summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarta Rybczynska <rybczynska@gmail.com>2022-02-18 11:05:47 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-03-02 00:21:37 +0000
commit11b10eac41c961ccde153409538aea5a5d2093aa (patch)
tree9a519a9b1e4d36ccea1f1a35bc986e7c59298bf8
parenta558b15d7f5d49ce6f82969650315bc91ec81490 (diff)
downloadpoky-11b10eac41c961ccde153409538aea5a5d2093aa.tar.gz
grub: avoid a memory leak
This patch fixes a memory leak in grub's loader/xnu when an error is detected in grub_xnu_writetree_toheap(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 265baabc6e7ce4962c22489158dba113e0d74b91) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch77
-rw-r--r--meta/recipes-bsp/grub/grub2.inc1
2 files changed, 78 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch b/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch
new file mode 100644
index 0000000000..f9ad0fc34c
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch
@@ -0,0 +1,77 @@
1From 81117a77a9e945ee5e7c1f12bd5667e2a16cbe32 Mon Sep 17 00:00:00 2001
2From: Marco A Benatto <mbenatto@redhat.com>
3Date: Mon, 30 Nov 2020 12:18:24 -0300
4Subject: [PATCH] loader/xnu: Free driverkey data when an error is detected in
5 grub_xnu_writetree_toheap()
6
7... to avoid memory leaks.
8
9Fixes: CID 96640
10
11Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
12Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
13
14Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=4b4027b6b1c877d7ab467896b04c7bd1aadcfa15]
15Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com>
16---
17 grub-core/loader/xnu.c | 24 ++++++++++++++++++++----
18 1 file changed, 20 insertions(+), 4 deletions(-)
19
20diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
21index b3029a8..39ceff8 100644
22--- a/grub-core/loader/xnu.c
23+++ b/grub-core/loader/xnu.c
24@@ -224,26 +224,33 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size)
25 if (! memorymap)
26 return grub_errno;
27
28- driverkey = (struct grub_xnu_devtree_key *) grub_malloc (sizeof (*driverkey));
29+ driverkey = (struct grub_xnu_devtree_key *) grub_zalloc (sizeof (*driverkey));
30 if (! driverkey)
31 return grub_errno;
32 driverkey->name = grub_strdup ("DeviceTree");
33 if (! driverkey->name)
34- return grub_errno;
35+ {
36+ err = grub_errno;
37+ goto fail;
38+ }
39+
40 driverkey->datasize = sizeof (*extdesc);
41 driverkey->next = memorymap->first_child;
42 memorymap->first_child = driverkey;
43 driverkey->data = extdesc
44 = (struct grub_xnu_extdesc *) grub_malloc (sizeof (*extdesc));
45 if (! driverkey->data)
46- return grub_errno;
47+ {
48+ err = grub_errno;
49+ goto fail;
50+ }
51
52 /* Allocate the space based on the size with dummy value. */
53 *size = grub_xnu_writetree_get_size (grub_xnu_devtree_root, "/");
54 err = grub_xnu_heap_malloc (ALIGN_UP (*size + 1, GRUB_XNU_PAGESIZE),
55 &src, target);
56 if (err)
57- return err;
58+ goto fail;
59
60 /* Put real data in the dummy. */
61 extdesc->addr = *target;
62@@ -252,6 +259,15 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size)
63 /* Write the tree to heap. */
64 grub_xnu_writetree_toheap_real (src, grub_xnu_devtree_root, "/");
65 return GRUB_ERR_NONE;
66+
67+ fail:
68+ memorymap->first_child = NULL;
69+
70+ grub_free (driverkey->data);
71+ grub_free (driverkey->name);
72+ grub_free (driverkey);
73+
74+ return err;
75 }
76
77 /* Find a key or value in parent key. */
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index c9e7a06a3f..eebe9a7233 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -85,6 +85,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
85 file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \ 85 file://0036-gfxmenu-gui_list-Remove-code-that-coverity-is-flaggi.patch \
86 file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \ 86 file://0037-loader-bsd-Check-for-NULL-arg-up-front.patch \
87 file://0038-loader-xnu-Fix-memory-leak.patch \ 87 file://0038-loader-xnu-Fix-memory-leak.patch \
88 file://0039-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch \
88 " 89 "
89SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" 90SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934"
90SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" 91SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea"