backport some patches from upstream
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
This commit is contained in:
Qiumiao Zhang
parent
0793726a95
commit
fbde2eddf8
119
backport-fs-udf-Fix-out-of-bounds-access.patch
Normal file
119
backport-fs-udf-Fix-out-of-bounds-access.patch
Normal file
@ -0,0 +1,119 @@
|
|||||||
|
From a24ea9241cb42e8ba670ac8d8ce54275df73a271 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lidong Chen <lidong.chen@oracle.com>
|
||||||
|
Date: Wed, 7 Jun 2023 01:31:06 +0000
|
||||||
|
Subject: fs/udf: Fix out of bounds access
|
||||||
|
|
||||||
|
Implemented a boundary check before advancing the allocation
|
||||||
|
descriptors pointer.
|
||||||
|
|
||||||
|
Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=a24ea9241cb42e8ba670ac8d8ce54275df73a271
|
||||||
|
Conflict:NA
|
||||||
|
|
||||||
|
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
|
||||||
|
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
|
||||||
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||||
|
---
|
||||||
|
grub-core/fs/udf.c | 38 ++++++++++++++++++++++++++++++++++++++
|
||||||
|
1 file changed, 38 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
|
||||||
|
index 7679ea3..b836e61 100644
|
||||||
|
--- a/grub-core/fs/udf.c
|
||||||
|
+++ b/grub-core/fs/udf.c
|
||||||
|
@@ -114,6 +114,10 @@ GRUB_MOD_LICENSE ("GPLv3+");
|
||||||
|
#define GRUB_UDF_PARTMAP_TYPE_1 1
|
||||||
|
#define GRUB_UDF_PARTMAP_TYPE_2 2
|
||||||
|
|
||||||
|
+#define GRUB_UDF_INVALID_STRUCT_PTR(_ptr, _struct) \
|
||||||
|
+ ((char *) (_ptr) >= end_ptr || \
|
||||||
|
+ ((grub_ssize_t) (end_ptr - (char *) (_ptr)) < (grub_ssize_t) sizeof (_struct)))
|
||||||
|
+
|
||||||
|
struct grub_udf_lb_addr
|
||||||
|
{
|
||||||
|
grub_uint32_t block_num;
|
||||||
|
@@ -458,6 +462,7 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
|
||||||
|
char *ptr;
|
||||||
|
grub_ssize_t len;
|
||||||
|
grub_disk_addr_t filebytes;
|
||||||
|
+ char *end_ptr;
|
||||||
|
|
||||||
|
switch (U16 (node->block.fe.tag.tag_ident))
|
||||||
|
{
|
||||||
|
@@ -476,9 +481,17 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ end_ptr = (char *) node + get_fshelp_size (node->data);
|
||||||
|
+
|
||||||
|
if ((U16 (node->block.fe.icbtag.flags) & GRUB_UDF_ICBTAG_FLAG_AD_MASK)
|
||||||
|
== GRUB_UDF_ICBTAG_FLAG_AD_SHORT)
|
||||||
|
{
|
||||||
|
+ if (GRUB_UDF_INVALID_STRUCT_PTR (ptr, struct grub_udf_short_ad))
|
||||||
|
+ {
|
||||||
|
+ grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
struct grub_udf_short_ad *ad = (struct grub_udf_short_ad *) ptr;
|
||||||
|
|
||||||
|
filebytes = fileblock * U32 (node->data->lvd.bsize);
|
||||||
|
@@ -542,10 +555,22 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
|
||||||
|
filebytes -= adlen;
|
||||||
|
ad++;
|
||||||
|
len -= sizeof (struct grub_udf_short_ad);
|
||||||
|
+
|
||||||
|
+ if (GRUB_UDF_INVALID_STRUCT_PTR (ad, struct grub_udf_short_ad))
|
||||||
|
+ {
|
||||||
|
+ grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
+ if (GRUB_UDF_INVALID_STRUCT_PTR (ptr, struct grub_udf_long_ad))
|
||||||
|
+ {
|
||||||
|
+ grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
struct grub_udf_long_ad *ad = (struct grub_udf_long_ad *) ptr;
|
||||||
|
|
||||||
|
filebytes = fileblock * U32 (node->data->lvd.bsize);
|
||||||
|
@@ -611,6 +636,12 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
|
||||||
|
filebytes -= adlen;
|
||||||
|
ad++;
|
||||||
|
len -= sizeof (struct grub_udf_long_ad);
|
||||||
|
+
|
||||||
|
+ if (GRUB_UDF_INVALID_STRUCT_PTR (ad, struct grub_udf_long_ad))
|
||||||
|
+ {
|
||||||
|
+ grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -630,6 +661,7 @@ grub_udf_read_file (grub_fshelp_node_t node,
|
||||||
|
case GRUB_UDF_ICBTAG_FLAG_AD_IN_ICB:
|
||||||
|
{
|
||||||
|
char *ptr;
|
||||||
|
+ char *end_ptr = (char *) node + get_fshelp_size (node->data);
|
||||||
|
|
||||||
|
ptr = ((U16 (node->block.fe.tag.tag_ident) == GRUB_UDF_TAG_IDENT_FE) ?
