0054-kern-efi-mm-Fix-possible-NULL-pointer-dereference.patch 2.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566
  1. From 6aee4bfd6973c714056fb7b56890b8d524e94ee1 Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Fri, 11 Dec 2020 15:03:13 +0000
  4. Subject: [PATCH] kern/efi/mm: Fix possible NULL pointer dereference
  5. The model of grub_efi_get_memory_map() is that if memory_map is NULL,
  6. then the purpose is to discover how much memory should be allocated to
  7. it for the subsequent call.
  8. The problem here is that with grub_efi_is_finished set to 1, there is no
  9. check at all that the function is being called with a non-NULL memory_map.
  10. While this MAY be true, we shouldn't assume it.
  11. The solution to this is to behave as expected, and if memory_map is NULL,
  12. then don't try to use it and allow memory_map_size to be filled in, and
  13. return 0 as is done later in the code if the buffer is too small (or NULL).
  14. Additionally, drop unneeded ret = 1.
  15. Fixes: CID 96632
  16. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  17. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  18. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  19. ---
  20. grub-core/kern/efi/mm.c | 19 ++++++++++++++-----
  21. 1 file changed, 14 insertions(+), 5 deletions(-)
  22. diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
  23. index b02fab1..5afcef7 100644
  24. --- a/grub-core/kern/efi/mm.c
  25. +++ b/grub-core/kern/efi/mm.c
  26. @@ -328,15 +328,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size,
  27. if (grub_efi_is_finished)
  28. {
  29. int ret = 1;
  30. - if (*memory_map_size < finish_mmap_size)
  31. +
  32. + if (memory_map != NULL)
  33. {
  34. - grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
  35. - ret = 0;
  36. + if (*memory_map_size < finish_mmap_size)
  37. + {
  38. + grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
  39. + ret = 0;
  40. + }
  41. + else
  42. + grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
  43. }
  44. else
  45. {
  46. - grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
  47. - ret = 1;
  48. + /*
  49. + * Incomplete, no buffer to copy into, same as
  50. + * GRUB_EFI_BUFFER_TOO_SMALL below.
  51. + */
  52. + ret = 0;
  53. }
  54. *memory_map_size = finish_mmap_size;
  55. if (map_key)
  56. --
  57. 2.14.2