgLnhbCCNc0CBHd5nLg fBXQ== X-Gm-Message-State: AOAM530omfCmT7Q+ttXcRv393xOdrMUu6Yrv5PJlCEqiROsofq2S8H7g oWnklEg0u5SDvegdIwdZuNfUGpODCzzUkkS8 X-Google-Smtp-Source: ABdhPJyz7mn86W2cf3e8RjuEarny8KcWF4jjTYEjAsoEbWpnEiv/IB5FVA3qpbBq/PcGlazAWMlPVA== X-Received: by 2002:a17:902:ef4c:b0:14f:7548:dae3 with SMTP id e12-20020a170902ef4c00b0014f7548dae3mr7712465plx.92.1645799309853; Fri, 25 Feb 2022 06:28:29 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:29 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 45/50] grub: add a fix for NULL pointer dereference Date: Fri, 25 Feb 2022 04:26:25 -1000 Message-Id: <35310bcfd53752081ed600e77f58ca3fb8db46ac.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162391 From: Marta Rybczynska This patch adds a fix for a NULL pointer dereference in grub's util/grub-install. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...nstall-Fix-NULL-pointer-dereferences.patch | 41 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0041-util-grub-install-Fix-NULL-pointer-dereferences.patch diff --git a/meta/recipes-bsp/grub/files/0041-util-grub-install-Fix-NULL-pointer-dereferences.patch b/meta/recipes-bsp/grub/files/0041-util-grub-install-Fix-NULL-pointer-dereferences.patch new file mode 100644 index 0000000000..ea563a41a0 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0041-util-grub-install-Fix-NULL-pointer-dereferences.patch @@ -0,0 +1,41 @@ +From 5d2dd0052474a882a22e47cc8c3ed87a01819f6b Mon Sep 17 00:00:00 2001 +From: Daniel Kiper +Date: Thu, 25 Feb 2021 18:35:01 +0100 +Subject: [PATCH] util/grub-install: Fix NULL pointer dereferences + +Two grub_device_open() calls does not have associated NULL checks +for returned values. Fix that and appease the Coverity. + +Fixes: CID 314583 + +Signed-off-by: Daniel Kiper +Reviewed-by: Javier Martinez Canillas + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=8b3a95655b4391122e7b0315d8cc6f876caf8183] +Signed-off-by: Marta Rybczynska +--- + util/grub-install.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/util/grub-install.c b/util/grub-install.c +index a82725f..367350f 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -1775,6 +1775,8 @@ main (int argc, char *argv[]) + fill_core_services (core_services); + + ins_dev = grub_device_open (install_drive); ++ if (ins_dev == NULL) ++ grub_util_error ("%s", grub_errmsg); + + bless (ins_dev, core_services, 0); + +@@ -1875,6 +1877,8 @@ main (int argc, char *argv[]) + fill_core_services(core_services); + + ins_dev = grub_device_open (install_drive); ++ if (ins_dev == NULL) ++ grub_util_error ("%s", grub_errmsg); + + bless (ins_dev, boot_efi, 1); + if (!removable && update_nvram) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index fad7415e0d..7ca0b469e9 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -87,6 +87,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0038-loader-xnu-Fix-memory-leak.patch \ file://0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch \ file://0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch \ + file://0041-util-grub-install-Fix-NULL-pointer-dereferences.