|
||||||
|
((char *) &node->block.fe.ext_attr[0]
|
||||||
|
@@ -637,6 +669,12 @@ grub_udf_read_file (grub_fshelp_node_t node,
|
||||||
|
((char *) &node->block.efe.ext_attr[0]
|
||||||
|
+ U32 (node->block.efe.ext_attr_length)));
|
||||||
|
|
||||||
|
+ if ((ptr + pos + len) > end_ptr)
|
||||||
|
+ {
|
||||||
|
+ grub_error (GRUB_ERR_BAD_FS, "corrupted UDF file system");
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
grub_memcpy (buf, ptr + pos, len);
|
||||||
|
|
||||||
|
return len;
|
||||||
|
--
|
||||||
|
cgit v1.1
|
||||||
|
|
||||||
@ -0,0 +1,38 @@
|
|||||||
|
From 9dbfbcd660470c3b951d15af0f6ce5a423185ad2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Kiper <daniel.kiper@oracle.com>
|
||||||
|
Date: Fri, 23 Jun 2023 00:02:24 +0200
|
||||||
|
Subject: lib/relocator: Fix OOB write when initializing lo->freebytes[]
|
||||||
|
|
||||||
|
Fixes: CID 96636
|
||||||
|
|
||||||
|
Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=9dbfbcd660470c3b951d15af0f6ce5a423185ad2
|
||||||
|
Conflict:NA
|
||||||
|
|
||||||
|
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||||
|
Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
|
||||||
|
---
|
||||||
|
grub-core/lib/relocator.c | 8 +++++---
|
||||||
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c
|
||||||
|
index 568fc0b..e0478ae 100644
|
||||||
|
--- a/grub-core/lib/relocator.c
|
||||||
|
+++ b/grub-core/lib/relocator.c
|
||||||
|
@@ -881,9 +881,11 @@ malloc_in_range (struct grub_relocator *rel,
|
||||||
|
offend = GRUB_RELOCATOR_FIRMWARE_REQUESTS_QUANT;
|
||||||
|
lo->freebytes[offstart / 8]
|
||||||
|
&= ((1 << (8 - (start % 8))) - 1);
|
||||||
|
- grub_memset (lo->freebytes + (offstart + 7) / 8, 0,
|
||||||
|
- offend / 8 - (offstart + 7) / 8);
|
||||||
|
- lo->freebytes[offend / 8] &= ~((1 << (offend % 8)) - 1);
|
||||||
|
+ if (offend / 8 > (offstart + 7) / 8)
|
||||||
|
+ grub_memset (lo->freebytes + (offstart + 7) / 8, 0,
|
||||||
|
+ offend / 8 - (offstart + 7) / 8);
|
||||||
|
+ if (offend < GRUB_RELOCATOR_FIRMWARE_REQUESTS_QUANT)
|
||||||
|
+ lo->freebytes[offend / 8] &= ~((1 << (offend % 8)) - 1);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
#endif
|
||||||
|
--
|
||||||
|
cgit v1.1
|
||||||
|
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
From 3077b39baef99afe534b582b9024bba877786e40 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Qiumiao Zhang <zhangqiumiao1@huawei.com>
|
||||||
|
Date: Tue, 25 Jul 2023 11:18:59 +0800
|
||||||
|
Subject: util/grub-mount: Fix memory leak in fuse_getattr()
|
||||||
|
|
||||||
|
Reference:https://git.savannah.gnu.org/cgit/grub.git/commit?id=3077b39baef99afe534b582b9024bba877786e40
|
||||||
|
Conflict:NA
|
||||||
|
|
||||||
|
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
|
||||||
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||||
|
---
|
||||||
|
util/grub-mount.c | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/util/grub-mount.c b/util/grub-mount.c
|
||||||
|
index 1c35b6a..c69889d 100644
|
||||||
|
--- a/util/grub-mount.c
|
||||||
|
+++ b/util/grub-mount.c
|
||||||
|
@@ -198,6 +198,7 @@ fuse_getattr (const char *path, struct stat *st,
|
||||||
|
(fs->fs_dir) (dev, path2, fuse_getattr_find_file, &ctx);
|
||||||
|
|
||||||
|
grub_free (path2);
|
||||||
|
+ free (pathname);
|
||||||
|
if (!ctx.file_exists)
|
||||||
|
{
|
||||||
|
grub_errno = GRUB_ERR_NONE;
|
||||||
|
--
|
||||||
|
cgit v1.1
|
||||||
|
|
||||||
@ -341,3 +341,6 @@ Patch0331: backport-util-grub-install-common-Fix-the-key-of.patch
|
|||||||
Patch0332: backport-kern-efi-mm-Fix-use-after-free-in-finish-boot-services.patch
|
Patch0332: backport-kern-efi-mm-Fix-use-after-free-in-finish-boot-services.patch
|
||||||
Patch0333: backport-kern-Check-for-NULL-when-closing-devices-and-disks.patch
|
Patch0333: backport-kern-Check-for-NULL-when-closing-devices-and-disks.patch
|
||||||
Patch0334: backport-RISC-V-Handle-R_RISCV_CALL_PLT-reloc.patch
|
Patch0334: backport-RISC-V-Handle-R_RISCV_CALL_PLT-reloc.patch
|
||||||
|
Patch0335: backport-fs-udf-Fix-out-of-bounds-access.patch
|
||||||
|
Patch0336: backport-lib-relocator-Fix-OOB-write-when-initializing-lo-freebytes.patch
|
||||||
|
Patch0337: backport-util-grub-mount-Fix-memory-leak-in-fuse_getattr.patch
|
||||||
|
|||||||
10
grub2.spec
10
grub2.spec
@ -14,7 +14,7 @@
|
|||||||
Name: grub2
|
Name: grub2
|
||||||
Epoch: 1
|
Epoch: 1
|
||||||
Version: 2.06
|
Version: 2.06
|
||||||
Release: 36
|
Release: 37
|
||||||
Summary: Bootloader with support for Linux, Multiboot and more
|
Summary: Bootloader with support for Linux, Multiboot and more
|
||||||
License: GPLv3+
|
License: GPLv3+
|
||||||
URL: http://www.gnu.org/software/grub/
|
URL: http://www.gnu.org/software/grub/
|
||||||
@ -440,6 +440,14 @@ fi
|
|||||||
%{_datadir}/man/man*
|
%{_datadir}/man/man*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Sep 13 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-37
|
||||||
|
- Type:bugfix
|
||||||
|
- CVE:NA
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fs/udf: Fix out of bounds access
|
||||||
|
lib/relocator: Fix OOB write when initializing lo->freebytes[]
|
||||||
|
util/grub-mount: Fix memory leak in fuse_getattr()
|
||||||
|
|
||||||
* Fri Sep 1 2023 ouuleilei <wangliu@iscas.ac.cn> - 1:2.06-36
|
* Fri Sep 1 2023 ouuleilei <wangliu@iscas.ac.cn> - 1:2.06-36
|
||||||
add a patch to fix build error
|
add a patch to fix build error
|
||||||
|
|
||||||
|
|||||||
@ -1,3 +1,3 @@
|
|||||||
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
|
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
|
||||||
grub,1,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
|
grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
|
||||||
grub.openeuler,1,The openEuler Project,grub2,@@VERSION_RELEASE@@,https://gitee.com/src-openeuler/grub2
|
grub.openeuler,1,The openEuler Project,grub2,@@VERSION_RELEASE@@,https://gitee.com/src-openeuler/grub2
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user