diff options
-rw-r--r-- | meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch | 128 | ||||
-rw-r--r-- | meta/recipes-bsp/grub/grub2.inc | 1 |
2 files changed, 129 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch new file mode 100644 index 0000000000..c1687c75d0 --- /dev/null +++ b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch | |||
@@ -0,0 +1,128 @@ | |||
1 | From 0c5d0fd796e6cafba179321de396681a493c4158 Mon Sep 17 00:00:00 2001 | ||
2 | From: Marco A Benatto <mbenatto@redhat.com> | ||
3 | Date: Mon, 7 Dec 2020 11:53:03 -0300 | ||
4 | Subject: [PATCH] disk/ldm: Make sure comp data is freed before exiting from | ||
5 | make_vg() | ||
6 | |||
7 | Several error handling paths in make_vg() do not free comp data before | ||
8 | jumping to fail2 label and returning from the function. This will leak | ||
9 | memory. So, let's fix all issues of that kind. | ||
10 | |||
11 | Fixes: CID 73804 | ||
12 | |||
13 | Signed-off-by: Marco A Benatto <mbenatto@redhat.com> | ||
14 | Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> | ||
15 | |||
16 | Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=23e39f50ca7a107f6b66396ed4d177a914dee035] | ||
17 | Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> | ||
18 | --- | ||
19 | grub-core/disk/ldm.c | 51 ++++++++++++++++++++++++++++++++++++++------ | ||
20 | 1 file changed, 44 insertions(+), 7 deletions(-) | ||
21 | |||
22 | diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c | ||
23 | index 58f8a53..428415f 100644 | ||
24 | --- a/grub-core/disk/ldm.c | ||
25 | +++ b/grub-core/disk/ldm.c | ||
26 | @@ -554,7 +554,11 @@ make_vg (grub_disk_t disk, | ||
27 | comp->segments = grub_calloc (comp->segment_alloc, | ||
28 | sizeof (*comp->segments)); | ||
29 | if (!comp->segments) | ||
30 | - goto fail2; | ||
31 | + { | ||
32 | + grub_free (comp->internal_id); | ||
33 | + grub_free (comp); | ||
34 | + goto fail2; | ||
35 | + } | ||
36 | } | ||
37 | else | ||
38 | { | ||
39 | @@ -562,7 +566,11 @@ make_vg (grub_disk_t disk, | ||
40 | comp->segment_count = 1; | ||
41 | comp->segments = grub_malloc (sizeof (*comp->segments)); | ||
42 | if (!comp->segments) | ||
43 | - goto fail2; | ||
44 | + { | ||
45 | + grub_free (comp->internal_id); | ||
46 | + grub_free (comp); | ||
47 | + goto fail2; | ||
48 | + } | ||
49 | comp->segments->start_extent = 0; | ||
50 | comp->segments->extent_count = lv->size; | ||
51 | comp->segments->layout = 0; | ||
52 | @@ -574,15 +582,26 @@ make_vg (grub_disk_t disk, | ||
53 | comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK; | ||
54 | } | ||
55 | else | ||
56 | - goto fail2; | ||
57 | + { | ||
58 | + grub_free (comp->segments); | ||
59 | + grub_free (comp->internal_id); | ||
60 | + grub_free (comp); | ||
61 | + goto fail2; | ||
62 | + } | ||
63 | ptr += *ptr + 1; | ||
64 | ptr++; | ||
65 | if (!(vblk[i].flags & 0x10)) | ||
66 | - goto fail2; | ||
67 | + { | ||
68 | + grub_free (comp->segments); | ||
69 | + grub_free (comp->internal_id); | ||
70 | + grub_free (comp); | ||
71 | + goto fail2; | ||
72 | + } | ||
73 | if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic) | ||
74 | || ptr + *ptr + 1 >= vblk[i].dynamic | ||
75 | + sizeof (vblk[i].dynamic)) | ||
76 | { | ||
77 | + grub_free (comp->segments); | ||
78 | grub_free (comp->internal_id); | ||
79 | grub_free (comp); | ||
80 | goto fail2; | ||
81 | @@ -592,6 +611,7 @@ make_vg (grub_disk_t disk, | ||
82 | if (ptr + *ptr + 1 >= vblk[i].dynamic | ||
83 | + sizeof (vblk[i].dynamic)) | ||
84 | { | ||
85 | + grub_free (comp->segments); | ||
86 | grub_free (comp->internal_id); | ||
87 | grub_free (comp); | ||
88 | goto fail2; | ||
89 | @@ -601,7 +621,12 @@ make_vg (grub_disk_t disk, | ||
90 | comp->segments->nodes = grub_calloc (comp->segments->node_alloc, | ||
91 | sizeof (*comp->segments->nodes)); | ||
92 | if (!lv->segments->nodes) | ||
93 | - goto fail2; | ||
94 | + { | ||
95 | + grub_free (comp->segments); | ||
96 | + grub_free (comp->internal_id); | ||
97 | + grub_free (comp); | ||
98 | + goto fail2; | ||
99 | + } | ||
100 | } | ||
101 | |||
102 | if (lv->segments->node_alloc == lv->segments->node_count) | ||
103 | @@ -611,11 +636,23 @@ make_vg (grub_disk_t disk, | ||
104 | |||
105 | if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || | ||
106 | grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) | ||
107 | - goto fail2; | ||
108 | + { | ||
109 | + grub_free (comp->segments->nodes); | ||
110 | + grub_free (comp->segments); | ||
111 | + grub_free (comp->internal_id); | ||
112 | + grub_free (comp); | ||
113 | + goto fail2; | ||
114 | + } | ||
115 | |||
116 | t = grub_realloc (lv->segments->nodes, sz); | ||
117 | if (!t) | ||
118 | - goto fail2; | ||
119 | + { | ||
120 | + grub_free (comp->segments->nodes); | ||
121 | + grub_free (comp->segments); | ||
122 | + grub_free (comp->internal_id); | ||
123 | + grub_free (comp); | ||
124 | + goto fail2; | ||
125 | + } | ||
126 | lv->segments->nodes = t; | ||
127 | } | ||
128 | lv->segments->nodes[lv->segments->node_count].pv = 0; | ||
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 94b89aa643..479e2f71f2 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc | |||
@@ -62,6 +62,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ | |||
62 | file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ | 62 | file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ |
63 | file://0014-zstd-Initialize-seq_t-structure-fully.patch \ | 63 | file://0014-zstd-Initialize-seq_t-structure-fully.patch \ |
64 | file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ | 64 | file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ |
65 | file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \ | ||
65 | " | 66 | " |
66 | SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" | 67 | SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" |
67 | SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" | 68 | SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" |