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4300 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 829ACC433EF for ; Fri, 25 Feb 2022 14:28:33 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.web09.6946.1645799313233140360 for ; Fri, 25 Feb 2022 06:28:33 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=MINZ+jhc; spf=softfail (domain: sakoman.com, ip: 209.85.215.178, mailfrom: steve@sakoman.com) Received: by mail-pg1-f178.google.com with SMTP id 132so4794516pga.5 for ; Fri, 25 Feb 2022 06:28:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=43BZAjoR3xkOZfygsBD8XxejPmOMMqWpmVIluChVhPU=; b=MINZ+jhcqaXxaoXDgDRq/2lKXThJHJ4hWq4lPKyT1ctpa8qJMnMlngCNSw+7bj0GNy jaZ1w/OG3642n/BIbVkTpub37cACqY1uNDNp4NLOVV4QQy8GL3wCahbOPg8usCEftFx0 Ot+mQJdjrhiNydazMEBddzALwlJhbzWWR+oVrhWixtgGhgvigVS/NBw4yw/mGM+l2Ag9 YpYOq4caaM2Bg7Hx0NomZQwpxr68yMg+/J1nyeZ7FMTzfDaX0kQ8iMsfmMvBEBVCKHlZ zK1atdbruKx15Yx1KDSYRqln+U1yZC8b6IevgSvd2QNR5dgE0Du/3eX2yojdUi0RmTEQ pyiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=43BZAjoR3xkOZfygsBD8XxejPmOMMqWpmVIluChVhPU=; b=EnzIw9EFHUvJurB2ft3X5n9gr3Kjnipj0BNRoVfv6fPXhiuE/DECiJpFMmqAmkAldn +4fAywArOMaa10kKirw/XEazKhgp0X8fc7fxOhbno6sYOEUYERaiMmSGkUmCrPIpTOf0 q7m5fJRXMSBjCJOOkfyuX6YttSrOUcpX1hDbIHGxqrKgvCdVMv7/r7rNZsBWweIsXJNL fQTOF2G8zr8iEepaF+zYjxicktlw8W0QJHH+FPpQ4PiX8yyIp+fkNsEKZOCRMt92i+ur UqcX2zTXYFufxm/uvIRAMA7+3NLDWnMDvYgktMNzBBJCBQ+4PfMWsU/ud2+6SlYvM61W lsnA== X-Gm-Message-State: AOAM531V/4mUpL3ywncc0XcH4uK9+iNEqMaUrFjnB80VvN+lVyiAJO6Q SNb9+P84nYHrKylHfNHk3BsQFbdAcOKvumia X-Google-Smtp-Source: ABdhPJyC538LA2DzeLc0q5R6SBU4ZJfuOyqMr7e/tCeHNHATlJvCamV4DeAq3ND2TZ8K/s/BjRwAVQ== X-Received: by 2002:a62:ce87:0:b0:4e0:cf48:e564 with SMTP id y129-20020a62ce87000000b004e0cf48e564mr7995920pfg.15.1645799312176; Fri, 25 Feb 2022 06:28:32 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:31 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 46/50] grub: add a fix for an incorrect cast Date: Fri, 25 Feb 2022 04:26:26 -1000 Message-Id: <906ecdc9efbc1b4025c2c7a9797ebd374f8508af.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162392 From: Marta Rybczynska This patch adds a fix for incorrect casting from signed to unsigned in grub's util/grub-editenv. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...v-Fix-incorrect-casting-of-a-signed-.patch | 46 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch diff --git a/meta/recipes-bsp/grub/files/0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch b/meta/recipes-bsp/grub/files/0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch new file mode 100644 index 0000000000..0cd8ec3611 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch @@ -0,0 +1,46 @@ +From 3d68daf2567aace4b52bd238cfd4a8111af3bc04 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Thu, 5 Nov 2020 14:33:50 +0000 +Subject: [PATCH] util/grub-editenv: Fix incorrect casting of a signed value + +The return value of ftell() may be negative (-1) on error. While it is +probably unlikely to occur, we should not blindly cast to an unsigned +value without first testing that it is not negative. + +Fixes: CID 73856 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5dc41edc4eba259c6043ae7698c245ec1baaacc6] +Signed-off-by: Marta Rybczynska +--- + util/grub-editenv.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index f3662c9..db6f187 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -125,6 +125,7 @@ open_envblk_file (const char *name) + { + FILE *fp; + char *buf; ++ long loc; + size_t size; + grub_envblk_t envblk; + +@@ -143,7 +144,12 @@ open_envblk_file (const char *name) + grub_util_error (_("cannot seek `%s': %s"), name, + strerror (errno)); + +- size = (size_t) ftell (fp); ++ loc = ftell (fp); ++ if (loc < 0) ++ grub_util_error (_("cannot get file location `%s': %s"), name, ++ strerror (errno)); ++ ++ size = (size_t) loc; + + if (fseek (fp, 0, SEEK_SET) < 0) + grub_util_error (_("cannot seek `%s': %s"), name, diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 7ca0b469e9..a1fbc5e644 