0016-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153
  1. From 1c7b619c84f229c1602c1958bcd054b6d9937562 Mon Sep 17 00:00:00 2001
  2. From: Alexey Makhalov <amakhalov@vmware.com>
  3. Date: Wed, 15 Jul 2020 06:42:37 +0000
  4. Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_addr()
  5. input args against integer underflow/overflow
  6. MIME-Version: 1.0
  7. Content-Type: text/plain; charset=UTF-8
  8. Content-Transfer-Encoding: 8bit
  9. Use arithmetic macros from safemath.h to accomplish it. In this commit,
  10. I didn't want to be too paranoid to check every possible math equation
  11. for overflow/underflow. Only obvious places (with non zero chance of
  12. overflow/underflow) were refactored.
  13. Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
  14. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  15. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  16. ---
  17. grub-core/loader/i386/linux.c | 9 +++++++--
  18. grub-core/loader/i386/pc/linux.c | 9 +++++++--
  19. grub-core/loader/i386/xen.c | 12 ++++++++++--
  20. grub-core/loader/xnu.c | 11 +++++++----
  21. 4 files changed, 31 insertions(+), 10 deletions(-)
  22. diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
  23. index d0501e229..02a73463a 100644
  24. --- a/grub-core/loader/i386/linux.c
  25. +++ b/grub-core/loader/i386/linux.c
  26. @@ -36,6 +36,7 @@
  27. #include <grub/lib/cmdline.h>
  28. #include <grub/linux.h>
  29. #include <grub/machine/kernel.h>
  30. +#include <grub/safemath.h>
  31. GRUB_MOD_LICENSE ("GPLv3+");
  32. @@ -547,9 +548,13 @@ grub_linux_boot (void)
  33. {
  34. grub_relocator_chunk_t ch;
  35. + grub_size_t sz;
  36. +
  37. + if (grub_add (ctx.real_size, efi_mmap_size, &sz))
  38. + return GRUB_ERR_OUT_OF_RANGE;
  39. +
  40. err = grub_relocator_alloc_chunk_addr (relocator, &ch,
  41. - ctx.real_mode_target,
  42. - (ctx.real_size + efi_mmap_size));
  43. + ctx.real_mode_target, sz);
  44. if (err)
  45. return err;
  46. real_mode_mem = get_virtual_current_address (ch);
  47. diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
  48. index 47ea2945e..31f09922b 100644
  49. --- a/grub-core/loader/i386/pc/linux.c
  50. +++ b/grub-core/loader/i386/pc/linux.c
  51. @@ -35,6 +35,7 @@
  52. #include <grub/i386/floppy.h>
  53. #include <grub/lib/cmdline.h>
  54. #include <grub/linux.h>
  55. +#include <grub/safemath.h>
  56. GRUB_MOD_LICENSE ("GPLv3+");
  57. @@ -218,8 +219,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
  58. setup_sects = GRUB_LINUX_DEFAULT_SETUP_SECTS;
  59. real_size = setup_sects << GRUB_DISK_SECTOR_BITS;
  60. - grub_linux16_prot_size = grub_file_size (file)
  61. - - real_size - GRUB_DISK_SECTOR_SIZE;
  62. + if (grub_sub (grub_file_size (file), real_size, &grub_linux16_prot_size) ||
  63. + grub_sub (grub_linux16_prot_size, GRUB_DISK_SECTOR_SIZE, &grub_linux16_prot_size))
  64. + {
  65. + grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
  66. + goto fail;
  67. + }
  68. if (! grub_linux_is_bzimage
  69. && GRUB_LINUX_ZIMAGE_ADDR + grub_linux16_prot_size
  70. diff --git a/grub-core/loader/i386/xen.c b/grub-core/loader/i386/xen.c
  71. index 8f662c8ac..cd24874ca 100644
  72. --- a/grub-core/loader/i386/xen.c
  73. +++ b/grub-core/loader/i386/xen.c
  74. @@ -41,6 +41,7 @@
  75. #include <grub/linux.h>
  76. #include <grub/i386/memory.h>
  77. #include <grub/verify.h>
  78. +#include <grub/safemath.h>
  79. GRUB_MOD_LICENSE ("GPLv3+");
  80. @@ -636,6 +637,7 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)),
  81. grub_relocator_chunk_t ch;
  82. grub_addr_t kern_start;
  83. grub_addr_t kern_end;
  84. + grub_size_t sz;
  85. if (argc == 0)
  86. return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
  87. @@ -703,8 +705,14 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)),
  88. xen_state.max_addr = ALIGN_UP (kern_end, PAGE_SIZE);
  89. - err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start,
  90. - kern_end - kern_start);
  91. +
  92. + if (grub_sub (kern_end, kern_start, &sz))
  93. + {
  94. + err = GRUB_ERR_OUT_OF_RANGE;
  95. + goto fail;
  96. + }
  97. +
  98. + err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start, sz);
  99. if (err)
  100. goto fail;
  101. kern_chunk_src = get_virtual_current_address (ch);
  102. diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
  103. index 77d7060e1..9ae4ceb35 100644
  104. --- a/grub-core/loader/xnu.c
  105. +++ b/grub-core/loader/xnu.c
  106. @@ -34,6 +34,7 @@
  107. #include <grub/env.h>
  108. #include <grub/i18n.h>
  109. #include <grub/verify.h>
  110. +#include <grub/safemath.h>
  111. GRUB_MOD_LICENSE ("GPLv3+");
  112. @@ -59,15 +60,17 @@ grub_xnu_heap_malloc (int size, void **src, grub_addr_t *target)
  113. {
  114. grub_err_t err;
  115. grub_relocator_chunk_t ch;
  116. + grub_addr_t tgt;
  117. +
  118. + if (grub_add (grub_xnu_heap_target_start, grub_xnu_heap_size, &tgt))
  119. + return GRUB_ERR_OUT_OF_RANGE;
  120. - err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch,
  121. - grub_xnu_heap_target_start
  122. - + grub_xnu_heap_size, size);
  123. + err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch, tgt, size);
  124. if (err)
  125. return err;
  126. *src = get_virtual_current_address (ch);
  127. - *target = grub_xnu_heap_target_start + grub_xnu_heap_size;
  128. + *target = tgt;
  129. grub_xnu_heap_size += size;
  130. grub_dprintf ("xnu", "val=%p\n", *src);
  131. return GRUB_ERR_NONE;
  132. --
  133. 2.26.2