0017-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341
  1. From 0cfbbca3ccd84d36ffb1bcd6644ada7c73b19fc0 Mon Sep 17 00:00:00 2001
  2. From: Alexey Makhalov <amakhalov@vmware.com>
  3. Date: Wed, 8 Jul 2020 01:44:38 +0000
  4. Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_align()
  5. max_addr against integer underflow
  6. MIME-Version: 1.0
  7. Content-Type: text/plain; charset=UTF-8
  8. Content-Transfer-Encoding: 8bit
  9. This commit introduces integer underflow mitigation in max_addr calculation
  10. in grub_relocator_alloc_chunk_align() invocation.
  11. It consists of 2 fixes:
  12. 1. Introduced grub_relocator_alloc_chunk_align_safe() wrapper function to perform
  13. sanity check for min/max and size values, and to make safe invocation of
  14. grub_relocator_alloc_chunk_align() with validated max_addr value. Replace all
  15. invocations such as grub_relocator_alloc_chunk_align(..., min_addr, max_addr - size, size, ...)
  16. by grub_relocator_alloc_chunk_align_safe(..., min_addr, max_addr, size, ...).
  17. 2. Introduced UP_TO_TOP32(s) macro for the cases where max_addr is 32-bit top
  18. address (0xffffffff - size + 1) or similar.
  19. Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
  20. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  21. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  22. ---
  23. grub-core/lib/i386/relocator.c | 28 ++++++++++----------------
  24. grub-core/lib/mips/relocator.c | 6 ++----
  25. grub-core/lib/powerpc/relocator.c | 6 ++----
  26. grub-core/lib/x86_64/efi/relocator.c | 7 +++----
  27. grub-core/loader/i386/linux.c | 5 ++---
  28. grub-core/loader/i386/multiboot_mbi.c | 7 +++----
  29. grub-core/loader/i386/pc/linux.c | 6 ++----
  30. grub-core/loader/mips/linux.c | 9 +++------
  31. grub-core/loader/multiboot.c | 2 +-
  32. grub-core/loader/multiboot_elfxx.c | 10 ++++-----
  33. grub-core/loader/multiboot_mbi2.c | 10 ++++-----
  34. grub-core/loader/xnu_resume.c | 2 +-
  35. include/grub/relocator.h | 29 +++++++++++++++++++++++++++
  36. 13 files changed, 69 insertions(+), 58 deletions(-)
  37. diff --git a/grub-core/lib/i386/relocator.c b/grub-core/lib/i386/relocator.c
  38. index 71dd4f0ab..34cbe834f 100644
  39. --- a/grub-core/lib/i386/relocator.c
  40. +++ b/grub-core/lib/i386/relocator.c
  41. @@ -83,11 +83,10 @@ grub_relocator32_boot (struct grub_relocator *rel,
  42. /* Specific memory range due to Global Descriptor Table for use by payload
  43. that we will store in returned chunk. The address range and preference
  44. are based on "THE LINUX/x86 BOOT PROTOCOL" specification. */
  45. - err = grub_relocator_alloc_chunk_align (rel, &ch, 0x1000,
  46. - 0x9a000 - RELOCATOR_SIZEOF (32),
  47. - RELOCATOR_SIZEOF (32), 16,
  48. - GRUB_RELOCATOR_PREFERENCE_LOW,
  49. - avoid_efi_bootservices);
  50. + err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x1000, 0x9a000,
  51. + RELOCATOR_SIZEOF (32), 16,
  52. + GRUB_RELOCATOR_PREFERENCE_LOW,
  53. + avoid_efi_bootservices);
  54. if (err)
  55. return err;
  56. @@ -125,13 +124,10 @@ grub_relocator16_boot (struct grub_relocator *rel,
  57. grub_relocator_chunk_t ch;
  58. /* Put it higher than the byte it checks for A20 check. */
  59. - err = grub_relocator_alloc_chunk_align (rel, &ch, 0x8010,
  60. - 0xa0000 - RELOCATOR_SIZEOF (16)
  61. - - GRUB_RELOCATOR16_STACK_SIZE,
  62. - RELOCATOR_SIZEOF (16)
  63. - + GRUB_RELOCATOR16_STACK_SIZE, 16,
  64. - GRUB_RELOCATOR_PREFERENCE_NONE,
  65. - 0);
  66. + err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x8010, 0xa0000,
  67. + RELOCATOR_SIZEOF (16) +
  68. + GRUB_RELOCATOR16_STACK_SIZE, 16,
  69. + GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  70. if (err)
  71. return err;
  72. @@ -183,11 +179,9 @@ grub_relocator64_boot (struct grub_relocator *rel,
  73. void *relst;
  74. grub_relocator_chunk_t ch;
  75. - err = grub_relocator_alloc_chunk_align (rel, &ch, min_addr,
  76. - max_addr - RELOCATOR_SIZEOF (64),
  77. - RELOCATOR_SIZEOF (64), 16,
  78. - GRUB_RELOCATOR_PREFERENCE_NONE,
  79. - 0);
  80. + err = grub_relocator_alloc_chunk_align_safe (rel, &ch, min_addr, max_addr,
  81. + RELOCATOR_SIZEOF (64), 16,
  82. + GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  83. if (err)
  84. return err;
  85. diff --git a/grub-core/lib/mips/relocator.c b/grub-core/lib/mips/relocator.c
  86. index 9d5f49cb9..743b213e6 100644
  87. --- a/grub-core/lib/mips/relocator.c
  88. +++ b/grub-core/lib/mips/relocator.c
  89. @@ -120,10 +120,8 @@ grub_relocator32_boot (struct grub_relocator *rel,
  90. unsigned i;
  91. grub_addr_t vtarget;
  92. - err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
  93. - (0xffffffff - stateset_size)
  94. - + 1, stateset_size,
  95. - sizeof (grub_uint32_t),
  96. + err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),
  97. + stateset_size, sizeof (grub_uint32_t),
  98. GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  99. if (err)
  100. return err;
  101. diff --git a/grub-core/lib/powerpc/relocator.c b/grub-core/lib/powerpc/relocator.c
  102. index bdf2b111b..8ffb8b686 100644
  103. --- a/grub-core/lib/powerpc/relocator.c
  104. +++ b/grub-core/lib/powerpc/relocator.c
  105. @@ -115,10 +115,8 @@ grub_relocator32_boot (struct grub_relocator *rel,
  106. unsigned i;
  107. grub_relocator_chunk_t ch;
  108. - err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
  109. - (0xffffffff - stateset_size)
  110. - + 1, stateset_size,
  111. - sizeof (grub_uint32_t),
  112. + err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),
  113. + stateset_size, sizeof (grub_uint32_t),
  114. GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  115. if (err)
  116. return err;
  117. diff --git a/grub-core/lib/x86_64/efi/relocator.c b/grub-core/lib/x86_64/efi/relocator.c
  118. index 3caef7a40..7d200a125 100644
  119. --- a/grub-core/lib/x86_64/efi/relocator.c
  120. +++ b/grub-core/lib/x86_64/efi/relocator.c
  121. @@ -50,10 +50,9 @@ grub_relocator64_efi_boot (struct grub_relocator *rel,
  122. * 64-bit relocator code may live above 4 GiB quite well.
  123. * However, I do not want ask for problems. Just in case.
  124. */
  125. - err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
  126. - 0x100000000 - RELOCATOR_SIZEOF (64_efi),
  127. - RELOCATOR_SIZEOF (64_efi), 16,
  128. - GRUB_RELOCATOR_PREFERENCE_NONE, 1);
  129. + err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0, 0x100000000,
  130. + RELOCATOR_SIZEOF (64_efi), 16,
  131. + GRUB_RELOCATOR_PREFERENCE_NONE, 1);
  132. if (err)
  133. return err;
  134. diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
  135. index 02a73463a..efbb99307 100644
  136. --- a/grub-core/loader/i386/linux.c
  137. +++ b/grub-core/loader/i386/linux.c
  138. @@ -181,9 +181,8 @@ allocate_pages (grub_size_t prot_size, grub_size_t *align,
  139. for (; err && *align + 1 > min_align; (*align)--)
  140. {
  141. grub_errno = GRUB_ERR_NONE;
  142. - err = grub_relocator_alloc_chunk_align (relocator, &ch,
  143. - 0x1000000,
  144. - 0xffffffff & ~prot_size,
  145. + err = grub_relocator_alloc_chunk_align (relocator, &ch, 0x1000000,
  146. + UP_TO_TOP32 (prot_size),
  147. prot_size, 1 << *align,
  148. GRUB_RELOCATOR_PREFERENCE_LOW,
  149. 1);
  150. diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c
  151. index ad3cc292f..a67d9d0a8 100644
  152. --- a/grub-core/loader/i386/multiboot_mbi.c
  153. +++ b/grub-core/loader/i386/multiboot_mbi.c