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -88,6 +88,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch \ file://0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch \ file://0041-util-grub-install-Fix-NULL-pointer-dereferences.patch \ + file://0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4301 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 824F9C433EF for ; Fri, 25 Feb 2022 14:28:36 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.web09.6948.1645799315468134622 for ; Fri, 25 Feb 2022 06:28:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Xca332Ea; spf=softfail (domain: sakoman.com, ip: 209.85.214.171, mailfrom: steve@sakoman.com) Received: by mail-pl1-f171.google.com with SMTP id x11so4937628pll.10 for ; Fri, 25 Feb 2022 06:28:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=kC2zMHF1JphdvMDUYYxIZrqFaKhFDTd+y9bN7NEGlQk=; b=Xca332Ea3Ldx3LRCdWtW6v0Mne21QGg4BMH+L+S539jTApCWosEnOphmCyiYA/tCxn o3k3wWEiq0FUuryA17F3pNvhhLp8ERjTOWg770hZMsmYU4h+m10vY7GhyiVyQqBI7ncW 0Pqc3XigCE1OuYd+aJ3YSle75zxOkC97tAFB0G+1Uog8udErOuR3EP7WO0cCNDKg6Ikm YnByp6hWNPRqA2Bc38qhAGXwM+HjP3fCHCQm5kRXLGDsRYhT6TLuIrHdbB3DGrYJf38q tgfYl3B6MZPbhW/m7LiQNIvH4Orcm212AM/lMUDHUXQ9+2dZ6WFBZNFhGu1j0b0I2QbG 2epA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kC2zMHF1JphdvMDUYYxIZrqFaKhFDTd+y9bN7NEGlQk=; b=0H84NkfnC0djULlmdllpkJn1Ev7p/MYYaBGp6tVlVS/Dox3fiHI6XTiB3KKoymjqTe E6JGlPBPZqPYkWW2IR2tp6OO6roa24XeiheOMYsTgpMtqz1Ypbgj4SbM+uyzNC9/szwe uki+H5OvhOszEoVseBdyYQSpe1u1ZW/p+H4RP4jDif3vki6lJ5hvjk3ze7fntJSUtq6h /ZtH8FvkEESr3/+7pyklsu+C+Lga9F1h6XNChQpZG5ddzWugdxA3LhnHE6erPngfKdsc cdSbcv0C6jRVIHJFJQ0i594YYmnKnKzYFHlXFC5WK+5Fvc9SSkj6j2GBIaDOs+WoHYd6 bS5Q== X-Gm-Message-State: AOAM5301R+/cvkLTfz0evaAPhuBnInadwAgFbJbNr6SIwc3Uh+K9lEGA eJVSX+VJlZ8Gqg7ofwY062RFSMvWfqsfjqfE X-Google-Smtp-Source: ABdhPJyLylTqtnTL7ouPUrkOP4ax5vOIG92J5OcE6LybWpBW3js+btpv+PeCZ5fbTPpwh4gRjux2ng== X-Received: by 2002:a17:902:6b47:b0:150:1f58:44c3 with SMTP id g7-20020a1709026b4700b001501f5844c3mr5631478plt.127.1645799314505; Fri, 25 Feb 2022 06:28:34 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:33 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 47/50] grub: fix incorrect use of a negative value Date: Fri, 25 Feb 2022 04:26:27 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162393 From: Marta Rybczynska This patch adds a fix for an incorrect use of a negative value in grub's util/glue-efi. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...x-incorrect-use-of-a-possibly-negati.patch | 50 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch diff --git a/meta/recipes-bsp/grub/files/0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch b/meta/recipes-bsp/grub/files/0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch new file mode 100644 index 0000000000..66d7c0aa42 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch @@ -0,0 +1,50 @@ +From e301a0f38a2130eb80f346c31e43bf5089af583c Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 4 Dec 2020 15:04:28 +0000 +Subject: [PATCH] util/glue-efi: Fix incorrect use of a possibly negative value + +It is possible for the ftell() function to return a negative value, +although it is fairly unlikely here, we should be checking for +a negative value before we assign it to an unsigned value. + +Fixes: CID 73744 + +Signed-off-by: Darren Kenny +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=1641d74e16f9d1ca35ba1a87ee4a0bf3afa48e72] +Signed-off-by: Marta Rybczynska +--- + util/glue-efi.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/util/glue-efi.c b/util/glue-efi.c +index 68f5316..de0fa6d 100644 +--- a/util/glue-efi.c ++++ b/util/glue-efi.c +@@ -39,13 +39,23 @@ write_fat (FILE *in32, FILE *in64, FILE *out, const char *out_filename, + struct grub_macho_fat_header head; + struct grub_macho_fat_arch arch32, arch64; + grub_uint32_t size32, size64; ++ long size; + char *buf; + + fseek (in32, 0, SEEK_END); +- size32 = ftell (in32); ++ size = ftell (in32); ++ if (size < 0) ++ grub_util_error ("cannot get end of input file '%s': %s", ++ name32, strerror (errno)); ++ size32 = (grub_uint32_t) size; + fseek (in32, 0, SEEK_SET); ++ + fseek (in64, 0, SEEK_END); +- size64 = ftell (in64); ++ size = ftell (in64); ++ if (size < 0) ++ grub_util_error ("cannot get end of input file '%s': %s", ++ name64, strerror (errno)); ++ size64 = (grub_uint64_t) size; + fseek (in64, 0, SEEK_SET); + + head.magic = grub_cpu_to_le32_compile_time (GRUB_MACHO_FAT_EFI_MAGIC); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index a1fbc5e644..2f230065b2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -89,6 +89,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0040-loader-xnu-Check-if-pointer-is-NULL-before-using-it.patch \ file://0041-util-grub-install-Fix-NULL-pointer-dereferences.patch \ file://0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch \ + file://0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4302 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82ADEC433F5 for ; Fri, 25 Feb 2022 14:28:38 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.web11.6939.1645799317754911228 for ; Fri, 25 Feb 2022 06:28:37 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=4/LK6GcW; spf=softfail (domain: sakoman.com, ip: 209.85.214.173, mailfrom: steve@sakoman.com) Received: by mail-pl1-f173.google.com with SMTP id ay5so2137087plb.1 for ; Fri, 25 Feb 2022 06:28:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=Lwn0NSUIGNYtSlUStd8OtEfW1Yjwd0d4hwnK46Mch68=; b=4/LK6GcWd/4FNeftFF4fRtD4H0zh3HelZO/2104ldKO3l05o2CvVRpIKJwB+xIyj3a ZBTM8Y2BM38XX7shEcvpn2ThIYpq1KVLFY/Hn2yqm0Vm5iWBboVmPWOOia9ajmDc+jcK DCnEhdN+38ssFF0j5vcbWwpXkiQq7isYZihkKxWZA69b7ClYCQwnvHr3sHbbLs1fUB7y TlwHrwK9tcB3MLIuVLQG7jpFcnl5q0XdRpF8eGAhnLjdGhS/6ENN6bLqIAocC95Idx29 URaHDz3gfZTvh/pXWQX3BREYur35Uw5FQd4NsVoeTR1weqH8vG7F2zQcnRQKam43NrKW gGHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Lwn0NSUIGNYtSlUStd8OtEfW1Yjwd0d4hwnK46Mch68=; b=63KqC6JU347UBAdFwNwnPfxBIgVDqXyAMFCIVfxlohhv0h9TcrTErmHQq5O/fHFz9v ZC44lftpEVDfcgxmgVBgPoWhtx///llDGiZXeFQWK582s3Q8KgLhnTtpTofe7EUnkk5L chCwxp7O73S+oxzxJmRpQE2KGcR24mT5HbWIKasfHb/zgenrPQNzAlksKoYmTcTIzMg3 KZr17KBwJ5S0v/IV8cBhDlpXhvxqCdm+Hs2WRzfGYTiFtVg6kPnJCio/Ova+e/wcaUAA KThAJBJku6b/d4I3vAaco8VMnh4EhaSf4JTu1Xeh8O4yrtpxnG2I5U5TTyG7hla/WL0r Fz9g== X-Gm-Message-State: AOAM531pKZuxzCc1y23OPspkMXyZerEzj9CdZ2q3VhZrr4K8DS7ypyx9 F7rHZF0mlx9bDsLJrLLE2adk/RrI0Hq6eICS X-Google-Smtp-Source: ABdhPJyOL6Z2VnZ+NrwcrKMijR6GsAAPLvATUBrSprBXtFdD3afMMr+YkbsYVGcDeh44Z2R9cFSMUQ== X-Received: by 2002:a17:90a:a887:b0:1bc:388a:329f with SMTP id h7-20020a17090aa88700b001bc388a329fmr3434640pjq.17.1645799316735; Fri, 25 Feb 2022 06:28:36 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:36 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 48/50] grub: add a fix for a NULL pointer dereference Date: Fri, 25 Feb 2022 04:26:28 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162394 From: Marta Rybczynska This patch adds a fix for a NULL pointer dereference in grub's script/execute. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ix-NULL-dereference-in-grub_script_e.patch | 28 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch diff --git a/meta/recipes-bsp/grub/files/0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch b/meta/recipes-bsp/grub/files/0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch new file mode 100644 index 0000000000..b279222fff --- /dev/null +++ b/meta/recipes-bsp/grub/files/0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch @@ -0,0 +1,28 @@ +From f5fb56954e5926ced42a980c3e0842ffd5fea2aa Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Fri, 3 Apr 2020 23:05:13 +1100 +Subject: [PATCH] script/execute: Fix NULL dereference in + grub_script_execute_cmdline() + +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=41ae93b2e6c75453514629bcfe684300e3aec0ce] +Signed-off-by: Marta Rybczynska +--- + grub-core/script/execute.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 7e028e1..5ea2aef 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -940,7 +940,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd) + struct grub_script_argv argv = { 0, 0, 0 }; + + /* Lookup the command. */ +- if (grub_script_arglist_to_argv (cmdline->arglist, &argv) || ! argv.args[0]) ++ if (grub_script_arglist_to_argv (cmdline->arglist, &argv) || ! argv.args || ! argv.args[0]) + return grub_errno; + + for (i = 0; i < argv.argc; i++) diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 2f230065b2..84b8b8d1be 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -90,6 +90,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0041-util-grub-install-Fix-NULL-pointer-dereferences.patch \ file://0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch \ file://0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch \ + file://0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4303 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84709C433EF for ; Fri, 25 Feb 2022 14:28:40 +0000 (UTC) Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by mx.groups.io with SMTP id smtpd.web08.6812.1645799319841714352 for ; Fri, 25 Feb 2022 06:28:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=w0uPEGZO; spf=softfail (domain: sakoman.com, ip: 209.85.210.172, mailfrom: steve@sakoman.com) Received: by mail-pf1-f172.google.com with SMTP id u16so4807268pfg.12 for ; Fri, 25 Feb 2022 06:28:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=2bfkTwraJcO/IJdTCpajZPK99RDrvkOdLMJM4XioSBE=; b=w0uPEGZOB23o6t26qH3p05R8Hs0Bw7rtj0rTsM/sLeJT1kMQR0WqloH3TpbzVjo+AP ATh2lODPTicBcgf7ldDIFKZcW+8lJ3NEgEBXXtLOAwZ/Obb7aQlBvyAiO5s6idbAU0+v oVQRxePBlDsC5HR8ieF3LnnmB4h2+afvOaVqVFSXvVYbHzvA0RazLJkLSul+Bg09BQUT PqGVChrP2XjvxMwK8oFD++2Z44rGho0ioe5eExjp55w2e7Oxj+qLgHy8zzDwHufVYptt 0/coPgly1N5kPruEEE/DSOGAo0O7aOEdqkCtGbZvX1XbT1til9JdyIK9SU3kgIMP7nVY H6CQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=2bfkTwraJcO/IJdTCpajZPK99RDrvkOdLMJM4XioSBE=; b=eDIv9FcxKGNZz0fIpy4wPi26YvHNKbHFr9JDESrxCdCjfPDHB8v7c5xsjV9rsdtIwr 5F9frVYiqDjmnJ5XkOSZPuprqp4qrPrq0Gnw/zffvU2Lqbt0/EEFCLHEI0QtgUpcS2BZ L4qEIrpyefl3k7qtdiGpTswOvyuMv6PXSrIICAS4t3kXWwWWb+gC0FJxXiBiMQWWh4d+ n/suhiYT5hW99u1jPjkYvqKx14j6F5Xxf0rnn8Y34JeO+6CwKPiddz+C6TScA7HBsHIh XNqHb0puZbTW/sUNh14ajEqMiCeXZmar2RRuVcR15ngpTZMwOynMSWh+ehdspVQJM/TR XbkQ== X-Gm-Message-State: AOAM532Nr2wZnn02quxiDjlrPdpQhLzu3LCq8mpxQLQ4LBfEoZIy7Kba 4FZiOKzMpbltX+up5zhZAhbo7SXmjlQtAgiV X-Google-Smtp-Source: ABdhPJzX6VZHXFWVUbXAxZnRP3lP4GYwI6UN/R9ZhHFfI+HMeIpqo1GmKbQFmpsrYjiGdtRHyi4imQ== X-Received: by 2002:a62:b609:0:b0:4f1:2735:3217 with SMTP id j9-20020a62b609000000b004f127353217mr8110123pff.22.1645799318940; Fri, 25 Feb 2022 06:28:38 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:38 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 49/50] grub: avoid a NULL pointer dereference Date: Fri, 25 Feb 2022 04:26:29 -1000 Message-Id: <6666dccd33178445f3c4fe277354393efb70285a.