summaryrefslogtreecommitdiffstats
path: root/meta/recipes-bsp
diff options
context:
space:
mode:
authorMarta Rybczynska <rybczynska@gmail.com>2022-02-18 11:05:24 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-03-02 00:21:37 +0000
commitda4ba2d04e3dabf2ab0432e7abecd4a78dabdde5 (patch)
treecce6032768d82c5bc4f4210ce16705b2d9167f59 /meta/recipes-bsp
parent90b1d407c6636acdfcfcadb8c99986aab5416a98 (diff)
downloadpoky-da4ba2d04e3dabf2ab0432e7abecd4a78dabdde5.tar.gz
grub: fix a memory leak
Add a fix for a memory leak in grub's disk/ldm. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 9fa41d5fbd1de899d1242c31d427262cd041d47c) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-bsp')
-rw-r--r--meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch128
-rw-r--r--meta/recipes-bsp/grub/grub2.inc1
2 files changed, 129 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch
new file mode 100644
index 0000000000..c1687c75d0
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch
@@ -0,0 +1,128 @@
1From 0c5d0fd796e6cafba179321de396681a493c4158 Mon Sep 17 00:00:00 2001
2From: Marco A Benatto <mbenatto@redhat.com>
3Date: Mon, 7 Dec 2020 11:53:03 -0300
4Subject: [PATCH] disk/ldm: Make sure comp data is freed before exiting from
5 make_vg()
6
7Several error handling paths in make_vg() do not free comp data before
8jumping to fail2 label and returning from the function. This will leak
9memory. So, let's fix all issues of that kind.
10
11Fixes: CID 73804
12
13Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=23e39f50ca7a107f6b66396ed4d177a914dee035]
17Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com>
18---
19 grub-core/disk/ldm.c | 51 ++++++++++++++++++++++++++++++++++++++------
20 1 file changed, 44 insertions(+), 7 deletions(-)
21
22diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
23index 58f8a53..428415f 100644
24--- a/grub-core/disk/ldm.c
25+++ b/grub-core/disk/ldm.c
26@@ -554,7 +554,11 @@ make_vg (grub_disk_t disk,
27 comp->segments = grub_calloc (comp->segment_alloc,
28 sizeof (*comp->segments));
29 if (!comp->segments)
30- goto fail2;
31+ {
32+ grub_free (comp->internal_id);
33+ grub_free (comp);
34+ goto fail2;
35+ }
36 }
37 else
38 {
39@@ -562,7 +566,11 @@ make_vg (grub_disk_t disk,
40 comp->segment_count = 1;
41 comp->segments = grub_malloc (sizeof (*comp->segments));
42 if (!comp->segments)
43- goto fail2;
44+ {
45+ grub_free (comp->internal_id);
46+ grub_free (comp);
47+ goto fail2;
48+ }
49 comp->segments->start_extent = 0;
50 comp->segments->extent_count = lv->size;
51 comp->segments->layout = 0;
52@@ -574,15 +582,26 @@ make_vg (grub_disk_t disk,
53 comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK;
54 }
55 else
56- goto fail2;
57+ {
58+ grub_free (comp->segments);
59+ grub_free (comp->internal_id);
60+ grub_free (comp);
61+ goto fail2;
62+ }
63 ptr += *ptr + 1;
64 ptr++;
65 if (!(vblk[i].flags & 0x10))
66- goto fail2;
67+ {
68+ grub_free (comp->segments);
69+ grub_free (comp->internal_id);
70+ grub_free (comp);
71+ goto fail2;
72+ }
73 if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic)
74 || ptr + *ptr + 1 >= vblk[i].dynamic
75 + sizeof (vblk[i].dynamic))
76 {
77+ grub_free (comp->segments);
78 grub_free (comp->internal_id);
79 grub_free (comp);
80 goto fail2;
81@@ -592,6 +611,7 @@ make_vg (grub_disk_t disk,
82 if (ptr + *ptr + 1 >= vblk[i].dynamic
83 + sizeof (vblk[i].dynamic))
84 {
85+ grub_free (comp->segments);
86 grub_free (comp->internal_id);
87 grub_free (comp);
88 goto fail2;
89@@ -601,7 +621,12 @@ make_vg (grub_disk_t disk,
90 comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
91 sizeof (*comp->segments->nodes));
92 if (!lv->segments->nodes)
93- goto fail2;
94+ {
95+ grub_free (comp->segments);
96+ grub_free (comp->internal_id);
97+ grub_free (comp);
98+ goto fail2;
99+ }
100 }
101
102 if (lv->segments->node_alloc == lv->segments->node_count)
103@@ -611,11 +636,23 @@ make_vg (grub_disk_t disk,
104
105 if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
106 grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
107- goto fail2;
108+ {
109+ grub_free (comp->segments->nodes);
110+ grub_free (comp->segments);
111+ grub_free (comp->internal_id);
112+ grub_free (comp);
113+ goto fail2;
114+ }
115
116 t = grub_realloc (lv->segments->nodes, sz);
117 if (!t)
118- goto fail2;
119+ {
120+ grub_free (comp->segments->nodes);
121+ grub_free (comp->segments);
122+ grub_free (comp->internal_id);
123+ grub_free (comp);
124+ goto fail2;
125+ }
126 lv->segments->nodes = t;
127 }
128 lv->segments->nodes[lv->segments->node_count].pv = 0;
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 94b89aa643..479e2f71f2 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -62,6 +62,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
62 file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \ 62 file://0013-io-lzopio-Resolve-unnecessary-self-assignment-errors.patch \
63 file://0014-zstd-Initialize-seq_t-structure-fully.patch \ 63 file://0014-zstd-Initialize-seq_t-structure-fully.patch \
64 file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \ 64 file://0015-kern-partition-Check-for-NULL-before-dereferencing-i.patch \
65 file://0016-disk-ldm-Make-sure-comp-data-is-freed-before-exiting.patch \
65 " 66 "
66SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" 67SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934"
67SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" 68SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-25 12:59:44 +0000