  154. @@ -466,10 +466,9 @@ grub_multiboot_make_mbi (grub_uint32_t *target)
  155. bufsize = grub_multiboot_get_mbi_size ();
  156. - err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch,
  157. - 0x10000, 0xa0000 - bufsize,
  158. - bufsize, 4,
  159. - GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  160. + err = grub_relocator_alloc_chunk_align_safe (grub_multiboot_relocator, &ch,
  161. + 0x10000, 0xa0000, bufsize, 4,
  162. + GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  163. if (err)
  164. return err;
  165. ptrorig = get_virtual_current_address (ch);
  166. diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
  167. index 31f09922b..5fed5ffdf 100644
  168. --- a/grub-core/loader/i386/pc/linux.c
  169. +++ b/grub-core/loader/i386/pc/linux.c
  170. @@ -453,10 +453,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
  171. {
  172. grub_relocator_chunk_t ch;
  173. - err = grub_relocator_alloc_chunk_align (relocator, &ch,
  174. - addr_min, addr_max - size,
  175. - size, 0x1000,
  176. - GRUB_RELOCATOR_PREFERENCE_HIGH, 0);
  177. + err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, addr_min, addr_max, size,
  178. + 0x1000, GRUB_RELOCATOR_PREFERENCE_HIGH, 0);
  179. if (err)
  180. return err;
  181. initrd_chunk = get_virtual_current_address (ch);
  182. diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c
  183. index 7b723bf18..e4ed95921 100644
  184. --- a/grub-core/loader/mips/linux.c
  185. +++ b/grub-core/loader/mips/linux.c
  186. @@ -442,12 +442,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
  187. {
  188. grub_relocator_chunk_t ch;
  189. - err = grub_relocator_alloc_chunk_align (relocator, &ch,
  190. - (target_addr & 0x1fffffff)
  191. - + linux_size + 0x10000,
  192. - (0x10000000 - size),
  193. - size, 0x10000,
  194. - GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  195. + err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, (target_addr & 0x1fffffff) +
  196. + linux_size + 0x10000, 0x10000000, size,
  197. + 0x10000, GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  198. if (err)
  199. goto fail;
  200. diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
  201. index 4a98d7082..facb13f3d 100644
  202. --- a/grub-core/loader/multiboot.c
  203. +++ b/grub-core/loader/multiboot.c
  204. @@ -403,7 +403,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
  205. {
  206. grub_relocator_chunk_t ch;
  207. err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch,
  208. - lowest_addr, (0xffffffff - size) + 1,
  209. + lowest_addr, UP_TO_TOP32 (size),
  210. size, MULTIBOOT_MOD_ALIGN,
  211. GRUB_RELOCATOR_PREFERENCE_NONE, 1);
  212. if (err)
  213. diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c
  214. index cc6853692..f2318e0d1 100644
  215. --- a/grub-core/loader/multiboot_elfxx.c
  216. +++ b/grub-core/loader/multiboot_elfxx.c
  217. @@ -109,10 +109,10 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
  218. if (load_size > mld->max_addr || mld->min_addr > mld->max_addr - load_size)
  219. return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size");
  220. - err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch,
  221. - mld->min_addr, mld->max_addr - load_size,
  222. - load_size, mld->align ? mld->align : 1,
  223. - mld->preference, mld->avoid_efi_boot_services);
  224. + err = grub_relocator_alloc_chunk_align_safe (GRUB_MULTIBOOT (relocator), &ch,
  225. + mld->min_addr, mld->max_addr,
  226. + load_size, mld->align ? mld->align : 1,
  227. + mld->preference, mld->avoid_efi_boot_services);
  228. if (err)
  229. {
  230. @@ -256,7 +256,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
  231. continue;