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162395 From: Marta Rybczynska This patch adds a fix for a NULL pointer dereference in grub's commands/ls. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...ire-device_name-is-not-NULL-before-p.patch | 33 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch diff --git a/meta/recipes-bsp/grub/files/0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch b/meta/recipes-bsp/grub/files/0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch new file mode 100644 index 0000000000..5a327fe1d2 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch @@ -0,0 +1,33 @@ +From dd82f98fa642907817f59aeaf3761b786898df85 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Mon, 11 Jan 2021 16:57:37 +1100 +Subject: [PATCH] commands/ls: Require device_name is not NULL before printing + +This can be triggered with: + ls -l (0 0*) +and causes a NULL deref in grub_normal_print_device_info(). + +I'm not sure if there's any implication with the IEEE 1275 platform. + +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6afbe6063c95b827372f9ec310c9fc7461311eb1] +Signed-off-by: Marta Rybczynska +--- + grub-core/commands/ls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c +index 5b7491a..326d2d6 100644 +--- a/grub-core/commands/ls.c ++++ b/grub-core/commands/ls.c +@@ -196,7 +196,7 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human) + goto fail; + } + +- if (! *path) ++ if (! *path && device_name) + { + if (grub_errno == GRUB_ERR_UNKNOWN_FS) + grub_errno = GRUB_ERR_NONE; diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 84b8b8d1be..0454b09d52 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -91,6 +91,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0042-util-grub-editenv-Fix-incorrect-casting-of-a-signed-.patch \ file://0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch \ file://0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch \ + file://0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Fri Feb 25 14:26:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 4304 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82FEFC433F5 for ; Fri, 25 Feb 2022 14:28:42 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.web10.7087.1645799322174332903 for ; Fri, 25 Feb 2022 06:28:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=s6LsyqKW; spf=softfail (domain: sakoman.com, ip: 209.85.214.173, mailfrom: steve@sakoman.com) Received: by mail-pl1-f173.google.com with SMTP id s1so4926864plg.12 for ; Fri, 25 Feb 2022 06:28:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=1b0ncTD1okVKZEW7vWIePMxkJeKyogxDVnp/ryFmBZ0=; b=s6LsyqKWiktaJ3QkhRmbxWjl0emIZhfQCwpaZsfY/6BuGxZ9tYPJksG9wcDuExo8WD d+DIuSaYj00LaEp9Wp0Al0TVtK96OfLzhpBRP+0GB0k5gFRVlKoRWGTgIq4zcSLhVpPD wODKeZoo7R4ee1ZITn9RvGUBXc1NkrBzevlr5++rQazrhO+nwfBq9IIh/9EVxncOuOiU i3K+kuQSee1Pmlw+/WB5Ad2ZZh+wNvtJMwk77ljyJqVOp7rD9i//pmd0pt8A/l+vMR6z D9gPg/Jgf5ziUKFgKMEn89BLAwnOAgW99TU/4q4ZPKfdPtGomMk7jtJZFmfRB+ARoC5n y+lQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=1b0ncTD1okVKZEW7vWIePMxkJeKyogxDVnp/ryFmBZ0=; b=H+ybDZ1mx1m33ceRY9qvgfx2VMmm4PBueOo2Lr8AZZMLcACrBlIlAA3FsWpe/hISOA sUEVzdkAF/XGUteAUbzP1B/sNj7W4uDEoP02aqZIrNzSWra7UMtrn3mj66smRTDytu/L ejJlDdmnXEN8oFaaCmyeYocw3sBaja9eo8a7b1GESQqW3XU09ynEs3cB7ctffWKGbsD8 ZSRSgzJBpNOzqJLEXR38lxZirX99E/Lg77FGDJxk0GwgHzJHnsg5K5272y46aUhlTzpV