  232. err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch, 0,
  233. - (0xffffffff - sh->sh_size) + 1,
  234. + UP_TO_TOP32 (sh->sh_size),
  235. sh->sh_size, sh->sh_addralign,
  236. GRUB_RELOCATOR_PREFERENCE_NONE,
  237. mld->avoid_efi_boot_services);
  238. diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c
  239. index 0efc66062..03967839c 100644
  240. --- a/grub-core/loader/multiboot_mbi2.c
  241. +++ b/grub-core/loader/multiboot_mbi2.c
  242. @@ -295,10 +295,10 @@ grub_multiboot2_load (grub_file_t file, const char *filename)
  243. return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size");
  244. }
  245. - err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch,
  246. - mld.min_addr, mld.max_addr - code_size,
  247. - code_size, mld.align ? mld.align : 1,
  248. - mld.preference, keep_bs);
  249. + err = grub_relocator_alloc_chunk_align_safe (grub_multiboot2_relocator, &ch,
  250. + mld.min_addr, mld.max_addr,
  251. + code_size, mld.align ? mld.align : 1,
  252. + mld.preference, keep_bs);
  253. }
  254. else
  255. err = grub_relocator_alloc_chunk_addr (grub_multiboot2_relocator,
  256. @@ -708,7 +708,7 @@ grub_multiboot2_make_mbi (grub_uint32_t *target)
  257. COMPILE_TIME_ASSERT (MULTIBOOT_TAG_ALIGN % sizeof (grub_properly_aligned_t) == 0);
  258. err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch,
  259. - 0, 0xffffffff - bufsize,
  260. + 0, UP_TO_TOP32 (bufsize),
  261. bufsize, MULTIBOOT_TAG_ALIGN,
  262. GRUB_RELOCATOR_PREFERENCE_NONE, 1);
  263. if (err)
  264. diff --git a/grub-core/loader/xnu_resume.c b/grub-core/loader/xnu_resume.c
  265. index 8089804d4..d648ef0cd 100644
  266. --- a/grub-core/loader/xnu_resume.c
  267. +++ b/grub-core/loader/xnu_resume.c
  268. @@ -129,7 +129,7 @@ grub_xnu_resume (char *imagename)
  269. {
  270. grub_relocator_chunk_t ch;
  271. err = grub_relocator_alloc_chunk_align (grub_xnu_relocator, &ch, 0,
  272. - (0xffffffff - hibhead.image_size) + 1,
  273. + UP_TO_TOP32 (hibhead.image_size),
  274. hibhead.image_size,
  275. GRUB_XNU_PAGESIZE,
  276. GRUB_RELOCATOR_PREFERENCE_NONE, 0);
  277. diff --git a/include/grub/relocator.h b/include/grub/relocator.h
  278. index 24d8672d2..1b3bdd92a 100644
  279. --- a/include/grub/relocator.h
  280. +++ b/include/grub/relocator.h
  281. @@ -49,6 +49,35 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel,
  282. int preference,
  283. int avoid_efi_boot_services);
  284. +/*
  285. + * Wrapper for grub_relocator_alloc_chunk_align() with purpose of
  286. + * protecting against integer underflow.
  287. + *
  288. + * Compare to its callee, max_addr has different meaning here.
  289. + * It covers entire chunk and not just start address of the chunk.
  290. + */
  291. +static inline grub_err_t
  292. +grub_relocator_alloc_chunk_align_safe (struct grub_relocator *rel,
  293. + grub_relocator_chunk_t *out,
  294. + grub_phys_addr_t min_addr,
  295. + grub_phys_addr_t max_addr,
  296. + grub_size_t size, grub_size_t align,
  297. + int preference,
  298. + int avoid_efi_boot_services)
  299. +{
  300. + /* Sanity check and ensure following equation (max_addr - size) is safe. */
  301. + if (max_addr < size || (max_addr - size) < min_addr)
  302. + return GRUB_ERR_OUT_OF_RANGE;
  303. +
  304. + return grub_relocator_alloc_chunk_align (rel, out, min_addr,
  305. + max_addr - size,
  306. + size, align, preference,
  307. + avoid_efi_boot_services);
  308. +}
  309. +
  310. +/* Top 32-bit address minus s bytes and plus 1 byte. */
  311. +#define UP_TO_TOP32(s) ((~(s) & 0xffffffff) + 1)
  312. +
  313. #define GRUB_RELOCATOR_PREFERENCE_NONE 0
  314. #define GRUB_RELOCATOR_PREFERENCE_LOW 1
  315. #define GRUB_RELOCATOR_PREFERENCE_HIGH 2
  316. --
  317. 2.26.2