Nc09OPlOnLS/YwLdE8dvGCepfIdCxLeoRXcyycNEHPaHXDZmgAjzKCrUDVY+jzqAszxK 300A== X-Gm-Message-State: AOAM530Gwng+U8/RT4YVRVUCv7owrgeE97BPRX9TIXCzMhlu0dIFOxBr 9z6vXF5uHvKNoxVMXmIOUXaIg9d3QqxMbPLc X-Google-Smtp-Source: ABdhPJw404L35duxXPXZgG/BETM849axv2GhZJamusYjLhUs2y6eLI9Y2J1jE4xfys+2UhFN3SFhiA== X-Received: by 2002:a17:90a:4581:b0:1bc:d215:8722 with SMTP id v1-20020a17090a458100b001bcd2158722mr3403926pjg.149.1645799321268; Fri, 25 Feb 2022 06:28:41 -0800 (PST) Received: from hexa.router0800d9.com (dhcp-72-253-6-214.hawaiiantel.net. [72.253.6.214]) by smtp.gmail.com with ESMTPSA id h17-20020a63df51000000b0036b9776ae5bsm2864538pgj.85.2022.02.25.06.28.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Feb 2022 06:28:40 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 50/50] grub: add a fix for a crash in scripts Date: Fri, 25 Feb 2022 04:26:30 -1000 Message-Id: <79ce9059f716546a7d6f4562ba194aedd90c22cd.1645798648.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 25 Feb 2022 14:28:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/162396 From: Marta Rybczynska This patch adds a fix for a crash in grub's script handling. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- ...void-crash-when-using-outside-a-func.patch | 37 +++++++++++++++++++ meta/recipes-bsp/grub/grub2.inc | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/0046-script-execute-Avoid-crash-when-using-outside-a-func.patch diff --git a/meta/recipes-bsp/grub/files/0046-script-execute-Avoid-crash-when-using-outside-a-func.patch b/meta/recipes-bsp/grub/files/0046-script-execute-Avoid-crash-when-using-outside-a-func.patch new file mode 100644 index 0000000000..84117a9073 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0046-script-execute-Avoid-crash-when-using-outside-a-func.patch @@ -0,0 +1,37 @@ +From df2505c4c3cf42b0c419c99a5f9e1ce63e5a5938 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Mon, 11 Jan 2021 17:30:42 +1100 +Subject: [PATCH] script/execute: Avoid crash when using "$#" outside a + function scope + +"$#" represents the number of arguments to a function. It is only +defined in a function scope, where "scope" is non-NULL. Currently, +if we attempt to evaluate "$#" outside a function scope, "scope" will +be NULL and we will crash with a NULL pointer dereference. + +Do not attempt to count arguments for "$#" if "scope" is NULL. This +will result in "$#" being interpreted as an empty string if evaluated +outside a function scope. + +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=fe0586347ee46f927ae27bb9673532da9f5dead5] +Signed-off-by: Marta Rybczynska +--- + grub-core/script/execute.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 5ea2aef..23d34bd 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -485,7 +485,7 @@ gettext_putvar (const char *str, grub_size_t len, + return 0; + + /* Enough for any number. */ +- if (len == 1 && str[0] == '#') ++ if (len == 1 && str[0] == '#' && scope != NULL) + { + grub_snprintf (*ptr, 30, "%u", scope->argv.argc); + *ptr += grub_strlen (*ptr); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 0454b09d52..75ef31f249 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -92,6 +92,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://0043-util-glue-efi-Fix-incorrect-use-of-a-possibly-negati.patch \ file://0044-script-execute-Fix-NULL-dereference-in-grub_script_e.patch \ file://0045-commands-ls-Require-device_name-is-not-NULL-before-p.patch \ + file://0046-script-execute-Avoid-crash-when-using-outside-a-func.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea"