From 0148405edfe1aafbda7284d10775379a0c5caf69 Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Wed, 27 Nov 2024 11:03:43 -0600 Subject: [PATCH 01/45] 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable Resolves: #2325960 Signed-off-by: Marta Lewandowska Reviewed-by: Leo Sandoval --- 99-grub-mkconfig.install | 6 ++++++ grub2.spec | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 1411f6ac..8048648c 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -4,6 +4,12 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then exit 0 fi +# Run grub2-mkconfig if ENABLE_BLSCFG is false +if grep -q '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then + RUN_MKCONFIG=true + DISABLE_BLS=true +fi + # PV and PVH Xen DomU guests boot with pygrub that doesn't have BLS support, # also Xen Dom0 use the menuentries from 20_linux_xen and not the ones from # 10_linux. So BLS support needs to be disabled for both Xen Dom0 and DomU. diff --git a/grub2.spec b/grub2.spec index 01a889b4..3ed24660 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed Nov 27 2024 Marta Lewandowska - 2.12-16 +- 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable +- Resolves: #2325960 + * Thu Nov 21 2024 Andrea Bolognani 2.12-15 - Add riscv64 support (thanks Jason Montleon) From 5c68e667c71cbab5ae9b850340b3cbc416dc1bf1 Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Wed, 27 Nov 2024 11:10:45 -0600 Subject: [PATCH 02/45] 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks On PPC systems, there is no need to check petiboot's version, so remove all related lines and unconditionally turn on the corresponding flag. Signed-off-by: Marta Lewandowska Reviewed-by: Leo Sandoval --- 99-grub-mkconfig.install | 21 +++------------------ grub2.spec | 5 ++++- 2 files changed, 7 insertions(+), 19 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 8048648c..a14f5fd8 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -21,25 +21,10 @@ if [[ -e /sys/hypervisor/type ]] && grep -q "^xen$" /sys/hypervisor/type; then fi ARCH=$(uname -m) -# Older ppc64le OPAL firmware (petitboot version < 1.8.0) don't have BLS support -# so grub2-mkconfig has to be run to generate a config with menuentry commands. +# Older ppc64le OPAL firmware don't have BLS support so grub2-mkconfig has to be +# run to generate a config with menuentry commands. if [[ $ARCH = "ppc64le" ]] && [ -d /sys/firmware/opal ]; then - - petitboot_path="/sys/firmware/devicetree/base/ibm,firmware-versions/petitboot" - - if test -e ${petitboot_path}; then - read -r -d '' petitboot_version < ${petitboot_path} - petitboot_version="$(echo ${petitboot_version//v})" - major_version="$(echo ${petitboot_version} | cut -d . -f1)" - minor_version="$(echo ${petitboot_version} | cut -d . -f2)" - - if test -z ${petitboot_version} || test ${major_version} -lt 1 || \ - test ${major_version} -eq 1 -a ${minor_version} -lt 8; then - RUN_MKCONFIG=true - fi - else - RUN_MKCONFIG=true - fi + RUN_MKCONFIG=true fi if [[ $DISABLE_BLS = "true" ]]; then diff --git a/grub2.spec b/grub2.spec index 3ed24660..55879ec3 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed Nov 27 2024 Marta Lewandowska - 2.12-17 +- 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks + * Wed Nov 27 2024 Marta Lewandowska - 2.12-16 - 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable - Resolves: #2325960 From 86c2c3cc6da0255bf19e3f9154781864016d6548 Mon Sep 17 00:00:00 2001 From: Peter Georg Date: Mon, 9 Dec 2024 21:57:30 +0100 Subject: [PATCH 03/45] Really allow xz'd symvers file Fixes: 78d64adfbe3cd089df8e41166c3688f026acdad1 Signed-off-by: Peter Georg --- 20-grub.install | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/20-grub.install b/20-grub.install index d9d1d1d7..d5ab5875 100755 --- a/20-grub.install +++ b/20-grub.install @@ -96,12 +96,12 @@ case "$COMMAND" in command -v restorecon &>/dev/null && \ restorecon "/boot/symvers-${KERNEL_VERSION}.gz" fi - # symvers is symvers-.bz symlink, needs a special treatment - i="$KERNEL_DIR/symvers.bz" + # symvers is symvers-.xz symlink, needs a special treatment + i="$KERNEL_DIR/symvers.xz" if [[ -e "$i" ]]; then - ln -fs "$i" "/boot/symvers-${KERNEL_VERSION}.bz" + ln -fs "$i" "/boot/symvers-${KERNEL_VERSION}.xz" command -v restorecon &>/dev/null && \ - restorecon "/boot/symvers-${KERNEL_VERSION}.bz" + restorecon "/boot/symvers-${KERNEL_VERSION}.xz" fi fi From 0083b9609af3989a23943df6c2d03ba7e332dd21 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 19 Dec 2024 10:20:31 +0100 Subject: [PATCH 04/45] add bli (boot loader info) module to efi modules Signed-off-by: Gerd Hoffmann --- grub.macros | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub.macros b/grub.macros index ba7ff0f5..417b3649 100644 --- a/grub.macros +++ b/grub.macros @@ -140,7 +140,7 @@ %{?with_efi_only:%global without_efi_only 1} %ifarch %{efi_arch} -%global efi_modules " efi_netfs efifwsetup efinet lsefi lsefimmap connectefi " +%global efi_modules " efi_netfs efifwsetup efinet lsefi lsefimmap connectefi bli " %endif %global xen_arch x86_64 From cd9f78bd4d7806cf8a8565a9466cfc687149c3c3 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Thu, 9 Jan 2025 17:15:07 +0100 Subject: [PATCH 05/45] fs/xfs: fix large extent counters incompat feature support Signed-off-by: Nicolas Frayer --- ...-extent-counters-incompat-feature-su.patch | 44 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 ++- 3 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch diff --git a/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch b/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch new file mode 100644 index 00000000..ba641630 --- /dev/null +++ b/0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Wed, 4 Dec 2024 07:50:28 -0600 +Subject: [PATCH] fs/xfs: fix large extent counters incompat feature support + +When large extent counter / NREXT64 support was added to grub, it missed +a couple of direct reads of nextents which need to be changed to the new +NREXT64-aware helper as well. Without this, we'll have mis-reads of some +directories with this feature enabled. + +(The large extent counter fix likely raced on merge with +07318ee7e ("fs/xfs: Fix XFS directory extent parsing") which added the new +direct nextents reads just prior, causing this issue.) + +Fixes: aa7c1322671e ("fs/xfs: Add large extent counters incompat feature support") +Signed-off-by: Eric Sandeen +Reviewed-by: Anthony Iliopoulos +Reviewed-by: Jon DeVree +--- + grub-core/fs/xfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 8e02ab4a3014..92046f9bdf49 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -926,7 +926,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + * Leaf and tail information are only in the data block if the number + * of extents is 1. + */ +- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) + { + struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); + +@@ -980,7 +980,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + * The expected number of directory entries is only tracked for the + * single extent case. + */ +- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) + { + /* Check if last direntry in this block is reached. */ + entries--; diff --git a/grub.patches b/grub.patches index 45df8060..bec34840 100644 --- a/grub.patches +++ b/grub.patches @@ -281,3 +281,4 @@ Patch0280: 0280-Enable-building-blscfg-module-on-xen-and-xen_pvh.patch Patch0281: 0281-loader-efi-Fix-RISC-V-build.patch Patch0282: 0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch +Patch0284: 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch diff --git a/grub2.spec b/grub2.spec index 55879ec3..1467c697 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 17%{?dist} +Release: 18%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Thu Jan 9 2025 Nicolas Frayer - 2.12-18 +- fs/xfs: fix large extent counters incompat feature support + * Wed Nov 27 2024 Marta Lewandowska - 2.12-17 - 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks From 40c3b05654e7f4389f9b2c8e1d41a3eac77e4207 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 13 Jan 2025 18:50:21 -0600 Subject: [PATCH 06/45] term/nns8250-spcr: return if redirection is disabled Signed-off-by: Leo Sandoval --- ...cr-return-if-redirection-is-disabled.patch | 34 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 ++- 3 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch diff --git a/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch b/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch new file mode 100644 index 00000000..4e5cdc1c --- /dev/null +++ b/0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Thu, 16 Jan 2025 10:22:48 -0600 +Subject: [PATCH] term/nns8250-spcr: return if redirection is disabled + +The Microsoft spec for SPCR says "The base address of the Serial Port register +set described using the ACPI Generic Address Structure, or 0 if console +redirection is disabled." so return if disable (base address = 0). If this check +is not done, we may get invalid ports for those particular machines that +redirection is disabled and at some point hanging the booting execution when +reading the grub.cfg configuration file. + +Signed-off-by: Benjamin Herrenschmidt +Reviewed-by: Leo Sandoval +--- + grub-core/term/ns8250-spcr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/term/ns8250-spcr.c b/grub-core/term/ns8250-spcr.c +index d52b52c26..86f1aa078 100644 +--- a/grub-core/term/ns8250-spcr.c ++++ b/grub-core/term/ns8250-spcr.c +@@ -75,6 +75,11 @@ grub_ns8250_spcr_init (void) + config.speed = 115200; + break; + }; ++ ++ /* if base address is 0, it means redirection is disable, so return it */ ++ if (spcr->base_addr.addr == 0) ++ return NULL; ++ + switch (spcr->base_addr.space_id) + { + case GRUB_ACPI_GENADDR_MEM_SPACE: diff --git a/grub.patches b/grub.patches index bec34840..8c659db2 100644 --- a/grub.patches +++ b/grub.patches @@ -282,3 +282,4 @@ Patch0281: 0281-loader-efi-Fix-RISC-V-build.patch Patch0282: 0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch Patch0284: 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch +Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index 1467c697..2ba6bb63 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Mon Jan 13 2025 Leo Sandoval 2.12-19 +- term/nns8250-spcr: return if redirection is disabled + * Thu Jan 9 2025 Nicolas Frayer - 2.12-18 - fs/xfs: fix large extent counters incompat feature support From 5ad3db94861fd165d88dcf9cdbaff40309100852 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Wed, 22 Jan 2025 14:36:40 -0600 Subject: [PATCH 07/45] fix pending SAST issues Related: #RHEL-50504 Signed-off-by: Leo Sandoval --- ...s-legacycfg-Avoid-closing-file-twice.patch | 37 +++++++++++++++++++ ...ove-conditional-operator-for-endtime.patch | 27 ++++++++++++++ grub.patches | 4 +- grub2.spec | 6 ++- 4 files changed, 72 insertions(+), 2 deletions(-) create mode 100644 0286-commands-legacycfg-Avoid-closing-file-twice.patch create mode 100644 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch diff --git a/0286-commands-legacycfg-Avoid-closing-file-twice.patch b/0286-commands-legacycfg-Avoid-closing-file-twice.patch new file mode 100644 index 00000000..2e126ab3 --- /dev/null +++ b/0286-commands-legacycfg-Avoid-closing-file-twice.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 16 Oct 2024 11:54:38 -0600 +Subject: [PATCH] commands/legacycfg: Avoid closing file twice + +An internal (at Red Hat) static soure code scan detected an +use-after-free scenario: + + Error: USE_AFTER_FREE (CWE-416): + grub-2.06/grub-core/commands/legacycfg.c:194: freed_arg: "grub_file_close" frees "file". + grub-2.06/grub-core/commands/legacycfg.c:201: deref_arg: Calling "grub_file_close" dereferences freed pointer "file". + # 199| if (!args) + # 200| { + # 201|-> grub_file_close (file); + # 202| grub_free (suffix); + # 203| grub_free (entrysrc); + +So, remove the extra file close call. + +Signed-off-by: Leo Sandoval +Reviewed-by: Daniel Kiper +--- + grub-core/commands/legacycfg.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index 2c5d1a0ef..86bcda695 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -198,7 +198,6 @@ legacy_file (const char *filename) + const char **args = grub_malloc (sizeof (args[0])); + if (!args) + { +- grub_file_close (file); + grub_free (suffix); + grub_free (entrysrc); + return grub_errno; diff --git a/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch b/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch new file mode 100644 index 00000000..759cd4f9 --- /dev/null +++ b/0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 22 Jan 2025 13:37:42 -0600 +Subject: [PATCH] disk/ahci.c: remove conditional operator for endtime + +The conditional makes no sense when the two possible expressions have the same +value, so remove it (perhaps the compiler does it for us but better to remove +it). + +Signed-off-by: Leo Sandoval +--- + grub-core/disk/ahci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/disk/ahci.c b/grub-core/disk/ahci.c +index e7b5dc5f2..b247161b9 100644 +--- a/grub-core/disk/ahci.c ++++ b/grub-core/disk/ahci.c +@@ -1038,7 +1038,7 @@ grub_ahci_readwrite_real (struct grub_ahci_device *dev, + grub_dprintf ("ahci", "AHCI tfd = %x\n", + dev->hba->ports[dev->port].task_file_data); + +- endtime = grub_get_time_ms () + (spinup ? 20000 : 20000); ++ endtime = grub_get_time_ms () + 20000; + while ((dev->hba->ports[dev->port].command_issue & 1)) + if (grub_get_time_ms () > endtime || + (dev->hba->ports[dev->port].intstatus & GRUB_AHCI_HBA_PORT_IS_FATAL_MASK)) diff --git a/grub.patches b/grub.patches index 8c659db2..18818609 100644 --- a/grub.patches +++ b/grub.patches @@ -282,4 +282,6 @@ Patch0281: 0281-loader-efi-Fix-RISC-V-build.patch Patch0282: 0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch Patch0284: 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch -Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch \ No newline at end of file +Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch +Patch0286: 0286-commands-legacycfg-Avoid-closing-file-twice.patch +Patch0287: 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index 2ba6bb63..081b321e 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 19%{?dist} +Release: 20%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed Jan 22 2025 Leo Sandoval 2.12-20 +- fix pending SAST issues +- Related: #RHEL-50504 + * Mon Jan 13 2025 Leo Sandoval 2.12-19 - term/nns8250-spcr: return if redirection is disabled From 60fc42215c66c26657581ca2bac0da40d2b4883b Mon Sep 17 00:00:00 2001 From: josef radinger Date: Sun, 19 Jan 2025 19:41:52 +0000 Subject: [PATCH 08/45] Update 0055-Add-grub2-switch-to-blscfg.patch fix small typo, which is visible in the Description in man page signed-off-by: josef radinger --- 0055-Add-grub2-switch-to-blscfg.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/0055-Add-grub2-switch-to-blscfg.patch b/0055-Add-grub2-switch-to-blscfg.patch index cb97a284..76732205 100644 --- a/0055-Add-grub2-switch-to-blscfg.patch +++ b/0055-Add-grub2-switch-to-blscfg.patch @@ -129,7 +129,7 @@ index 00000000000..a851424beb2 +# Print the usage. +usage () { + gettext_printf "Usage: %s\n" "$self" -+ gettext "Switch to BLS config files.\n"; echo ++ gettext "Switch to BLS config files."; echo + echo + print_option_help "-h, --help" "$(gettext "print this message and exit")" + print_option_help "-V, --version" "$(gettext "print the version information and exit")" From 20db2b22d863543f0f31b4c54cc7e65923473f62 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 28 Jan 2025 18:21:48 +0100 Subject: [PATCH 09/45] commands/bli: Fix crash in get_part_uuid() Resolves: #2339164 Signed-off-by: Nicolas Frayer --- ...mands-bli-Fix-crash-in-get_part_uuid.patch | 80 +++++++++++++++++++ grub.patches | 3 +- grub2.spec | 6 +- 3 files changed, 87 insertions(+), 2 deletions(-) create mode 100644 0288-commands-bli-Fix-crash-in-get_part_uuid.patch diff --git a/0288-commands-bli-Fix-crash-in-get_part_uuid.patch b/0288-commands-bli-Fix-crash-in-get_part_uuid.patch new file mode 100644 index 00000000..fe26cecb --- /dev/null +++ b/0288-commands-bli-Fix-crash-in-get_part_uuid.patch @@ -0,0 +1,80 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Wed, 17 Jul 2024 14:46:46 +0800 +Subject: [PATCH] commands/bli: Fix crash in get_part_uuid() + +The get_part_uuid() function made an assumption that the target GRUB +device is a partition device and accessed device->disk->partition +without checking for NULL. There are four situations where this +assumption is problematic: + +1. The device is a net device instead of a disk. +2. The device is an abstraction device, like LVM, RAID, or CRYPTO, which + is mostly logical "disk" ((lvmid/) and so on). +3. Firmware RAID may present the ESP to GRUB as an EFI disk (hd0) device + if it is contained within a Linux software RAID. +4. When booting from a CD-ROM, the ESP is a VFAT image indexed by the El + Torito boot catalog. The boot device is set to (cd0), corresponding + to the CD-ROM image mounted as an ISO 9660 filesystem. + +As a result, get_part_uuid() could lead to a NULL pointer dereference +and trigger a synchronous exception during boot if the ESP falls into +one of these categories. This patch fixes the problem by adding the +necessary checks to handle cases where the ESP is not a partition device. + +Additionally, to avoid disrupting the boot process, this patch relaxes +the severity of the errors in this context to non-critical. Errors will +be logged, but they will not prevent the boot process from continuing. + +Fixes: e0fa7dc84 (bli: Add a module for the Boot Loader Interface) + +Signed-off-by: Michael Chang +Reviewed-By: Oliver Steffen +Reviewed-by: Daniel Kiper +--- + grub-core/commands/bli.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/bli.c b/grub-core/commands/bli.c +index e0d8a54f7bea..298c5f70a876 100644 +--- a/grub-core/commands/bli.c ++++ b/grub-core/commands/bli.c +@@ -48,6 +48,22 @@ get_part_uuid (const char *device_name, char **part_uuid) + if (device == NULL) + return grub_error (grub_errno, N_("cannot open device: %s"), device_name); + ++ if (device->disk == NULL) ++ { ++ grub_dprintf ("bli", "%s is not a disk device, partuuid skipped\n", device_name); ++ *part_uuid = NULL; ++ grub_device_close (device); ++ return GRUB_ERR_NONE; ++ } ++ ++ if (device->disk->partition == NULL) ++ { ++ grub_dprintf ("bli", "%s has no partition, partuuid skipped\n", device_name); ++ *part_uuid = NULL; ++ grub_device_close (device); ++ return GRUB_ERR_NONE; ++ } ++ + disk = grub_disk_open (device->disk->name); + if (disk == NULL) + { +@@ -99,7 +115,7 @@ set_loader_device_part_uuid (void) + + status = get_part_uuid (device_name, &part_uuid); + +- if (status == GRUB_ERR_NONE) ++ if (status == GRUB_ERR_NONE && part_uuid) + status = grub_efi_set_variable_to_string ("LoaderDevicePartUUID", &bli_vendor_guid, part_uuid, + GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | + GRUB_EFI_VARIABLE_RUNTIME_ACCESS); +@@ -117,4 +133,6 @@ GRUB_MOD_INIT (bli) + GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | + GRUB_EFI_VARIABLE_RUNTIME_ACCESS); + set_loader_device_part_uuid (); ++ /* No error here is critical, other than being logged */ ++ grub_print_error (); + } diff --git a/grub.patches b/grub.patches index 18818609..2cd34418 100644 --- a/grub.patches +++ b/grub.patches @@ -284,4 +284,5 @@ Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch Patch0284: 0284-fs-xfs-Fix-large-extent-counters-incompat-feature-su.patch Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch Patch0286: 0286-commands-legacycfg-Avoid-closing-file-twice.patch -Patch0287: 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch \ No newline at end of file +Patch0287: 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch +Patch0288: 0288-commands-bli-Fix-crash-in-get_part_uuid.patch diff --git a/grub2.spec b/grub2.spec index 081b321e..d8499ae7 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 20%{?dist} +Release: 21%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Jan 28 2025 Nicolas Frayer 2.12-21 +- commands/bli: Fix crash in get_part_uuid() +- Resolves: #2339164 + * Wed Jan 22 2025 Leo Sandoval 2.12-20 - fix pending SAST issues - Related: #RHEL-50504 From a60abb0cdcbf28619ffd9f40e520e289f74bd373 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 4 Feb 2025 15:10:22 +0100 Subject: [PATCH 10/45] Phase 1 of the bootloader updates proposal implementation https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 Signed-off-by: Marta Lewandoska Signed-off-by: Nicolas Frayer Signed-off-by: Leo Sandoval --- grub.macros | 24 ++++++++++++++++-------- grub2.spec | 18 ++++++++++++++---- install_bootloader | 11 +++++++++++ 3 files changed, 41 insertions(+), 12 deletions(-) create mode 100755 install_bootloader diff --git a/grub.macros b/grub.macros index 417b3649..ec5f08c3 100644 --- a/grub.macros +++ b/grub.macros @@ -1,6 +1,10 @@ # vim:filetype=spec # Modules always contain just 32-bit code +%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global _libdir %{_exec_prefix}/lib +%global grub_root_dir %{_libdir}/grub2 +%global grub_version_dir %{grub_root_dir}/%{version}-%{release} +%global grub_efi_dir %{grub_version_dir}/EFI/%{efidir} %global _binaries_in_noarch_packages_terminate_build 0 #%%undefine _missing_build_ids_terminate_build %{expand:%%{!?buildsubdir:%%global buildsubdir grub-%{tarversion}}} @@ -704,8 +708,9 @@ find . '(' -iname gdb_grub \\\ ')' \\\ -exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \ find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \ -install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ +install -m 0755 %{SOURCE21} $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ %{expand:%%do_install_protected_file grub2-%{alt_package_arch}} \ cd .. \ %{nil} @@ -722,8 +727,9 @@ fi \ find $RPM_BUILD_ROOT -iname "*.module" -exec chmod a-x {} '\;' \ ln -s ../boot/grub2/grub.cfg \\\ $RPM_BUILD_ROOT%{_sysconfdir}/grub2-efi.cfg \ -install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ +install -m 0755 %{SOURCE21} $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ %ifarch %{arm} \ install -D -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_boot}/BOOTARM.EFI \ %endif \ @@ -823,7 +829,8 @@ cp -a $RPM_BUILD_ROOT%{_datarootdir}/locale/en\@quot \\\ cp docs/grub.info $RPM_BUILD_ROOT%{_infodir}/grub2.info \ cp docs/grub-dev.info \\\ $RPM_BUILD_ROOT%{_infodir}/grub2-dev.info \ -install -d -m 0700 ${RPM_BUILD_ROOT}%{efi_esp_dir}/ \ +install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ +install -D -d -m 0700 $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/loader/entries \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/themes/system \ @@ -871,14 +878,15 @@ ln -s ../boot/grub2/grub.cfg \\\ %defattr(-,root,root,-) \ %config(noreplace) %{_sysconfdir}/grub2.cfg \ %config(noreplace) %{_sysconfdir}/grub2-efi.cfg \ -%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{2} \ +%attr(0700,root,root) %verify(not mtime) %{grub_efi_dir}/%{2} \ +%{_prefix}/lib/bootloader/install_bootloader \ %ifarch %{arm} \ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ %endif \ %attr(0700,root,root)/boot/grub2/fonts \ %dir %attr(0700,root,root)/boot/loader/entries \ %ghost %config(noreplace) %attr(0600,root,root)/boot/grub2/grub.cfg \ -%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ +%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{grub_efi_dir}/grub.cfg \ %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv \ %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/grub2-%{1}.conf \ %{expand:%if 0%{?without_efi_modules} \ @@ -896,7 +904,7 @@ ln -s ../boot/grub2/grub.cfg \\\ \ %{expand:%%files %{1}-cdboot} \ %defattr(-,root,root,-) \ -%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{3} \ +%attr(0700,root,root) %verify(not mtime) %{grub_efi_dir}/%{3} \ %attr(0700,root,root)/boot/grub2/fonts \ %{nil} diff --git a/grub2.spec b/grub2.spec index d8499ae7..5f55cb78 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 21%{?dist} +Release: 22%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -35,6 +35,7 @@ Source9: strtoull_test.c Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in +Source21: install_bootloader %include %{SOURCE1} @@ -382,7 +383,7 @@ fi %posttrans common set -eu -EFI_HOME=%{efi_esp_dir} +EFI_HOME=%{grub_efi_dir} GRUB_HOME=/boot/grub2 ESP_PATH=/boot/efi @@ -426,6 +427,11 @@ fi mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg +%if 0%{with_efi_arch} +%posttrans efi-%{efiarch} +/usr/lib/bootloader/install_bootloader %{grub_efi_dir} %{efi_esp_dir} +%endif + %files common -f grub.lang %dir %{_libdir}/grub/ %dir %{_datarootdir}/grub/ @@ -439,8 +445,8 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %dir /boot/grub2/themes/system %attr(0700,root,root) %dir /boot/grub2 %exclude /boot/grub2/* -%dir %attr(0700,root,root) %{efi_esp_dir} -%exclude %{efi_esp_dir}/* +%dir %attr(0700,root,root) %{grub_version_dir} +%exclude %{grub_version_dir}/* %ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv %license COPYING %doc THANKS @@ -602,6 +608,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Feb 4 2025 Marta Lewandowska - 2.12-22 +- Phase 1 of the bootloader updates proposal implementation +- https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 + * Tue Jan 28 2025 Nicolas Frayer 2.12-21 - commands/bli: Fix crash in get_part_uuid() - Resolves: #2339164 diff --git a/install_bootloader b/install_bootloader new file mode 100755 index 00000000..1560e8b0 --- /dev/null +++ b/install_bootloader @@ -0,0 +1,11 @@ +#!/bin/bash + +if [[ $# -lt 2 ]]; then + echo "usage: $0 from_dir efi_dir" + exit 1 +fi + +from_dir=${1} +efi_dir=${2} + +cp ${from_dir}/* ${efi_dir}/ From ecd705e766c25c9150ce2e7afd72e67164ddcee4 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 7 Feb 2025 15:43:55 -0800 Subject: [PATCH 11/45] Ensure all scriptlets always exit 0, per guidelines Fedora package scriptlets are required to always exit 0. grub2's do not currently ensure this, and especially the new %posttrans scriptlet for grub2-efi actually exits non-zero during ostree builds, causing them to fail: https://bodhi.fedoraproject.org/updates/FEDORA-2025-5a25808a78#comment-3947404 This should fix that, and also make sure we never get the same problem with the other scriptlets in the package. Signed-off-by: Adam Williamson --- grub2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/grub2.spec b/grub2.spec index 5f55cb78..d55f9d13 100644 --- a/grub2.spec +++ b/grub2.spec @@ -365,6 +365,8 @@ elif [ -f /etc/grub.d/01_users ] && \ > /boot/grub2/user.cfg fi fi +# ensure we exit 0 +: %post tools %systemd_user_post grub-boot-success.timer @@ -425,11 +427,12 @@ if test -f ${EFI_HOME}/grubenv; then mv --force ${EFI_HOME}/grubenv ${GRUB_HOME}/grubenv fi -mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg +# ensure we exit 0 +mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %if 0%{with_efi_arch} %posttrans efi-%{efiarch} -/usr/lib/bootloader/install_bootloader %{grub_efi_dir} %{efi_esp_dir} +/usr/lib/bootloader/install_bootloader %{grub_efi_dir} %{efi_esp_dir} || : %endif %files common -f grub.lang From d03bbec7353787233039acc57fa9e8039f32a10e Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 11 Feb 2025 16:10:24 +0100 Subject: [PATCH 12/45] Revert "Phase 1 of the bootloader updates proposal implementation" This reverts commit a60abb0cdcbf28619ffd9f40e520e289f74bd373. Revert as not all components are ready for this change. Signed-off-by: Nicolas Frayer --- grub.macros | 24 ++++++++---------------- grub2.spec | 17 +++++++---------- install_bootloader | 11 ----------- 3 files changed, 15 insertions(+), 37 deletions(-) delete mode 100755 install_bootloader diff --git a/grub.macros b/grub.macros index ec5f08c3..417b3649 100644 --- a/grub.macros +++ b/grub.macros @@ -1,10 +1,6 @@ # vim:filetype=spec # Modules always contain just 32-bit code -%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global _libdir %{_exec_prefix}/lib -%global grub_root_dir %{_libdir}/grub2 -%global grub_version_dir %{grub_root_dir}/%{version}-%{release} -%global grub_efi_dir %{grub_version_dir}/EFI/%{efidir} %global _binaries_in_noarch_packages_terminate_build 0 #%%undefine _missing_build_ids_terminate_build %{expand:%%{!?buildsubdir:%%global buildsubdir grub-%{tarversion}}} @@ -708,9 +704,8 @@ find . '(' -iname gdb_grub \\\ ')' \\\ -exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \ find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \ -install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ -install -m 0755 %{SOURCE21} $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ +install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ %{expand:%%do_install_protected_file grub2-%{alt_package_arch}} \ cd .. \ %{nil} @@ -727,9 +722,8 @@ fi \ find $RPM_BUILD_ROOT -iname "*.module" -exec chmod a-x {} '\;' \ ln -s ../boot/grub2/grub.cfg \\\ $RPM_BUILD_ROOT%{_sysconfdir}/grub2-efi.cfg \ -install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ -install -m 0755 %{SOURCE21} $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ +install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ %ifarch %{arm} \ install -D -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_boot}/BOOTARM.EFI \ %endif \ @@ -829,8 +823,7 @@ cp -a $RPM_BUILD_ROOT%{_datarootdir}/locale/en\@quot \\\ cp docs/grub.info $RPM_BUILD_ROOT%{_infodir}/grub2.info \ cp docs/grub-dev.info \\\ $RPM_BUILD_ROOT%{_infodir}/grub2-dev.info \ -install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ -install -D -d -m 0700 $RPM_BUILD_ROOT%{_prefix}/lib/bootloader/ \ +install -d -m 0700 ${RPM_BUILD_ROOT}%{efi_esp_dir}/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/loader/entries \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/themes/system \ @@ -878,15 +871,14 @@ ln -s ../boot/grub2/grub.cfg \\\ %defattr(-,root,root,-) \ %config(noreplace) %{_sysconfdir}/grub2.cfg \ %config(noreplace) %{_sysconfdir}/grub2-efi.cfg \ -%attr(0700,root,root) %verify(not mtime) %{grub_efi_dir}/%{2} \ -%{_prefix}/lib/bootloader/install_bootloader \ +%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{2} \ %ifarch %{arm} \ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ %endif \ %attr(0700,root,root)/boot/grub2/fonts \ %dir %attr(0700,root,root)/boot/loader/entries \ %ghost %config(noreplace) %attr(0600,root,root)/boot/grub2/grub.cfg \ -%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{grub_efi_dir}/grub.cfg \ +%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv \ %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/grub2-%{1}.conf \ %{expand:%if 0%{?without_efi_modules} \ @@ -904,7 +896,7 @@ ln -s ../boot/grub2/grub.cfg \\\ \ %{expand:%%files %{1}-cdboot} \ %defattr(-,root,root,-) \ -%attr(0700,root,root) %verify(not mtime) %{grub_efi_dir}/%{3} \ +%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{3} \ %attr(0700,root,root)/boot/grub2/fonts \ %{nil} diff --git a/grub2.spec b/grub2.spec index d55f9d13..852a6783 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 22%{?dist} +Release: 23%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -35,7 +35,6 @@ Source9: strtoull_test.c Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in -Source21: install_bootloader %include %{SOURCE1} @@ -385,7 +384,7 @@ fi %posttrans common set -eu -EFI_HOME=%{grub_efi_dir} +EFI_HOME=%{efi_esp_dir} GRUB_HOME=/boot/grub2 ESP_PATH=/boot/efi @@ -430,11 +429,6 @@ fi # ensure we exit 0 mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : -%if 0%{with_efi_arch} -%posttrans efi-%{efiarch} -/usr/lib/bootloader/install_bootloader %{grub_efi_dir} %{efi_esp_dir} || : -%endif - %files common -f grub.lang %dir %{_libdir}/grub/ %dir %{_datarootdir}/grub/ @@ -448,8 +442,8 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %dir /boot/grub2/themes/system %attr(0700,root,root) %dir /boot/grub2 %exclude /boot/grub2/* -%dir %attr(0700,root,root) %{grub_version_dir} -%exclude %{grub_version_dir}/* +%dir %attr(0700,root,root) %{efi_esp_dir} +%exclude %{efi_esp_dir}/* %ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv %license COPYING %doc THANKS @@ -611,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue Feb 11 2025 Nicolas Frayer 2.12-23 +- Revert commit for bootloader update proposal for now as not all components are ready + * Tue Feb 4 2025 Marta Lewandowska - 2.12-22 - Phase 1 of the bootloader updates proposal implementation - https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 diff --git a/install_bootloader b/install_bootloader deleted file mode 100755 index 1560e8b0..00000000 --- a/install_bootloader +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -if [[ $# -lt 2 ]]; then - echo "usage: $0 from_dir efi_dir" - exit 1 -fi - -from_dir=${1} -efi_dir=${2} - -cp ${from_dir}/* ${efi_dir}/ From 5427c3632868bc051345101af544c831c4619dcd Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Thu, 13 Feb 2025 11:35:06 -0600 Subject: [PATCH 13/45] Add Several CVE fixes Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 Resolves: CVE-2024-45775 CVE-2024-45780 CVE-2024-45774 Resolves: CVE-2025-0690 CVE-2025-1118 CVE-2024-45782 Resolves: CVE-2025-0624 CVE-2024-45779 CVE-2024-45776 Resolves: CVE-2025-0622 CVE-2025-0677 Signed-off-by: Leo Sandoval --- 0289-misc-Implement-grub_strlcpy.patch | 65 +++ 0290-fs-ufs-Fix-a-heap-OOB-write.patch | 31 + ...Fix-stack-OOB-write-with-grub_strcpy.patch | 31 + ...itialize-name-in-grub_cpio_find_file.patch | 40 ++ ...ger-overflow-leads-to-heap-OOB-write.patch | 89 +++ ...f2fs-Set-a-grub_errno-if-mount-fails.patch | 31 + ...plus-Set-a-grub_errno-if-mount-fails.patch | 35 ++ ...9660-Set-a-grub_errno-if-mount-fails.patch | 33 ++ 0297-fs-iso9660-Fix-invalid-free.patch | 50 ++ 0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch | 63 ++ ...ead-caused-by-invalid-dir-slot-index.patch | 64 +++ ...40-bits-offset-and-address-for-a-dat.patch | 128 +++++ ...ent-signed-unsigned-types-usage-in-r.patch | 85 +++ ...ut-of-bounds-read-for-inline-extents.patch | 46 ++ 0303-fs-ntfs-Fix-out-of-bounds-read.patch | 47 ++ ...-the-end-of-the-MFT-attribute-buffer.patch | 141 +++++ ...helper-function-to-access-attributes.patch | 183 ++++++ ...tfs-Implement-attribute-verification.patch | 245 ++++++++ 0307-fs-xfs-Fix-out-of-bounds-read.patch | 43 ++ ...g-failing-to-mount-sets-a-grub_errno.patch | 42 ++ 0309-kern-file-Ensure-file-data-is-set.patch | 32 ++ ...lement-filesystem-reference-counting.patch | 440 ++++++++++++++ ...ld-option-to-block-command-line-inte.patch | 366 ++++++++++++ ...Require-authentication-after-TPM-unl.patch | 337 +++++++++++ ...-Reference-tracking-for-the-loopback.patch | 108 ++++ 0314-kern-disk-Limit-recursion-depth.patch | 120 ++++ ...tion-Limit-recursion-in-part_iterate.patch | 44 ++ ...pt-execute-Limit-the-recursion-depth.patch | 55 ++ ...et_default_ip-and-net_default_mac-va.patch | 29 + ...bles-hooks-when-interface-is-unregis.patch | 84 +++ ...write-in-grub_net_search_config_file.patch | 79 +++ ...x-stack-buffer-overflow-in-tftp_open.patch | 115 ++++ ...eg-Do-not-permit-duplicate-SOF0-mark.patch | 33 ++ ...r-an-integer-overflow-in-grub_dl_ref.patch | 138 +++++ ...r-the-SHF_INFO_LINK-flag-in-grub_dl_.patch | 34 ++ ...-Missing-check-for-failed-allocation.patch | 34 ++ 0325-commands-ls-Fix-NULL-dereference.patch | 32 ++ ...egister-the-check_signatures-hooks-o.patch | 31 + ...ove-variables-hooks-on-module-unload.patch | 37 ++ ...ove-variables-hooks-on-module-unload.patch | 34 ++ ...overflow-leads-to-heap-OOB-write-or-.patch | 35 ++ ...ger-overflow-leads-to-heap-OOB-write.patch | 53 ++ ...x-an-integer-overflow-when-supplying.patch | 69 +++ ...ack-overflow-due-to-unlimited-recurs.patch | 83 +++ ...-Block-the-dump-command-in-lockdown-.patch | 33 ++ ...isable-memory-reading-in-lockdown-mo.patch | 50 ++ ...-Disable-memory-reading-in-lockdown-.patch | 37 ++ 0336-fs-bfs-Disable-under-lockdown.patch | 52 ++ ...able-many-filesystems-under-lockdown.patch | 391 +++++++++++++ ...afe-math-macros-to-prevent-overflows.patch | 543 ++++++++++++++++++ ...rflows-when-allocating-memory-for-ar.patch | 38 ++ ...turned-pointer-for-allocated-memory-.patch | 152 +++++ ...disk-Call-grub_ieee1275_close-when-g.patch | 31 + ...afe-math-macros-to-prevent-overflows.patch | 353 ++++++++++++ ...lows-when-allocating-memory-for-arra.patch | 82 +++ ...lows-when-assigning-returned-values-.patch | 105 ++++ ...afe-math-macros-to-prevent-overflows.patch | 138 +++++ ...verflows-when-allocating-memory-for-.patch | 40 ++ ...returned-pointer-for-allocated-memor.patch | 88 +++ ...ng-NULL-check-after-grub_strdup-call.patch | 24 + ...afe-math-macros-to-prevent-overflows.patch | 240 ++++++++ ...flows-when-allocating-memory-for-arr.patch | 45 ++ ...urned-pointer-for-allocated-memory-i.patch | 31 + ...fs-Check-if-allocated-memory-is-NULL.patch | 32 ++ ...ix-potential-underflow-and-NULL-dere.patch | 32 ++ ...unix-getroot-Fix-potential-underflow.patch | 35 ++ ...e-consistent-overflow-error-messages.patch | 55 ++ ...ine-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch | 30 + ...safe-math-to-avoid-an-integer-overfl.patch | 41 ++ ...dd-sanity-check-after-grub_strtoul-c.patch | 46 ++ ...sanity-check-after-grub_strtoul-call.patch | 57 ++ ...nux-Cast-left-shift-to-grub_uint32_t.patch | 30 + ...bsd-Use-safe-math-to-avoid-underflow.patch | 56 ++ grub.patches | 73 +++ grub2.spec | 24 +- 75 files changed, 6897 insertions(+), 1 deletion(-) create mode 100644 0289-misc-Implement-grub_strlcpy.patch create mode 100644 0290-fs-ufs-Fix-a-heap-OOB-write.patch create mode 100644 0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch create mode 100644 0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch create mode 100644 0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0297-fs-iso9660-Fix-invalid-free.patch create mode 100644 0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch create mode 100644 0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch create mode 100644 0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch create mode 100644 0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch create mode 100644 0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch create mode 100644 0303-fs-ntfs-Fix-out-of-bounds-read.patch create mode 100644 0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch create mode 100644 0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch create mode 100644 0306-fs-ntfs-Implement-attribute-verification.patch create mode 100644 0307-fs-xfs-Fix-out-of-bounds-read.patch create mode 100644 0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch create mode 100644 0309-kern-file-Ensure-file-data-is-set.patch create mode 100644 0310-kern-file-Implement-filesystem-reference-counting.patch create mode 100644 0311-cli_lock-Add-build-option-to-block-command-line-inte.patch create mode 100644 0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch create mode 100644 0313-disk-loopback-Reference-tracking-for-the-loopback.patch create mode 100644 0314-kern-disk-Limit-recursion-depth.patch create mode 100644 0315-kern-partition-Limit-recursion-in-part_iterate.patch create mode 100644 0316-script-execute-Limit-the-recursion-depth.patch create mode 100644 0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch create mode 100644 0318-net-Remove-variables-hooks-when-interface-is-unregis.patch create mode 100644 0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch create mode 100644 0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch create mode 100644 0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch create mode 100644 0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch create mode 100644 0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch create mode 100644 0324-commands-extcmd-Missing-check-for-failed-allocation.patch create mode 100644 0325-commands-ls-Fix-NULL-dereference.patch create mode 100644 0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch create mode 100644 0327-normal-Remove-variables-hooks-on-module-unload.patch create mode 100644 0328-gettext-Remove-variables-hooks-on-module-unload.patch create mode 100644 0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch create mode 100644 0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 0331-commands-read-Fix-an-integer-overflow-when-supplying.patch create mode 100644 0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch create mode 100644 0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch create mode 100644 0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch create mode 100644 0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch create mode 100644 0336-fs-bfs-Disable-under-lockdown.patch create mode 100644 0337-fs-Disable-many-filesystems-under-lockdown.patch create mode 100644 0338-disk-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch create mode 100644 0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch create mode 100644 0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch create mode 100644 0342-fs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch create mode 100644 0344-fs-Prevent-overflows-when-assigning-returned-values-.patch create mode 100644 0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch create mode 100644 0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch create mode 100644 0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch create mode 100644 0349-net-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch create mode 100644 0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch create mode 100644 0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch create mode 100644 0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch create mode 100644 0354-osdep-unix-getroot-Fix-potential-underflow.patch create mode 100644 0355-misc-Ensure-consistent-overflow-error-messages.patch create mode 100644 0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch create mode 100644 0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch create mode 100644 0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch create mode 100644 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch create mode 100644 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch create mode 100644 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch diff --git a/0289-misc-Implement-grub_strlcpy.patch b/0289-misc-Implement-grub_strlcpy.patch new file mode 100644 index 00000000..d6932f2e --- /dev/null +++ b/0289-misc-Implement-grub_strlcpy.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 15 Jun 2024 02:33:08 +0100 +Subject: [PATCH] misc: Implement grub_strlcpy() + +grub_strlcpy() acts the same way as strlcpy() does on most *NIX, +returning the length of src and ensuring dest is always NUL +terminated except when size is 0. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/include/grub/misc.h b/include/grub/misc.h +index db517acd5..6b1e084af 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -72,6 +72,45 @@ grub_stpcpy (char *dest, const char *src) + return d - 1; + } + ++static inline grub_size_t ++grub_strlcpy (char *dest, const char *src, grub_size_t size) ++{ ++ char *d = dest; ++ grub_size_t res = 0; ++ /* ++ * We do not subtract one from size here to avoid dealing with underflowing ++ * the value, which is why to_copy is always checked to be greater than one ++ * throughout this function. ++ */ ++ grub_size_t to_copy = size; ++ ++ /* Copy size - 1 bytes to dest. */ ++ if (to_copy > 1) ++ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1) ++ ; ++ ++ /* ++ * NUL terminate if size != 0. The previous step may have copied a NUL byte ++ * if it reached the end of the string, but we know dest[size - 1] must always ++ * be a NUL byte. ++ */ ++ if (size != 0) ++ dest[size - 1] = '\0'; ++ ++ /* If there is still space in dest, but are here, we reached the end of src. */ ++ if (to_copy > 1) ++ return res; ++ ++ /* ++ * If we haven't reached the end of the string, iterate through to determine ++ * the strings total length. ++ */ ++ while (*src++ != '\0' && ++res) ++ ; ++ ++ return res; ++} ++ + /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */ + static inline void * + grub_memcpy (void *dest, const void *src, grub_size_t n) diff --git a/0290-fs-ufs-Fix-a-heap-OOB-write.patch b/0290-fs-ufs-Fix-a-heap-OOB-write.patch new file mode 100644 index 00000000..ed1be4cb --- /dev/null +++ b/0290-fs-ufs-Fix-a-heap-OOB-write.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:03:33 +0100 +Subject: [PATCH] fs/ufs: Fix a heap OOB write + +grub_strcpy() was used to copy a symlink name from the filesystem +image to a heap allocated buffer. This led to a OOB write to adjacent +heap allocations. Fix by using grub_strlcpy(). + +Fixes: CVE-2024-45781 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ufs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index a354c92d9..01235101b 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino) + /* Check against zero is paylindromic, no need to swap. */ + if (data->inode.nblocks == 0 + && INODE_SIZE (data) <= sizeof (data->inode.symlink)) +- grub_strcpy (symlink, (char *) data->inode.symlink); ++ grub_strlcpy (symlink, (char *) data->inode.symlink, sz); + else + { + if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0) diff --git a/0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch b/0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch new file mode 100644 index 00000000..5a836725 --- /dev/null +++ b/0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:48:33 +0100 +Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy() + +Replaced with grub_strlcpy(). + +Fixes: CVE-2024-45782 +Fixes: CVE-2024-56737 +Fixes: https://savannah.gnu.org/bugs/?66599 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 91dc0e69c..920112b03 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32_compile_time (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str)); + + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, + 0, (char *) &dir, sizeof (dir)) == 0) diff --git a/0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch b/0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch new file mode 100644 index 00000000..6433d2d5 --- /dev/null +++ b/0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:47:54 +0100 +Subject: [PATCH] fs/tar: Initialize name in grub_cpio_find_file() + +It was possible to iterate through grub_cpio_find_file() without +allocating name and not setting mode to GRUB_ARCHELP_ATTR_END, which +would cause the uninitialized value for name to be used as an argument +for canonicalize() in grub_archelp_dir(). + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/tar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index c551ed6b5..646bce5eb 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -78,6 +78,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + int reread = 0, have_longname = 0, have_longlink = 0; + + data->hofs = data->next_hofs; ++ *name = NULL; + + for (reread = 0; reread < 3; reread++) + { +@@ -202,6 +203,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + } + return GRUB_ERR_NONE; + } ++ ++ if (*name == NULL) ++ return grub_error (GRUB_ERR_BAD_FS, "invalid tar archive"); ++ + return GRUB_ERR_NONE; + } + diff --git a/0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch b/0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 00000000..b059e496 --- /dev/null +++ b/0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,89 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:58 +0000 +Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write + +Both namesize and linksize are derived from hd.size, a 12-digit octal +number parsed by read_number(). Later direct arithmetic calculation like +"namesize + 1" and "linksize + 1" may exceed the maximum value of +grub_size_t leading to heap OOB write. This patch fixes the issue by +using grub_add() and checking for an overflow. + +Fixes: CVE-2024-45780 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/tar.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 646bce5eb..386c09022 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + struct head hd; + int reread = 0, have_longname = 0, have_longlink = 0; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + *name = NULL; +@@ -98,7 +100,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); +- *name = grub_malloc (namesize + 1); ++ ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + err = grub_disk_read (data->disk, 0, +@@ -118,15 +124,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); +- if (data->linkname_alloc < linksize + 1) ++ ++ if (grub_add (linksize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); ++ ++ if (data->linkname_alloc < sz) + { + char *n; +- n = grub_calloc (2, linksize + 1); ++ n = grub_calloc (2, sz); + if (!n) + return grub_errno; + grub_free (data->linkname); + data->linkname = n; +- data->linkname_alloc = 2 * (linksize + 1); ++ data->linkname_alloc = 2 * (sz); + } + + err = grub_disk_read (data->disk, 0, +@@ -149,7 +159,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + while (extra_size < sizeof (hd.prefix) + && hd.prefix[extra_size]) + extra_size++; +- *name = grub_malloc (sizeof (hd.name) + extra_size + 2); ++ ++ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow")); ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + if (hd.prefix[0]) diff --git a/0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch b/0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..0b72b727 --- /dev/null +++ b/0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:15:03 +0100 +Subject: [PATCH] fs/f2fs: Set a grub_errno if mount fails + +It was previously possible for grub_errno to not be set when +grub_f2fs_mount() failed if nat_bitmap_ptr() returned NULL. + +This issue is solved by ensuring a grub_errno is set in the fail case. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/f2fs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index 855e24618..db8a65f8d 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -872,6 +872,9 @@ grub_f2fs_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a F2FS filesystem"); ++ + grub_free (data); + + return NULL; diff --git a/0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch b/0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..eb36c019 --- /dev/null +++ b/0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:22:51 +0100 +Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails + +It was possible for mount to fail but not set grub_errno. This led to +a possible double decrement of the module reference count if the NULL +page was mapped. + +Fixing in general as a similar bug was fixed in commit 61b13c187 +(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there +are likely more variants around. + +Fixes: CVE-2024-45783 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfsplus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index 295822f69..de71fd486 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk) + + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem"); + + grub_free (data); diff --git a/0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch b/0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..69470f69 --- /dev/null +++ b/0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:37:08 +0100 +Subject: [PATCH] fs/iso9660: Set a grub_errno if mount fails + +It was possible for a grub_errno to not be set if mount of an ISO 9660 +filesystem failed when set_rockridge() returned 0. + +This isn't known to be exploitable as the other filesystems due to +filesystem helper checking the requested file type. Though fixing +as a precaution. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8c348b59a..8d480e602 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -551,6 +551,9 @@ grub_iso9660_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a ISO9660 filesystem"); ++ + grub_free (data); + return 0; + } diff --git a/0297-fs-iso9660-Fix-invalid-free.patch b/0297-fs-iso9660-Fix-invalid-free.patch new file mode 100644 index 00000000..61bd5cce --- /dev/null +++ b/0297-fs-iso9660-Fix-invalid-free.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:42 +0800 +Subject: [PATCH] fs/iso9660: Fix invalid free + +The ctx->filename can point to either a string literal or a dynamically +allocated string. The ctx->filename_alloc field is used to indicate the +type of allocation. + +An issue has been identified where ctx->filename is reassigned to +a string literal in susp_iterate_dir() but ctx->filename_alloc is not +correctly handled. This oversight causes a memory leak and an invalid +free operation later. + +The fix involves checking ctx->filename_alloc, freeing the allocated +string if necessary and clearing ctx->filename_alloc for string literals. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8d480e602..8e3c95c4f 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -628,9 +628,19 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + filename type is stored. */ + /* FIXME: Fix this slightly improper cast. */ + if (entry->data[0] & GRUB_ISO9660_RR_DOT) +- ctx->filename = (char *) "."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) "."; ++ } + else if (entry->data[0] & GRUB_ISO9660_RR_DOTDOT) +- ctx->filename = (char *) ".."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) ".."; ++ } + else if (entry->len >= 5) + { + grub_size_t off = 0, csize = 1; diff --git a/0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch b/0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch new file mode 100644 index 00000000..49464e74 --- /dev/null +++ b/0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch @@ -0,0 +1,63 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:59 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read in jfs_getent() + +The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash +was caused by an invalid leaf nodes count, diro->dirpage->header.count, +which was larger than the maximum number of leaf nodes allowed in an +inode. This fix is to ensure that the leaf nodes count is validated in +grub_jfs_opendir() before calling grub_jfs_getent(). + +On the occasion replace existing raw numbers with newly defined constant. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 6f7c43904..32dec7fb7 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -41,6 +41,12 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_JFS_TREE_LEAF 2 + ++/* ++ * Define max entries stored in-line in an inode. ++ * https://jfs.sourceforge.net/project/pub/jfslayout.pdf ++ */ ++#define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++ + struct grub_jfs_sblock + { + /* The magic for JFS. It should contain the string "JFS1". */ +@@ -203,9 +209,9 @@ struct grub_jfs_inode + grub_uint8_t freecnt; + grub_uint8_t freelist; + grub_uint32_t idotdot; +- grub_uint8_t sorted[8]; ++ grub_uint8_t sorted[GRUB_JFS_INODE_INLINE_ENTRIES]; + } header; +- struct grub_jfs_leaf_dirent dirents[8]; ++ struct grub_jfs_leaf_dirent dirents[GRUB_JFS_INODE_INLINE_ENTRIES]; + } GRUB_PACKED dir; + /* Fast symlink. */ + struct +@@ -453,6 +459,13 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + /* Check if the entire tree is contained within the inode. */ + if (inode->file.tree.flags & GRUB_JFS_TREE_LEAF) + { ++ if (inode->dir.header.count > GRUB_JFS_INODE_INLINE_ENTRIES) ++ { ++ grub_free (diro); ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid JFS inode")); ++ return 0; ++ } ++ + diro->leaf = inode->dir.dirents; + diro->next_leaf = (struct grub_jfs_leaf_next_dirent *) de; + diro->sorted = inode->dir.header.sorted; diff --git a/0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch b/0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch new file mode 100644 index 00000000..029e8485 --- /dev/null +++ b/0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch @@ -0,0 +1,64 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:28:00 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read caused by invalid dir slot index + +While fuzz testing JFS with ASAN enabled an OOB read was detected in +grub_jfs_opendir(). The issue occurred due to an invalid directory slot +index in the first entry of the sorted directory slot array in the inode +directory header. The fix ensures the slot index is validated before +accessing it. Given that an internal or a leaf node in a directory B+ +tree is a 4 KiB in size and each directory slot is always 32 bytes, the +max number of slots in a node is 128. The validation ensures that the +slot index doesn't exceed this limit. + +[1] https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + JFS will allocate 4K of disk space for an internal node of the B+ tree. + An internal node looks the same as a leaf node. + - page 10 + + Fixed number of Directory Slots depending on the size of the node. These are + the slots to be used for storing the directory slot array and the directory + entries or router entries. A directory slot is always 32 bytes. + ... + A Directory Slot Array which is a sorted array of indices to the directory + slots that are currently in use. + ... + An internal or a leaf node in the directory B+ tree is a 4K page. + - page 25 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 32dec7fb7..88fb884df 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -46,6 +46,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + * https://jfs.sourceforge.net/project/pub/jfslayout.pdf + */ + #define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++#define GRUB_JFS_DIR_MAX_SLOTS 128 + + struct grub_jfs_sblock + { +@@ -481,6 +482,14 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + ++ if (inode->dir.header.sorted[0] >= GRUB_JFS_DIR_MAX_SLOTS) ++ { ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid directory slot index")); ++ grub_free (diro->dirpage); ++ grub_free (diro); ++ return 0; ++ } ++ + blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + diff --git a/0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch b/0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch new file mode 100644 index 00000000..ed387aeb --- /dev/null +++ b/0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch @@ -0,0 +1,128 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:39 +0000 +Subject: [PATCH] fs/jfs: Use full 40 bits offset and address for a data extent + +An extent's logical offset and address are represented as a 40-bit value +split into two parts: the most significant 8 bits and the least +significant 32 bits. Currently the JFS code uses only the least +significant 32 bits value for offsets and addresses assuming the data +size will never exceed the 32-bit range. This approach ignores the most +significant 8 bits potentially leading to incorrect offsets and +addresses for larger values. The patch fixes it by incorporating the +most significant 8 bits into the calculation to get the full 40-bits +value for offsets and addresses. + +https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + "off1,off2 is a 40-bit field, containing the logical offset of the first + block in the extent. + ... + addr1,addr2 is a 40-bit field, containing the address of the extent." + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 41 +++++++++++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 12 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 88fb884df..2bde48d45 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -265,6 +265,20 @@ static grub_dl_t my_mod; + + static grub_err_t grub_jfs_lookup_symlink (struct grub_jfs_data *data, grub_uint32_t ino); + ++/* ++ * An extent's offset, physical and logical, is represented as a 40-bit value. ++ * This 40-bit value is split into two parts: ++ * - offset1: the most signficant 8 bits of the offset, ++ * - offset2: the least significant 32 bits of the offset. ++ * ++ * This function calculates and returns the 64-bit offset of an extent. ++ */ ++static grub_uint64_t ++get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) ++{ ++ return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); ++} ++ + static grub_int64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, +@@ -274,22 +288,25 @@ getblk (struct grub_jfs_treehead *treehead, + { + int found = -1; + int i; ++ grub_uint64_t ext_offset, ext_blk; + + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { ++ ext_offset = get_ext_offset (extents[i].offset1, extents[i].offset2); ++ ext_blk = get_ext_offset (extents[i].extent.blk1, extents[i].extent.blk2); ++ + if (treehead->flags & GRUB_JFS_TREE_LEAF) + { + /* Read the leafnode. */ +- if (grub_le_to_cpu32 (extents[i].offset2) <= blk ++ if (ext_offset <= blk + && ((grub_le_to_cpu16 (extents[i].extent.length)) + + (extents[i].extent.length2 << 16) +- + grub_le_to_cpu32 (extents[i].offset2)) > blk) +- return (blk - grub_le_to_cpu32 (extents[i].offset2) +- + grub_le_to_cpu32 (extents[i].extent.blk2)); ++ + ext_offset) > blk) ++ return (blk - ext_offset + ext_blk); + } + else +- if (blk >= grub_le_to_cpu32 (extents[i].offset2)) ++ if (blk >= ext_offset) + found = i; + } + +@@ -307,10 +324,9 @@ getblk (struct grub_jfs_treehead *treehead, + return -1; + + if (!grub_disk_read (data->disk, +- ((grub_disk_addr_t) grub_le_to_cpu32 (extents[found].extent.blk2)) +- << (grub_le_to_cpu16 (data->sblock.log2_blksz) +- - GRUB_DISK_SECTOR_BITS), 0, +- sizeof (*tree), (char *) tree)) ++ (grub_disk_addr_t) ext_blk ++ << (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS), ++ 0, sizeof (*tree), (char *) tree)) + { + if (grub_memcmp (&tree->treehead, treehead, sizeof (struct grub_jfs_treehead)) || + grub_memcmp (&tree->extents, extents, 254 * sizeof (struct grub_jfs_tree_extent))) +@@ -361,7 +377,7 @@ grub_jfs_read_inode (struct grub_jfs_data *data, grub_uint32_t ino, + sizeof (iag_inodes), &iag_inodes)) + return grub_errno; + +- inoblk = grub_le_to_cpu32 (iag_inodes[inoext].blk2); ++ inoblk = get_ext_offset (iag_inodes[inoext].blk1, iag_inodes[inoext].blk2); + inoblk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS); + inoblk += inonum; +@@ -490,7 +506,8 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + +- blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); ++ blk = get_ext_offset (de[inode->dir.header.sorted[0]].ex.blk1, ++ de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + + /* Read in the nodes until we are on the leaf node level. */ +@@ -508,7 +525,7 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + + de = (struct grub_jfs_internal_dirent *) diro->dirpage->dirent; + index = diro->dirpage->sorted[diro->dirpage->header.sindex * 32]; +- blk = (grub_le_to_cpu32 (de[index].ex.blk2) ++ blk = (get_ext_offset (de[index].ex.blk1, de[index].ex.blk2) + << (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS)); + } while (!(diro->dirpage->header.flags & GRUB_JFS_TREE_LEAF)); diff --git a/0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch b/0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch new file mode 100644 index 00000000..33c684b2 --- /dev/null +++ b/0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:40 +0000 +Subject: [PATCH] fs/jfs: Inconsistent signed/unsigned types usage in return + values + +The getblk() returns a value of type grub_int64_t which is assigned to +iagblk and inoblk, both of type grub_uint64_t, in grub_jfs_read_inode() +via grub_jfs_blkno(). This patch fixes the type mismatch in the +functions. Additionally, the getblk() will return 0 instead of -1 on +failure cases. This change is safe because grub_errno is always set in +getblk() to indicate errors and it is later checked in the callers. + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 2bde48d45..70a2f4947 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -279,7 +279,7 @@ get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) + return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); + } + +-static grub_int64_t ++static grub_uint64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, + int max_extents, +@@ -290,6 +290,8 @@ getblk (struct grub_jfs_treehead *treehead, + int i; + grub_uint64_t ext_offset, ext_blk; + ++ grub_errno = GRUB_ERR_NONE; ++ + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { +@@ -312,7 +314,7 @@ getblk (struct grub_jfs_treehead *treehead, + + if (found != -1) + { +- grub_int64_t ret = -1; ++ grub_uint64_t ret = 0; + struct + { + struct grub_jfs_treehead treehead; +@@ -321,7 +323,7 @@ getblk (struct grub_jfs_treehead *treehead, + + tree = grub_zalloc (sizeof (*tree)); + if (!tree) +- return -1; ++ return 0; + + if (!grub_disk_read (data->disk, + (grub_disk_addr_t) ext_blk +@@ -334,19 +336,20 @@ getblk (struct grub_jfs_treehead *treehead, + else + { + grub_error (GRUB_ERR_BAD_FS, "jfs: infinite recursion detected"); +- ret = -1; ++ ret = 0; + } + } + grub_free (tree); + return ret; + } + +- return -1; ++ grub_error (GRUB_ERR_READ_ERROR, "jfs: block %" PRIuGRUB_UINT64_T " not found", blk); ++ return 0; + } + + /* Get the block number for the block BLK in the node INODE in the + mounted filesystem DATA. */ +-static grub_int64_t ++static grub_uint64_t + grub_jfs_blkno (struct grub_jfs_data *data, struct grub_jfs_inode *inode, + grub_uint64_t blk) + { diff --git a/0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch b/0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch new file mode 100644 index 00000000..880ef764 --- /dev/null +++ b/0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:23 +0800 +Subject: [PATCH] fs/ext2: Fix out-of-bounds read for inline extents + +When inline extents are used, i.e. the extent tree depth equals zero, +a maximum of four entries can fit into the inode's data block. If the +extent header states a number of entries greater than four the current +ext2 implementation causes an out-of-bounds read. Fix this issue by +capping the number of extents to four when reading inline extents. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index e1cc5e62a..3f9f6b208 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -495,6 +495,8 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + struct grub_ext4_extent *ext; + int i; + grub_disk_addr_t ret; ++ grub_uint16_t nent; ++ const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + if (grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, + fileblock, &leaf) != GRUB_ERR_NONE) +@@ -508,7 +510,13 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + return 0; + + ext = (struct grub_ext4_extent *) (leaf + 1); +- for (i = 0; i < grub_le_to_cpu16 (leaf->entries); i++) ++ ++ nent = grub_le_to_cpu16 (leaf->entries); ++ ++ if (leaf->depth == 0) ++ nent = grub_min (nent, max_inline_ext); ++ ++ for (i = 0; i < nent; i++) + { + if (fileblock < grub_le_to_cpu32 (ext[i].block)) + break; diff --git a/0303-fs-ntfs-Fix-out-of-bounds-read.patch b/0303-fs-ntfs-Fix-out-of-bounds-read.patch new file mode 100644 index 00000000..4d4acdce --- /dev/null +++ b/0303-fs-ntfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Mon, 3 Jun 2024 12:12:06 +0800 +Subject: [PATCH] fs/ntfs: Fix out-of-bounds read + +When parsing NTFS file records the presence of the 0xFF marker indicates +the end of the attribute list. This value signifies that there are no +more attributes to process. + +However, when the end marker is missing due to corrupted metadata the +loop continues to read beyond the attribute list resulting in out-of-bounds +reads and potentially entering an infinite loop. + +This patch adds a check to provide a stop condition for the loop ensuring +it stops at the end of the attribute list or at the end of the Master File +Table. This guards against out-of-bounds reads and prevents infinite loops. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index de435aa14..8a5384247 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -139,6 +139,8 @@ free_attr (struct grub_ntfs_attr *at) + static grub_uint8_t * + find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + { ++ grub_uint8_t *mft_end; ++ + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +@@ -191,7 +193,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + at->attr_cur = at->attr_nxt; +- while (*at->attr_cur != 0xFF) ++ mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { + at->attr_nxt += u16at (at->attr_cur, 4); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) diff --git a/0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch b/0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch new file mode 100644 index 00000000..e6a5c144 --- /dev/null +++ b/0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch @@ -0,0 +1,141 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 7 Jan 2025 11:38:34 +0000 +Subject: [PATCH] fs/ntfs: Track the end of the MFT attribute buffer + +The end of the attribute buffer should be stored alongside the rest of +the attribute struct as right now it is not possible to implement bounds +checking when accessing attributes sequentially. + +This is done via: + - updating init_attr() to set at->end and check is is not initially out of bounds, + - implementing checks as init_attr() had its type change in its callers, + - updating the value of at->end when needed. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 34 ++++++++++++++++++++++++++++------ + include/grub/ntfs.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 8a5384247..dbda720e1 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -119,13 +119,20 @@ static grub_err_t read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, + grub_disk_read_hook_t read_hook, + void *read_hook_data); + +-static void ++static grub_err_t + init_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft) + { + at->mft = mft; + at->flags = (mft == &mft->data->mmft) ? GRUB_NTFS_AF_MMFT : 0; + at->attr_nxt = mft->buf + first_attr_off (mft->buf); ++ at->end = mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ ++ if (at->attr_nxt > at->end) ++ return grub_error (GRUB_ERR_BAD_FS, "attributes start outside the MFT"); ++ + at->attr_end = at->emft_buf = at->edat_buf = at->sbuf = NULL; ++ ++ return GRUB_ERR_NONE; + } + + static void +@@ -239,6 +246,10 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } + at->flags |= GRUB_NTFS_AF_ALST; ++ ++ /* From this point on pa_end is the end of the buffer */ ++ at->end = pa_end; ++ + while (at->attr_nxt < at->attr_end) + { + if ((*at->attr_nxt == attr) || (attr == 0)) +@@ -298,7 +309,9 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + { + grub_uint8_t *pa; + +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; ++ + pa = find_attr (at, attr); + if (pa == NULL) + return NULL; +@@ -314,7 +327,8 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + } + grub_errno = GRUB_ERR_NONE; + free_attr (at); +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; + pa = find_attr (at, attr); + } + return pa; +@@ -585,7 +599,7 @@ init_file (struct grub_ntfs_file *mft, grub_uint64_t mftno) + mft->attr.attr_end = 0; /* Don't jump to attribute list */ + } + else +- init_attr (&mft->attr, mft); ++ return init_attr (&mft->attr, mft); + + return 0; + } +@@ -811,7 +825,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bmp = NULL; + + at = &attr; +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return 0; ++ + while (1) + { + cur_pos = find_attr (at, GRUB_NTFS_AT_INDEX_ROOT); +@@ -842,7 +858,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bitmap = NULL; + bitmap_len = 0; + free_attr (at); ++ /* No need to check errors here, as it will already be fine */ + init_attr (at, mft); ++ + while ((cur_pos = find_attr (at, GRUB_NTFS_AT_BITMAP)) != NULL) + { + int ofs; +@@ -1207,6 +1225,7 @@ grub_ntfs_label (grub_device_t device, char **label) + struct grub_ntfs_data *data = 0; + struct grub_fshelp_node *mft = 0; + grub_uint8_t *pa; ++ grub_err_t err; + + grub_dl_ref (my_mod); + +@@ -1232,7 +1251,10 @@ grub_ntfs_label (grub_device_t device, char **label) + goto fail; + } + +- init_attr (&mft->attr, mft); ++ err = init_attr (&mft->attr, mft); ++ if (err != GRUB_ERR_NONE) ++ return err; ++ + pa = find_attr (&mft->attr, GRUB_NTFS_AT_VOLUME_NAME); + + if (pa >= mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR)) +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index d1a6af696..ec1c4db38 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -134,6 +134,7 @@ struct grub_ntfs_attr + grub_uint8_t *attr_cur, *attr_nxt, *attr_end; + grub_uint32_t save_pos; + grub_uint8_t *sbuf; ++ grub_uint8_t *end; + struct grub_ntfs_file *mft; + }; + diff --git a/0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch b/0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch new file mode 100644 index 00000000..aede4b40 --- /dev/null +++ b/0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch @@ -0,0 +1,183 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 14 May 2024 12:39:56 +0100 +Subject: [PATCH] fs/ntfs: Use a helper function to access attributes + +Right now to access the next attribute the code reads the length of the +current attribute and adds that to the current pointer. This is error +prone as bounds checking needs to be performed all over the place. So, +implement a helper and ensure its used across find_attr() and read_attr(). + +This commit does *not* implement full bounds checking. It is just the +preparation work for this to be added into the helper. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 69 +++++++++++++++++++++++++++++++++++++++++++---------- + include/grub/ntfs.h | 2 ++ + 2 files changed, 58 insertions(+), 13 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index dbda720e1..1c678f3d0 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -70,6 +70,25 @@ res_attr_data_len (void *res_attr_ptr) + return u32at (res_attr_ptr, 0x10); + } + ++/* Return the next attribute if it exists, otherwise return NULL. */ ++static grub_uint8_t * ++next_attribute (grub_uint8_t *curr_attribute, void *end) ++{ ++ grub_uint8_t *next = curr_attribute; ++ ++ /* ++ * Need to verify we aren't exceeding the end of the buffer by reading the ++ * header for the current attribute ++ */ ++ if (curr_attribute + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) ++ return NULL; ++ ++ next += u16at (curr_attribute, 4); ++ ++ return next; ++} ++ ++ + grub_ntfscomp_func_t grub_ntfscomp_func; + + static grub_err_t +@@ -151,13 +170,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + at->attr_cur = at->attr_nxt; +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->attr_end); + if ((*at->attr_cur == attr) || (attr == 0)) + { +- grub_uint8_t *new_pos; ++ grub_uint8_t *new_pos, *end; + + if (at->flags & GRUB_NTFS_AF_MMFT) + { +@@ -181,15 +200,36 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + ++ /* ++ * Only time emft_bufs is defined is in this function, with this ++ * size. ++ */ ++ grub_size_t emft_buf_size = ++ at->mft->data->mft_size << GRUB_NTFS_BLK_SHR; ++ ++ /* ++ * Needs to be enough space for the successful case to even ++ * bother. ++ */ ++ if (first_attr_off (at->emft_buf) >= (emft_buf_size - 0x18 - 2)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, ++ "can\'t find 0x%X in attribute list", ++ (unsigned char) *at->attr_cur); ++ return NULL; ++ } ++ + new_pos = &at->emft_buf[first_attr_off (at->emft_buf)]; +- while (*new_pos != 0xFF) ++ end = &at->emft_buf[emft_buf_size]; ++ ++ while (new_pos && *new_pos != 0xFF) + { + if ((*new_pos == *at->attr_cur) + && (u16at (new_pos, 0xE) == u16at (at->attr_cur, 0x18))) + { + return new_pos; + } +- new_pos += u16at (new_pos, 4); ++ new_pos = next_attribute (new_pos, end); + } + grub_error (GRUB_ERR_BAD_FS, + "can\'t find 0x%X in attribute list", +@@ -203,7 +243,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->end); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) + at->attr_end = at->attr_cur; + if ((*at->attr_cur == attr) || (attr == 0)) +@@ -250,13 +290,14 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + /* From this point on pa_end is the end of the buffer */ + at->end = pa_end; + +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + if ((*at->attr_nxt == attr) || (attr == 0)) + break; +- at->attr_nxt += u16at (at->attr_nxt, 4); ++ at->attr_nxt = next_attribute (at->attr_nxt, pa_end); + } +- if (at->attr_nxt >= at->attr_end) ++ ++ if (at->attr_nxt >= at->attr_end || at->attr_nxt == NULL) + return NULL; + + if ((at->flags & GRUB_NTFS_AF_MMFT) && (attr == GRUB_NTFS_AT_DATA)) +@@ -277,7 +318,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + grub_cpu_to_le32 (at->mft->data->mft_start + + 1)); + pa = at->attr_nxt + u16at (pa, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; +@@ -293,7 +335,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + u32at (pa, 0x10) * (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), + at->mft->data->mft_size << GRUB_NTFS_BLK_SHR, 0, 0, 0)) + return NULL; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, pa_end); + } + at->attr_nxt = at->attr_cur; + at->flags &= ~GRUB_NTFS_AF_GPOS; +@@ -530,14 +572,15 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, + else + vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); + pa = at->attr_nxt + u16at (at->attr_nxt, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; + if (u32at (pa, 8) > vcn) + break; + at->attr_nxt = pa; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, at->attr_end); + } + } + pp = find_attr (at, attr); +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index ec1c4db38..2c8078403 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -89,6 +89,8 @@ enum + #define GRUB_NTFS_COM_SEC (GRUB_NTFS_COM_LEN >> GRUB_NTFS_BLK_SHR) + #define GRUB_NTFS_LOG_COM_SEC (GRUB_NTFS_COM_LOG_LEN - GRUB_NTFS_BLK_SHR) + ++#define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 ++ + enum + { + GRUB_NTFS_AF_ALST = 1, diff --git a/0306-fs-ntfs-Implement-attribute-verification.patch b/0306-fs-ntfs-Implement-attribute-verification.patch new file mode 100644 index 00000000..4ee1c392 --- /dev/null +++ b/0306-fs-ntfs-Implement-attribute-verification.patch @@ -0,0 +1,245 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 14 May 2024 12:39:56 +0100 +Subject: [PATCH] fs/ntfs: Implement attribute verification + +It was possible to read OOB when an attribute had a size that exceeded +the allocated buffer. This resolves that by making sure all attributes +that get read are fully in the allocated space by implementing +a function to validate them. + +Defining the offsets in include/grub/ntfs.h but they are only used in +the validation function and not across the rest of the NTFS code. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 153 ++++++++++++++++++++++++++++++++++++++++++++++++++++ + include/grub/ntfs.h | 22 ++++++++ + 2 files changed, 175 insertions(+) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 1c678f3d0..64f4f2221 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -70,6 +70,149 @@ res_attr_data_len (void *res_attr_ptr) + return u32at (res_attr_ptr, 0x10); + } + ++/* ++ * Check if the attribute is valid and doesn't exceed the allocated region. ++ * This accounts for resident and non-resident data. ++ * ++ * This is based off the documentation from the linux-ntfs project: ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html ++ */ ++static bool ++validate_attribute (grub_uint8_t *attr, void *end) ++{ ++ grub_size_t attr_size = 0; ++ grub_size_t min_size = 0; ++ grub_size_t spare = (grub_uint8_t *) end - attr; ++ /* ++ * Just used as a temporary variable to try and deal with cases where someone ++ * tries to overlap fields. ++ */ ++ grub_size_t curr = 0; ++ ++ /* Need verify we can entirely read the attributes header. */ ++ if (attr + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) ++ goto fail; ++ ++ /* ++ * So, the rest of this code uses a 16bit int for the attribute length but ++ * from reading the all the documentation I could find it says this field is ++ * actually 32bit. But let's be consistent with the rest of the code. ++ * ++ * https://elixir.bootlin.com/linux/v6.10.7/source/fs/ntfs3/ntfs.h#L370 ++ */ ++ attr_size = u16at (attr, GRUB_NTFS_ATTRIBUTE_LENGTH); ++ ++ if (attr_size > spare) ++ goto fail; ++ ++ /* Not an error case, just reached the end of the attributes. */ ++ if (attr_size == 0) ++ return false; ++ ++ /* ++ * Extra validation by trying to calculate a minimum possible size for this ++ * attribute. +8 from the size of the resident data struct which is the ++ * minimum that can be added. ++ */ ++ min_size = GRUB_NTFS_ATTRIBUTE_HEADER_SIZE + 8; ++ ++ if (min_size > attr_size) ++ goto fail; ++ ++ /* Is the data is resident (0) or not (1). */ ++ if (attr[GRUB_NTFS_ATTRIBUTE_RESIDENT] == 0) ++ { ++ /* Read the offset and size of the attribute. */ ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_RES_OFFSET); ++ curr += u32at (attr, GRUB_NTFS_ATTRIBUTE_RES_LENGTH); ++ if (curr > min_size) ++ min_size = curr; ++ } ++ else ++ { ++ /* ++ * If the data is non-resident, the minimum size is 64 which is where ++ * the data runs start. We already have a minimum size of 24. So, just ++ * adding 40 to get to the real value. ++ */ ++ min_size += 40; ++ if (min_size > attr_size) ++ goto fail; ++ /* If the compression unit size is > 0, +8 bytes*/ ++ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE) > 0) ++ min_size += 8; ++ ++ /* ++ * Need to consider the data runs now. Each member of the run has byte ++ * that describes the size of the data length and offset. Each being ++ * 4 bits in the byte. ++ */ ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_DATA_RUNS); ++ ++ if (curr + 1 > min_size) ++ min_size = curr + 1; ++ ++ if (min_size > attr_size) ++ goto fail; ++ ++ /* ++ * Each attribute can store multiple data runs which are stored ++ * continuously in the attribute. They exist as one header byte ++ * with up to 14 bytes following it depending on the lengths. ++ * We stop when we hit a header that is just a NUL byte. ++ * ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/data_runs.html ++ */ ++ while (attr[curr] != 0) ++ { ++ /* ++ * We stop when we hit a header that is just a NUL byte. The data ++ * run header is stored as a single byte where the top 4 bits refer ++ * to the number of bytes used to store the total length of the ++ * data run, and the number of bytes used to store the offset. ++ * These directly follow the header byte, so we use them to update ++ * the minimum size. ++ */ ++ min_size += (attr[curr] & 0x7) + ((attr[curr] >> 4) & 0x7); ++ curr += min_size; ++ min_size++; ++ if (min_size > attr_size) ++ goto fail; ++ } ++ } ++ ++ /* Name offset, doing this after data residence checks. */ ++ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET) != 0) ++ { ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET); ++ /* ++ * Multiple the name length by 2 as its UTF-16. Can be zero if this in an ++ * unamed attribute. ++ */ ++ curr += attr[GRUB_NTFS_ATTRIBUTE_NAME_LENGTH] * 2; ++ if (curr > min_size) ++ min_size = curr; ++ } ++ ++ /* Padded to 8 bytes. */ ++ if (min_size % 8 != 0) ++ min_size += 8 - (min_size % 8); ++ ++ /* ++ * At this point min_size should be exactly attr_size but being flexible ++ * here to avoid any issues. ++ */ ++ if (min_size > attr_size) ++ goto fail; ++ ++ return true; ++ ++ fail: ++ grub_dprintf ("ntfs", "spare=%" PRIuGRUB_SIZE " min_size=%" PRIuGRUB_SIZE " attr_size=%" PRIuGRUB_SIZE "\n", ++ spare, min_size, attr_size); ++ return false; ++} ++ + /* Return the next attribute if it exists, otherwise return NULL. */ + static grub_uint8_t * + next_attribute (grub_uint8_t *curr_attribute, void *end) +@@ -84,6 +227,8 @@ next_attribute (grub_uint8_t *curr_attribute, void *end) + return NULL; + + next += u16at (curr_attribute, 4); ++ if (validate_attribute (next, end) == false) ++ return NULL; + + return next; + } +@@ -290,6 +435,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + /* From this point on pa_end is the end of the buffer */ + at->end = pa_end; + ++ if (validate_attribute (at->attr_nxt, pa_end) == false) ++ return NULL; ++ + while (at->attr_nxt) + { + if ((*at->attr_nxt == attr) || (attr == 0)) +@@ -319,6 +467,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + + 1)); + pa = at->attr_nxt + u16at (pa, 4); + ++ if (validate_attribute (pa, pa_end) == true) ++ pa = NULL; ++ + while (pa) + { + if (*pa != attr) +@@ -572,6 +723,8 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, + else + vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); + pa = at->attr_nxt + u16at (at->attr_nxt, 4); ++ if (validate_attribute (pa, at->attr_end) == false) ++ pa = NULL; + + while (pa) + { +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index 2c8078403..77b182acf 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -91,6 +91,28 @@ enum + + #define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 + ++/* ++ * To make attribute validation clearer the offsets for each value in the ++ * attribute headers are defined as macros. ++ * ++ * These offsets are all from: ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html ++ */ ++ ++/* These offsets are part of the attribute header. */ ++#define GRUB_NTFS_ATTRIBUTE_LENGTH 4 ++#define GRUB_NTFS_ATTRIBUTE_RESIDENT 8 ++#define GRUB_NTFS_ATTRIBUTE_NAME_LENGTH 9 ++#define GRUB_NTFS_ATTRIBUTE_NAME_OFFSET 10 ++ ++/* Offsets for values needed for resident data. */ ++#define GRUB_NTFS_ATTRIBUTE_RES_LENGTH 16 ++#define GRUB_NTFS_ATTRIBUTE_RES_OFFSET 20 ++ ++/* Offsets for values needed for non-resident data. */ ++#define GRUB_NTFS_ATTRIBUTE_DATA_RUNS 32 ++#define GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE 34 ++ + enum + { + GRUB_NTFS_AF_ALST = 1, diff --git a/0307-fs-xfs-Fix-out-of-bounds-read.patch b/0307-fs-xfs-Fix-out-of-bounds-read.patch new file mode 100644 index 00000000..a71ff511 --- /dev/null +++ b/0307-fs-xfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:57 +0800 +Subject: [PATCH] fs/xfs: Fix out-of-bounds read + +The number of records in the root key array read from disk was not being +validated against the size of the root node. This could lead to an +out-of-bounds read. + +This patch adds a check to ensure that the number of records in the root +key array does not exceed the expected size of a root node read from +disk. If this check detects an out-of-bounds condition the operation is +aborted to prevent random errors due to metadata corruption. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 92046f9bd..96f62c5a4 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -595,6 +595,17 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + do + { + grub_uint64_t i; ++ grub_addr_t keys_end, data_end; ++ ++ if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || ++ grub_add ((grub_addr_t) keys, keys_end, &keys_end) || ++ grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || ++ keys_end > data_end) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS root keys"); ++ grub_free (leaf); ++ return 0; ++ } + + for (i = 0; i < nrec; i++) + { diff --git a/0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch b/0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch new file mode 100644 index 00000000..39f0adaa --- /dev/null +++ b/0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:03:58 +0100 +Subject: [PATCH] fs/xfs: Ensuring failing to mount sets a grub_errno + +It was previously possible for grub_xfs_mount() to return NULL without +setting grub_errno if the XFS version was invalid. This resulted in it +being possible for grub_dl_unref() to be called twice allowing the XFS +module to be unloaded while there were still references to it. + +Fixing this problem in general by ensuring a grub_errno is set if the +fail label is reached. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 96f62c5a4..a837f9824 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -327,6 +327,8 @@ static int grub_xfs_sb_valid(struct grub_xfs_data *data) + } + return 1; + } ++ ++ grub_error (GRUB_ERR_BAD_FS, "unsupported XFS filesystem version"); + return 0; + } + +@@ -1068,7 +1070,7 @@ grub_xfs_mount (grub_disk_t disk) + return data; + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not an XFS filesystem"); + + grub_free (data); diff --git a/0309-kern-file-Ensure-file-data-is-set.patch b/0309-kern-file-Ensure-file-data-is-set.patch new file mode 100644 index 00000000..260d1b08 --- /dev/null +++ b/0309-kern-file-Ensure-file-data-is-set.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 03:01:40 +0100 +Subject: [PATCH] kern/file: Ensure file->data is set + +This is to avoid a generic issue were some filesystems would not set +data and also not set a grub_errno. This meant it was possible for many +filesystems to grub_dl_unref() themselves multiple times resulting in +it being possible to unload the filesystems while there were still +references to them, e.g., via a loopback. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 75510df7c..85e832bd8 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -124,6 +124,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if ((file->fs->fs_open) (file, file_name) != GRUB_ERR_NONE) + goto fail; + ++ if (file->data == NULL) ++ goto fail; ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + diff --git a/0310-kern-file-Implement-filesystem-reference-counting.patch b/0310-kern-file-Implement-filesystem-reference-counting.patch new file mode 100644 index 00000000..348bebed --- /dev/null +++ b/0310-kern-file-Implement-filesystem-reference-counting.patch @@ -0,0 +1,440 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 13:44:25 -0600 +Subject: [PATCH] kern/file: Implement filesystem reference counting + +The grub_file_open() and grub_file_close() should be the only places +that allow a reference to a filesystem to stay open. So, add grub_dl_t +to grub_fs_t and set this in the GRUB_MOD_INIT() for each filesystem to +avoid issues when filesystems forget to do it themselves or do not track +their own references, e.g. squash4. + +The fs_label(), fs_uuid(), fs_mtime() and fs_read() should all ref and +unref in the same function but it is essentially redundant in GRUB +single threaded model. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 1 + + grub-core/fs/bfs.c | 1 + + grub-core/fs/btrfs.c | 1 + + grub-core/fs/cbfs.c | 1 + + grub-core/fs/cpio.c | 1 + + grub-core/fs/cpio_be.c | 1 + + grub-core/fs/ext2.c | 1 + + grub-core/fs/f2fs.c | 1 + + grub-core/fs/fat.c | 1 + + grub-core/fs/hfs.c | 1 + + grub-core/fs/hfsplus.c | 1 + + grub-core/fs/iso9660.c | 1 + + grub-core/fs/jfs.c | 1 + + grub-core/fs/minix.c | 1 + + grub-core/fs/newc.c | 1 + + grub-core/fs/nilfs2.c | 1 + + grub-core/fs/ntfs.c | 1 + + grub-core/fs/odc.c | 1 + + grub-core/fs/proc.c | 1 + + grub-core/fs/reiserfs.c | 1 + + grub-core/fs/romfs.c | 1 + + grub-core/fs/sfs.c | 1 + + grub-core/fs/squash4.c | 1 + + grub-core/fs/tar.c | 1 + + grub-core/fs/udf.c | 1 + + grub-core/fs/ufs.c | 1 + + grub-core/fs/xfs.c | 1 + + grub-core/fs/zfs/zfs.c | 1 + + grub-core/kern/file.c | 7 +++++++ + include/grub/fs.h | 4 ++++ + 30 files changed, 39 insertions(+) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index ed606b3f1..9b0afb954 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -703,6 +703,7 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { ++ grub_affs_fs.mod = mod; + grub_fs_register (&grub_affs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index 07cb3e3ac..f37b16895 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -1106,6 +1106,7 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); ++ grub_bfs_fs.mod = mod; + grub_fs_register (&grub_bfs_fs); + } + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index ad35e7575..6593f5175 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -3402,6 +3402,7 @@ subvol_get_env (struct grub_env_var *var __attribute__ ((unused)), + + GRUB_MOD_INIT (btrfs) + { ++ grub_btrfs_fs.mod = mod; + grub_fs_register (&grub_btrfs_fs); + cmd_info = grub_register_command("btrfs-info", grub_cmd_btrfs_info, + "DEVICE", +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 8ab7106af..2332745fe 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -390,6 +390,7 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif ++ grub_cbfs_fs.mod = mod; + grub_fs_register (&grub_cbfs_fs); + } + +diff --git a/grub-core/fs/cpio.c b/grub-core/fs/cpio.c +index dab5f9898..1799f7ff5 100644 +--- a/grub-core/fs/cpio.c ++++ b/grub-core/fs/cpio.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/cpio_be.c b/grub-core/fs/cpio_be.c +index 846548892..7bed1b848 100644 +--- a/grub-core/fs/cpio_be.c ++++ b/grub-core/fs/cpio_be.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio_be) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index 3f9f6b208..c3058f7e7 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -1131,6 +1131,7 @@ static struct grub_fs grub_ext2_fs = + + GRUB_MOD_INIT(ext2) + { ++ grub_ext2_fs.mod = mod; + grub_fs_register (&grub_ext2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index db8a65f8d..f6d6beaa5 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -1353,6 +1353,7 @@ static struct grub_fs grub_f2fs_fs = { + + GRUB_MOD_INIT (f2fs) + { ++ grub_f2fs_fs.mod = mod; + grub_fs_register (&grub_f2fs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/fat.c b/grub-core/fs/fat.c +index c5efed724..6e62b915d 100644 +--- a/grub-core/fs/fat.c ++++ b/grub-core/fs/fat.c +@@ -1312,6 +1312,7 @@ GRUB_MOD_INIT(fat) + #endif + { + COMPILE_TIME_ASSERT (sizeof (struct grub_fat_dir_entry) == 32); ++ grub_fat_fs.mod = mod; + grub_fs_register (&grub_fat_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 920112b03..ce7581dd5 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -1434,6 +1434,7 @@ static struct grub_fs grub_hfs_fs = + + GRUB_MOD_INIT(hfs) + { ++ grub_hfs_fs.mod = mod; + if (!grub_is_lockdown ()) + grub_fs_register (&grub_hfs_fs); + my_mod = mod; +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index de71fd486..3f203abcc 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -1176,6 +1176,7 @@ static struct grub_fs grub_hfsplus_fs = + + GRUB_MOD_INIT(hfsplus) + { ++ grub_hfsplus_fs.mod = mod; + grub_fs_register (&grub_hfsplus_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8e3c95c4f..c73cb9ce0 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -1260,6 +1260,7 @@ static struct grub_fs grub_iso9660_fs = + + GRUB_MOD_INIT(iso9660) + { ++ grub_iso9660_fs.mod = mod; + grub_fs_register (&grub_iso9660_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 70a2f4947..b0283ac00 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -1005,6 +1005,7 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { ++ grub_jfs_fs.mod = mod; + grub_fs_register (&grub_jfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index 5354951d1..b7679c3e2 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -734,6 +734,7 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { ++ grub_minix_fs.mod = mod; + grub_fs_register (&grub_minix_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/newc.c b/grub-core/fs/newc.c +index 4fb8b2e3d..43b7f8b64 100644 +--- a/grub-core/fs/newc.c ++++ b/grub-core/fs/newc.c +@@ -64,6 +64,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (newc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index fc7374ead..4e1e71738 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -1231,6 +1231,7 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); ++ grub_nilfs2_fs.mod = mod; + grub_fs_register (&grub_nilfs2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 64f4f2221..4e144cc3c 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -1541,6 +1541,7 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { ++ grub_ntfs_fs.mod = mod; + grub_fs_register (&grub_ntfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/odc.c b/grub-core/fs/odc.c +index 790000622..8e4e8aeac 100644 +--- a/grub-core/fs/odc.c ++++ b/grub-core/fs/odc.c +@@ -52,6 +52,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (odc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/proc.c b/grub-core/fs/proc.c +index 5f516502d..bcde43349 100644 +--- a/grub-core/fs/proc.c ++++ b/grub-core/fs/proc.c +@@ -192,6 +192,7 @@ static struct grub_fs grub_procfs_fs = + + GRUB_MOD_INIT (procfs) + { ++ grub_procfs_fs.mod = mod; + grub_disk_dev_register (&grub_procfs_dev); + grub_fs_register (&grub_procfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index 42818c376..e8b0b6383 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -1407,6 +1407,7 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { ++ grub_reiserfs_fs.mod = mod; + grub_fs_register (&grub_reiserfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index 1f7dcfca1..56b0b2b2f 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -475,6 +475,7 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { ++ grub_romfs_fs.mod = mod; + grub_fs_register (&grub_romfs_fs); + } + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 983e88008..f0d7cac43 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -779,6 +779,7 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { ++ grub_sfs_fs.mod = mod; + grub_fs_register (&grub_sfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index a30e6ebe1..6e9d63874 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -1044,6 +1044,7 @@ static struct grub_fs grub_squash_fs = + + GRUB_MOD_INIT(squash4) + { ++ grub_squash_fs.mod = mod; + grub_fs_register (&grub_squash_fs); + } + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 386c09022..fd2ec1f74 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -354,6 +354,7 @@ static struct grub_fs grub_cpio_fs = { + + GRUB_MOD_INIT (tar) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index b836e6107..8765c633c 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -1455,6 +1455,7 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { ++ grub_udf_fs.mod = mod; + grub_fs_register (&grub_udf_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index 01235101b..e82d9356d 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -899,6 +899,7 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { ++ grub_ufs_fs.mod = mod; + grub_fs_register (&grub_ufs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index a837f9824..6c952aef1 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -1304,6 +1304,7 @@ static struct grub_fs grub_xfs_fs = + + GRUB_MOD_INIT(xfs) + { ++ grub_xfs_fs.mod = mod; + grub_fs_register (&grub_xfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index b5453e006..a497b1869 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -4424,6 +4424,7 @@ static struct grub_fs grub_zfs_fs = { + GRUB_MOD_INIT (zfs) + { + COMPILE_TIME_ASSERT (sizeof (zap_leaf_chunk_t) == ZAP_LEAF_CHUNKSIZE); ++ grub_zfs_fs.mod = mod; + grub_fs_register (&grub_zfs_fs); + #ifndef GRUB_UTIL + my_mod = mod; +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 85e832bd8..ec90a26ba 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + void (*EXPORT_VAR (grub_grubnet_fini)) (void); + +@@ -127,6 +128,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if (file->data == NULL) + goto fail; + ++ if (file->fs->mod) ++ grub_dl_ref (file->fs->mod); ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + +@@ -219,6 +223,9 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len) + grub_err_t + grub_file_close (grub_file_t file) + { ++ if (file->fs->mod) ++ grub_dl_unref (file->fs->mod); ++ + grub_dprintf ("file", "Closing `%s' ...\n", file->name); + if (file->fs->fs_close) + (file->fs->fs_close) (file); +diff --git a/include/grub/fs.h b/include/grub/fs.h +index 026bc3bb8..df4c93b16 100644 +--- a/include/grub/fs.h ++++ b/include/grub/fs.h +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + /* For embedding types. */ +@@ -57,6 +58,9 @@ struct grub_fs + /* My name. */ + const char *name; + ++ /* My module */ ++ grub_dl_t mod; ++ + /* Call HOOK with each file under DIR. */ + grub_err_t (*fs_dir) (grub_device_t device, const char *path, + grub_fs_dir_hook_t hook, void *hook_data); diff --git a/0311-cli_lock-Add-build-option-to-block-command-line-inte.patch b/0311-cli_lock-Add-build-option-to-block-command-line-inte.patch new file mode 100644 index 00000000..3c7d6414 --- /dev/null +++ b/0311-cli_lock-Add-build-option-to-block-command-line-inte.patch @@ -0,0 +1,366 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 24 Jan 2024 06:26:37 +0000 +Subject: [PATCH] cli_lock: Add build option to block command line interface + +Add functionality to disable command line interface access and editing of GRUB +menu entries if GRUB image is built with --disable-cli. + +Signed-off-by: Alec Brown +Reviewed-by: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 6 ++++-- + grub-core/kern/main.c | 28 ++++++++++++++++++++++++++++ + grub-core/kern/rescue_reader.c | 13 +++++++++++++ + grub-core/normal/auth.c | 3 +++ + grub-core/normal/menu_text.c | 31 +++++++++++++++++-------------- + include/grub/kernel.h | 1 + + include/grub/misc.h | 2 ++ + include/grub/util/install.h | 8 ++++++-- + util/grub-install-common.c | 10 ++++++++-- + util/grub-mkimage.c | 9 ++++++++- + util/mkimage.c | 15 ++++++++++++++- + 11 files changed, 104 insertions(+), 22 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 096a3cde0..9ce9c5b82 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6520,8 +6520,10 @@ the GRUB command line, edit menu entries, and execute any menu entry. If + @samp{superusers} is set, then use of the command line and editing of menu + entries are automatically restricted to superusers. Setting @samp{superusers} + to empty string effectively disables both access to CLI and editing of menu +-entries. Note: The environment variable needs to be exported to also affect +-the section defined by the @samp{submenu} command (@pxref{submenu}). ++entries. Building a grub image with @samp{--disable-cli} option will also ++disable access to CLI and editing of menu entries, as well as disabling rescue ++mode. Note: The environment variable needs to be exported to also affect the ++section defined by the @samp{submenu} command (@pxref{submenu}). + + Other users may be allowed to execute specific menu entries by giving a list of + usernames (as above) using the @option{--users} option to the +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 8e89763f4..0d6b8138d 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -30,11 +30,14 @@ + #include + #include + #include ++#include + + #ifdef GRUB_MACHINE_PCBIOS + #include + #endif + ++static bool cli_disabled = false; ++ + grub_addr_t + grub_modules_get_end (void) + { +@@ -299,6 +302,28 @@ grub_load_normal_mode (void) + grub_command_execute ("normal", 0, 0); + } + ++bool ++grub_is_cli_disabled (void) ++{ ++ return cli_disabled; ++} ++ ++static void ++check_is_cli_disabled (void) ++{ ++ struct grub_module_header *header; ++ header = 0; ++ ++ FOR_MODULES (header) ++ { ++ if (header->type == OBJ_TYPE_DISABLE_CLI) ++ { ++ cli_disabled = true; ++ return; ++ } ++ } ++} ++ + static void + reclaim_module_space (void) + { +@@ -356,6 +381,9 @@ grub_main (void) + + grub_boot_time ("After loading embedded modules."); + ++ /* Check if the CLI should be disabled */ ++ check_is_cli_disabled (); ++ + /* It is better to set the root device as soon as possible, + for convenience. */ + grub_set_prefix_and_root (); +diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c +index dcd7d4439..4259857ba 100644 +--- a/grub-core/kern/rescue_reader.c ++++ b/grub-core/kern/rescue_reader.c +@@ -78,6 +78,19 @@ grub_rescue_read_line (char **line, int cont, + void __attribute__ ((noreturn)) + grub_rescue_run (void) + { ++ /* Stall if the CLI has been disabled */ ++ if (grub_is_cli_disabled ()) ++ { ++ grub_printf ("Rescue mode has been disabled...\n"); ++ ++ do ++ { ++ /* Do not optimize out the loop. */ ++ asm volatile (""); ++ } ++ while (1); ++ } ++ + grub_printf ("Entering rescue mode...\n"); + + while (1) +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index 517fc623f..d94020186 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -209,6 +209,9 @@ grub_auth_check_authentication (const char *userlist) + char entered[GRUB_AUTH_MAX_PASSLEN]; + struct grub_auth_user *user; + ++ if (grub_is_cli_disabled ()) ++ return GRUB_ACCESS_DENIED; ++ + grub_memset (login, 0, sizeof (login)); + + if (is_authenticated (userlist)) +diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c +index b1321eb26..9c383e64a 100644 +--- a/grub-core/normal/menu_text.c ++++ b/grub-core/normal/menu_text.c +@@ -178,21 +178,24 @@ command-line or ESC to discard edits and return to the GRUB menu."), + + grub_free (msg_translated); + +- if (nested) ++ if (!grub_is_cli_disabled ()) + { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line. ESC to return previous menu."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); +- } +- else +- { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ if (nested) ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line. ESC to return previous menu."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } ++ else ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } + } + } + return ret; +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index 98edc0863..f98a780da 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -33,6 +33,7 @@ enum + OBJ_TYPE_DISABLE_SHIM_LOCK, + OBJ_TYPE_GPG_PUBKEY, + OBJ_TYPE_X509_PUBKEY, ++ OBJ_TYPE_DISABLE_CLI + }; + + /* The module header. */ +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 6b1e084af..d6e9bae8e 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -442,6 +442,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t d, + grub_uint64_t *r); + ++extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); ++ + /* Must match softdiv group in gentpl.py. */ + #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ + (defined(__riscv) && (__riscv_xlen == 32))) +diff --git a/include/grub/util/install.h b/include/grub/util/install.h +index 59eabb9bb..dbf3c216d 100644 +--- a/include/grub/util/install.h ++++ b/include/grub/util/install.h +@@ -72,6 +72,8 @@ + { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ + "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ + 1}, \ ++ { "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, \ ++ N_("disabled command line interface access"), 0 }, \ + { "verbose", 'v', 0, 0, \ + N_("print verbose messages."), 1 } + +@@ -135,7 +137,8 @@ enum grub_install_options { + GRUB_INSTALL_OPTIONS_DTB, + GRUB_INSTALL_OPTIONS_SBAT, + GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, +- GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE ++ GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE, ++ GRUB_INSTALL_OPTIONS_DISABLE_CLI + }; + + extern char *grub_install_source_directory; +@@ -198,7 +201,8 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, + grub_compression_t comp, const char *dtb_file, +- const char *sbat_path, const int disable_shim_lock); ++ const char *sbat_path, const int disable_shim_lock, ++ const int disable_cli); + + const struct grub_install_image_target_desc * + grub_install_get_image_target (const char *arg); +diff --git a/util/grub-install-common.c b/util/grub-install-common.c +index 67afc2eed..42aec141e 100644 +--- a/util/grub-install-common.c ++++ b/util/grub-install-common.c +@@ -469,6 +469,7 @@ static char **x509keys; + static size_t nx509keys; + static grub_compression_t compression; + static size_t appsig_size; ++static int disable_cli; + + int + grub_install_parse (int key, char *arg) +@@ -514,6 +515,9 @@ grub_install_parse (int key, char *arg) + * (nx509keys + 1)); + x509keys[nx509keys++] = xstrdup (arg); + return 1; ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ disable_cli = 1; ++ return 1; + + case GRUB_INSTALL_OPTIONS_VERBOSITY: + verbosity++; +@@ -708,11 +712,13 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + grub_util_info ("grub-mkimage --directory '%s' --prefix '%s' --output '%s'" + " --format '%s' --compression '%s'" + " --appended-signture-size %zu %s%s%s\n", ++ " --format '%s' --compression '%s'%s%s%s%s\n", + dir, prefix, outname, + mkimage_target, compnames[compression], + appsig_size, + note ? " --note" : "", +- disable_shim_lock ? " --disable-shim-lock" : "", s); ++ disable_shim_lock ? " --disable-shim-lock" : "", ++ disable_cli ? " --disable-cli" : "", s); + free (s); + + tgt = grub_install_get_image_target (mkimage_target); +@@ -725,7 +731,7 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + x509keys, nx509keys, + config_path, tgt, + note, appsig_size, compression, dtb, sbat, +- disable_shim_lock); ++ disable_shim_lock, disable_cli); + while (dc--) + grub_install_pop_module (); + } +diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c +index e1f111278..13bdc6cf0 100644 +--- a/util/grub-mkimage.c ++++ b/util/grub-mkimage.c +@@ -84,6 +84,7 @@ static struct argp_option options[] = { + {"compression", 'C', "(xz|none|auto)", 0, N_("choose the compression to use for core image"), 0}, + {"sbat", 's', N_("FILE"), 0, N_("SBAT metadata"), 0}, + {"disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, N_("disable shim_lock verifier"), 0}, ++ {"disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, N_("disable command line interface access"), 0}, + {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, + {"appended-signature-size", 'S', N_("SIZE"), 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 0}, + { 0, 0, 0, 0, 0, 0 } +@@ -133,6 +134,7 @@ struct arguments + int note; + int disable_shim_lock; + size_t appsig_size; ++ int disable_cli; + const struct grub_install_image_target_desc *image_target; + grub_compression_t comp; + }; +@@ -259,6 +261,10 @@ argp_parser (int key, char *arg, struct argp_state *state) + arguments->disable_shim_lock = 1; + break; + ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ arguments->disable_cli = 1; ++ break; ++ + case 'v': + verbosity++; + break; +@@ -347,7 +353,8 @@ main (int argc, char *argv[]) + arguments.image_target, arguments.note, + arguments.appsig_size, arguments.comp, + arguments.dtb, arguments.sbat, +- arguments.disable_shim_lock); ++ arguments.disable_shim_lock, ++ arguments.disable_cli); + + if (grub_util_file_sync (fp) < 0) + grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout", +diff --git a/util/mkimage.c b/util/mkimage.c +index 425d920ff..f31fdefa8 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -888,7 +888,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, grub_compression_t comp, + const char *dtb_path, const char *sbat_path, +- int disable_shim_lock) ++ int disable_shim_lock, int disable_cli) + { + char *kernel_img, *core_img; + size_t total_module_size, core_size; +@@ -963,6 +963,9 @@ grub_install_generate_image (const char *dir, const char *prefix, + if (disable_shim_lock) + total_module_size += sizeof (struct grub_module_header); + ++ if (disable_cli) ++ total_module_size += sizeof (struct grub_module_header); ++ + if (config_path) + { + config_size = ALIGN_ADDR (grub_util_get_image_size (config_path) + 1); +@@ -1129,6 +1132,16 @@ grub_install_generate_image (const char *dir, const char *prefix, + offset += sizeof (*header); + } + ++ if (disable_cli) ++ { ++ struct grub_module_header *header; ++ ++ header = (struct grub_module_header *) (kernel_img + offset); ++ header->type = grub_host_to_target32 (OBJ_TYPE_DISABLE_CLI); ++ header->size = grub_host_to_target32 (sizeof (*header)); ++ offset += sizeof (*header); ++ } ++ + if (config_path) + { + struct grub_module_header *header; diff --git a/0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch b/0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch new file mode 100644 index 00000000..2c2396ad --- /dev/null +++ b/0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch @@ -0,0 +1,337 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Tue, 11 Feb 2025 15:08:06 -0600 +Subject: [PATCH] disk/cryptodisk: Require authentication after TPM unlock for + CLI access + +The GRUB may use TPM to verify the integrity of boot components and the +result can determine whether a previously sealed key can be released. If +everything checks out, showing nothing has been tampered with, the key +is released and GRUB unlocks the encrypted root partition for the next +stage of booting. + +However, the liberal Command Line Interface (CLI) can be misused by +anyone in this case to access files in the encrypted partition one way +or another. Despite efforts to keep the CLI secure by preventing utility +command output from leaking file content, many techniques in the wild +could still be used to exploit the CLI, enabling attacks or learning +methods to attack. It's nearly impossible to account for all scenarios +where a hack could be applied. + +Therefore, to mitigate potential misuse of the CLI after the root device +has been successfully unlocked via TPM, the user should be required to +authenticate using the LUKS password. This added layer of security +ensures that only authorized users can access the CLI reducing the risk +of exploitation or unauthorized access to the encrypted partition. + +Fixes: CVE-2024-49504 + +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 29 +++++++++++++++ + grub-core/disk/cryptodisk.c | 87 ++++++++++++++++++++++++++++++++++++++++++- + grub-core/kern/main.c | 12 ++++++ + grub-core/normal/auth.c | 30 +++++++++++++++ + grub-core/normal/main.c | 4 ++ + grub-core/normal/menu_entry.c | 4 ++ + include/grub/auth.h | 1 + + include/grub/cryptodisk.h | 3 ++ + include/grub/misc.h | 2 + + 9 files changed, 171 insertions(+), 1 deletion(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 9ce9c5b82..2d6d73a78 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6882,6 +6882,35 @@ sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed + As with UEFI secure boot, it is necessary to build in the required modules, + or sign them separately. + ++@subsection Command line and menuentry editor protection ++ ++The TPM key protector provides full disk encryption support on servers or ++virtual machine images, meanwhile keeping the boot process unattended. This ++prevents service disruptions by eliminating the need for manual password input ++during startup, improving system uptime and continuity. It is achieved by TPM, ++which verifies the integrity of boot components by checking cryptographic ++hashes against securely stored values, to confirm the disks are unlocked in a ++trusted state. ++ ++However, for users to access the system interactively, some form of ++authentication is still required, as the disks are not unlocked by an ++authorized user. This raised concerns about using an unprotected ++@samp{command-line interface} (@pxref{Command-line interface}), as anyone could ++execute commands to access decrypted data. To address this issue, the LUKS ++password is used to ensure that only authorized users are granted access to the ++interface. Additionally, the @samp{menu entry editor} (@pxref{Menu entry ++editor}) is also safeguarded by the LUKS password, as modifying a boot entry is ++effectively the same as altering the @file{grub.cfg} file read from encrypted ++files. ++ ++It is worth mentioning that the built-in password support, as described in ++@samp{Authentication and Authorization in GRUB} (@pxref{Authentication and ++authorisation}), can also be used to protect the command-line interface from ++unauthorized access. However, it is not recommended to rely on this approach as ++it is an optional step. Setting it up requires additional manual intervention, ++which increases the risk of password leakage during the process. Moreover, the ++superuser list must be well maintained, and the password used cannot be ++synchronized with LUKS key rotation. + + @node Platform limitations + @chapter Platform limitations +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 98e176a13..06a42b2d7 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -1144,7 +1144,9 @@ grub_cryptodisk_scan_device_real (const char *name, + ret = grub_cryptodisk_insert (dev, name, source); + if (ret != GRUB_ERR_NONE) + goto error; +- ++#ifndef GRUB_UTIL ++ grub_cli_set_auth_needed (); ++#endif + goto cleanup; + } + grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); +@@ -1576,6 +1578,89 @@ luks_script_get (grub_size_t *sz) + return ret; + } + ++#ifdef GRUB_MACHINE_EFI ++grub_err_t ++grub_cryptodisk_challenge_password (void) ++{ ++ grub_cryptodisk_t cr_dev; ++ ++ for (cr_dev = cryptodisk_list; cr_dev != NULL; cr_dev = cr_dev->next) ++ { ++ grub_cryptodisk_dev_t cr; ++ grub_disk_t source = NULL; ++ grub_err_t ret = GRUB_ERR_NONE; ++ grub_cryptodisk_t dev = NULL; ++ char *part = NULL; ++ struct grub_cryptomount_args cargs = {0}; ++ ++ cargs.check_boot = 0; ++ cargs.search_uuid = cr_dev->uuid; ++ ++ source = grub_disk_open (cr_dev->source); ++ ++ if (source == NULL) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ ++ FOR_CRYPTODISK_DEVS (cr) ++ { ++ dev = cr->scan (source, &cargs); ++ if (grub_errno) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ if (dev == NULL) ++ continue; ++ break; ++ } ++ ++ if (dev == NULL) ++ { ++ ret = grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); ++ goto error_out; ++ } ++ ++ part = grub_partition_get_name (source->partition); ++ grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, ++ source->partition != NULL ? "," : "", ++ part != NULL ? part : N_("UNKNOWN"), cr_dev->uuid); ++ grub_free (part); ++ ++ cargs.key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); ++ if (cargs.key_data == NULL) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ ++ if (!grub_password_get ((char *) cargs.key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) ++ { ++ ret = grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); ++ goto error_out; ++ } ++ cargs.key_len = grub_strlen ((char *) cargs.key_data); ++ ret = cr->recover_key (source, dev, &cargs); ++ ++ error_out: ++ grub_disk_close (source); ++ if (dev != NULL) ++ cryptodisk_close (dev); ++ if (cargs.key_data) ++ { ++ grub_memset (cargs.key_data, 0, cargs.key_len); ++ grub_free (cargs.key_data); ++ } ++ ++ return ret; ++ } ++ ++ return GRUB_ERR_NONE; ++} ++#endif /* GRUB_MACHINE_EFI */ ++ + struct grub_procfs_entry luks_script = + { + .name = "luks_script", +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 0d6b8138d..2e6b79ee3 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -37,6 +37,7 @@ + #endif + + static bool cli_disabled = false; ++static bool cli_need_auth = false; + + grub_addr_t + grub_modules_get_end (void) +@@ -308,6 +309,17 @@ grub_is_cli_disabled (void) + return cli_disabled; + } + ++bool ++grub_is_cli_need_auth (void) ++{ ++ return cli_need_auth; ++} ++ ++void grub_cli_set_auth_needed (void) ++{ ++ cli_need_auth = true; ++} ++ + static void + check_is_cli_disabled (void) + { +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index d94020186..71b361bc0 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -25,6 +25,10 @@ + #include + #include + ++#ifdef GRUB_MACHINE_EFI ++#include ++#endif ++ + struct grub_auth_user + { + struct grub_auth_user *next; +@@ -200,6 +204,32 @@ grub_username_get (char buf[], unsigned buf_size) + return (key != GRUB_TERM_ESC); + } + ++grub_err_t ++grub_auth_check_cli_access (void) ++{ ++ if (grub_is_cli_need_auth () == true) ++ { ++#ifdef GRUB_MACHINE_EFI ++ static bool authenticated = false; ++ ++ if (authenticated == false) ++ { ++ grub_err_t ret; ++ ++ ret = grub_cryptodisk_challenge_password (); ++ if (ret == GRUB_ERR_NONE) ++ authenticated = true; ++ return ret; ++ } ++ return GRUB_ERR_NONE; ++#else ++ return GRUB_ACCESS_DENIED; ++#endif ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ + grub_err_t + grub_auth_check_authentication (const char *userlist) + { +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 26872ce94..86ffb388d 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -557,9 +557,13 @@ grub_cmdline_run (int nested, int force_auth) + } + while (err && force_auth); + ++ if (err == GRUB_ERR_NONE) ++ err = grub_auth_check_cli_access (); ++ + if (err) + { + grub_print_error (); ++ grub_wait_after_message (); + grub_errno = GRUB_ERR_NONE; + return; + } +diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c +index ade56be2b..8b0d17e3f 100644 +--- a/grub-core/normal/menu_entry.c ++++ b/grub-core/normal/menu_entry.c +@@ -1255,9 +1255,13 @@ grub_menu_entry_run (grub_menu_entry_t entry) + + err = grub_auth_check_authentication (NULL); + ++ if (err == GRUB_ERR_NONE) ++ err = grub_auth_check_cli_access (); ++ + if (err) + { + grub_print_error (); ++ grub_wait_after_message (); + grub_errno = GRUB_ERR_NONE; + return; + } +diff --git a/include/grub/auth.h b/include/grub/auth.h +index 747334451..21d5190f0 100644 +--- a/include/grub/auth.h ++++ b/include/grub/auth.h +@@ -33,5 +33,6 @@ grub_err_t grub_auth_unregister_authentication (const char *user); + grub_err_t grub_auth_authenticate (const char *user); + grub_err_t grub_auth_deauthenticate (const char *user); + grub_err_t grub_auth_check_authentication (const char *userlist); ++grub_err_t grub_auth_check_cli_access (void); + + #endif /* ! GRUB_AUTH_HEADER */ +diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h +index d94df68b6..d2572f8b0 100644 +--- a/include/grub/cryptodisk.h ++++ b/include/grub/cryptodisk.h +@@ -187,4 +187,7 @@ grub_util_get_geli_uuid (const char *dev); + grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid); + grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); + ++#ifdef GRUB_MACHINE_EFI ++grub_err_t grub_cryptodisk_challenge_password (void); ++#endif + #endif +diff --git a/include/grub/misc.h b/include/grub/misc.h +index d6e9bae8e..0429339ef 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -443,6 +443,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t *r); + + extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); ++extern bool EXPORT_FUNC(grub_is_cli_need_auth) (void); ++extern void EXPORT_FUNC(grub_cli_set_auth_needed) (void); + + /* Must match softdiv group in gentpl.py. */ + #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ diff --git a/0313-disk-loopback-Reference-tracking-for-the-loopback.patch b/0313-disk-loopback-Reference-tracking-for-the-loopback.patch new file mode 100644 index 00000000..5f6cd3af --- /dev/null +++ b/0313-disk-loopback-Reference-tracking-for-the-loopback.patch @@ -0,0 +1,108 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:22:28 -0600 +Subject: [PATCH] disk/loopback: Reference tracking for the loopback + +It was possible to delete a loopback while there were still references +to it. This led to an exploitable use-after-free. + +Fixed by implementing a reference counting in the grub_loopback struct. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/disk/loopback.c | 17 +++++++++++++++++ + include/grub/err.h | 3 ++- + include/grub/loopback.h | 1 + + 3 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c +index 11a5e0cbd..f39281323 100644 +--- a/grub-core/disk/loopback.c ++++ b/grub-core/disk/loopback.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -57,6 +58,8 @@ delete_loopback (const char *name) + if (! dev) + return grub_error (GRUB_ERR_BAD_DEVICE, "device not found"); + ++ if (dev->refcnt > 0) ++ return grub_error (GRUB_ERR_STILL_REFERENCED, "device still referenced"); + /* Remove the device from the list. */ + *prev = dev->next; + +@@ -113,6 +116,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args) + + newdev->file = file; + newdev->id = last_id++; ++ newdev->refcnt = 0; + + /* Add the new entry to the list. */ + newdev->next = loopback_list; +@@ -154,6 +158,9 @@ grub_loopback_open (const char *name, grub_disk_t disk) + if (! dev) + return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); + ++ if (grub_add (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count overflow"); ++ + /* Use the filesize for the disk size, round up to a complete sector. */ + if (dev->file->size != GRUB_FILE_SIZE_UNKNOWN) + disk->total_sectors = ((dev->file->size + GRUB_DISK_SECTOR_SIZE - 1) +@@ -171,6 +178,15 @@ grub_loopback_open (const char *name, grub_disk_t disk) + return 0; + } + ++static void ++grub_loopback_close (grub_disk_t disk) ++{ ++ struct grub_loopback *dev = disk->data; ++ ++ if (grub_sub (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count underflow"); ++} ++ + static grub_err_t + grub_loopback_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_size_t size, char *buf) +@@ -213,6 +229,7 @@ static struct grub_disk_dev grub_loopback_dev = + .id = GRUB_DISK_DEVICE_LOOPBACK_ID, + .disk_iterate = grub_loopback_iterate, + .disk_open = grub_loopback_open, ++ .disk_close = grub_loopback_close, + .disk_read = grub_loopback_read, + .disk_write = grub_loopback_write, + .next = 0 +diff --git a/include/grub/err.h b/include/grub/err.h +index 3c587b9b8..29f1a73c5 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -73,7 +73,8 @@ typedef enum + GRUB_ERR_NET_NO_DOMAIN, + GRUB_ERR_EOF, + GRUB_ERR_BAD_SIGNATURE, +- GRUB_ERR_BAD_FIRMWARE ++ GRUB_ERR_BAD_FIRMWARE, ++ GRUB_ERR_STILL_REFERENCED + } + grub_err_t; + +diff --git a/include/grub/loopback.h b/include/grub/loopback.h +index 3b9a9e32e..915ef65fc 100644 +--- a/include/grub/loopback.h ++++ b/include/grub/loopback.h +@@ -25,6 +25,7 @@ struct grub_loopback + grub_file_t file; + struct grub_loopback *next; + unsigned long id; ++ grub_uint64_t refcnt; + }; + + #endif /* ! GRUB_LOOPBACK_HEADER */ diff --git a/0314-kern-disk-Limit-recursion-depth.patch b/0314-kern-disk-Limit-recursion-depth.patch new file mode 100644 index 00000000..eba37f97 --- /dev/null +++ b/0314-kern-disk-Limit-recursion-depth.patch @@ -0,0 +1,120 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 04:09:24 +0100 +Subject: [PATCH] kern/disk: Limit recursion depth + +The grub_disk_read() may trigger other disk reads, e.g. via loopbacks. +This may lead to very deep recursion which can corrupt the heap. So, fix +the issue by limiting reads depth. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/disk.c | 27 ++++++++++++++++++++------- + include/grub/err.h | 3 ++- + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c +index 355b6579d..5747ad85c 100644 +--- a/grub-core/kern/disk.c ++++ b/grub-core/kern/disk.c +@@ -28,6 +28,10 @@ + + #define GRUB_CACHE_TIMEOUT 2 + ++/* Disk reads may trigger other disk reads. So, limit recursion depth. */ ++#define MAX_READ_RECURSION_DEPTH 16 ++static unsigned int read_recursion_depth = 0; ++ + /* The last time the disk was used. */ + static grub_uint64_t grub_last_time = 0; + +@@ -421,6 +425,8 @@ grub_err_t + grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_off_t offset, grub_size_t size, void *buf) + { ++ grub_err_t err = GRUB_ERR_NONE; ++ + /* First of all, check if the region is within the disk. */ + if (grub_disk_adjust_range (disk, §or, &offset, size) != GRUB_ERR_NONE) + { +@@ -431,12 +437,17 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + return grub_errno; + } + ++ if (++read_recursion_depth >= MAX_READ_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_RECURSION_DEPTH, "grub_disk_read(): Maximum recursion depth exceeded"); ++ goto error; ++ } ++ + /* First read until first cache boundary. */ + if (offset || (sector & (GRUB_DISK_CACHE_SIZE - 1))) + { + grub_disk_addr_t start_sector; + grub_size_t pos; +- grub_err_t err; + grub_size_t len; + + start_sector = sector & ~((grub_disk_addr_t) GRUB_DISK_CACHE_SIZE - 1); +@@ -448,7 +459,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + err = grub_disk_read_small (disk, start_sector, + offset + pos, len, buf); + if (err) +- return err; ++ goto error; + buf = (char *) buf + len; + size -= len; + offset += len; +@@ -461,7 +472,6 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + { + char *data = NULL; + grub_disk_addr_t agglomerate; +- grub_err_t err; + + /* agglomerate read until we find a first cached entry. */ + for (agglomerate = 0; agglomerate +@@ -497,7 +507,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + - disk->log_sector_size), + buf); + if (err) +- return err; ++ goto error; + + for (i = 0; i < agglomerate; i ++) + grub_disk_cache_store (disk->dev->id, disk->id, +@@ -531,13 +541,16 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + /* And now read the last part. */ + if (size) + { +- grub_err_t err; + err = grub_disk_read_small (disk, sector, 0, size, buf); + if (err) +- return err; ++ goto error; + } + +- return grub_errno; ++ err = grub_errno; ++ ++ error: ++ read_recursion_depth--; ++ return err; + } + + grub_uint64_t +diff --git a/include/grub/err.h b/include/grub/err.h +index 29f1a73c5..7530f58b2 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -74,7 +74,8 @@ typedef enum + GRUB_ERR_EOF, + GRUB_ERR_BAD_SIGNATURE, + GRUB_ERR_BAD_FIRMWARE, +- GRUB_ERR_STILL_REFERENCED ++ GRUB_ERR_STILL_REFERENCED, ++ GRUB_ERR_RECURSION_DEPTH + } + grub_err_t; + diff --git a/0315-kern-partition-Limit-recursion-in-part_iterate.patch b/0315-kern-partition-Limit-recursion-in-part_iterate.patch new file mode 100644 index 00000000..f51ff967 --- /dev/null +++ b/0315-kern-partition-Limit-recursion-in-part_iterate.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 16 Nov 2024 21:24:19 +0000 +Subject: [PATCH] kern/partition: Limit recursion in part_iterate() + +The part_iterate() is used by grub_partition_iterate() as a callback in +the partition iterate functions. However, part_iterate() may also call +the partition iterate functions which may lead to recursion. Fix potential +issue by limiting the recursion depth. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index edad9f9e4..704512a20 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -28,6 +28,9 @@ + + grub_partition_map_t grub_partition_map_list; + ++#define MAX_RECURSION_DEPTH 32 ++static unsigned int recursion_depth = 0; ++ + /* + * Checks that disk->partition contains part. This function assumes that the + * start of part is relative to the start of disk->partition. Returns 1 if +@@ -208,7 +211,12 @@ part_iterate (grub_disk_t dsk, const grub_partition_t partition, void *data) + FOR_PARTITION_MAPS(partmap) + { + grub_err_t err; +- err = partmap->iterate (dsk, part_iterate, ctx); ++ recursion_depth++; ++ if (recursion_depth <= MAX_RECURSION_DEPTH) ++ err = partmap->iterate (dsk, part_iterate, ctx); ++ else ++ err = grub_error (GRUB_ERR_RECURSION_DEPTH, "maximum recursion depth exceeded"); ++ recursion_depth--; + if (err) + grub_errno = GRUB_ERR_NONE; + if (ctx->ret) diff --git a/0316-script-execute-Limit-the-recursion-depth.patch b/0316-script-execute-Limit-the-recursion-depth.patch new file mode 100644 index 00000000..6bf1d092 --- /dev/null +++ b/0316-script-execute-Limit-the-recursion-depth.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 19:04:13 +0100 +Subject: [PATCH] script/execute: Limit the recursion depth + +If unbounded recursion is allowed it becomes possible to collide the +stack with the heap. As UEFI firmware often lacks guard pages this +becomes an exploitable issue as it is possible in some cases to do +a controlled overwrite of a section of this heap region with +arbitrary data. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index c19b4bf70..7ed3a1a03 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -36,10 +36,18 @@ + is sizeof (int) * 3, and one extra for a possible -ve sign. */ + #define ERRNO_DIGITS_MAX (sizeof (int) * 3 + 1) + ++/* ++ * A limit on recursion, to avoid colliding with the heap. UEFI defines a baseline ++ * stack size of 128 KiB. So, assuming at most 1-2 KiB per iteration this should ++ * keep us safe. ++ */ ++#define MAX_RECURSION_DEPTH 64 ++ + static unsigned long is_continue; + static unsigned long active_loops; + static unsigned long active_breaks; + static unsigned long function_return; ++static unsigned long recursion_depth; + + #define GRUB_SCRIPT_SCOPE_MALLOCED 1 + #define GRUB_SCRIPT_SCOPE_ARGS_MALLOCED 2 +@@ -850,7 +858,13 @@ grub_script_execute_cmd (struct grub_script_cmd *cmd) + if (cmd == 0) + return 0; + ++ recursion_depth++; ++ ++ if (recursion_depth >= MAX_RECURSION_DEPTH) ++ return grub_error (GRUB_ERR_RECURSION_DEPTH, N_("maximum recursion depth exceeded")); ++ + ret = cmd->exec (cmd); ++ recursion_depth--; + + grub_snprintf (errnobuf, sizeof (errnobuf), "%d", ret); + grub_env_set ("?", errnobuf); diff --git a/0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch b/0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch new file mode 100644 index 00000000..c3f5636c --- /dev/null +++ b/0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:27:10 -0600 +Subject: [PATCH] net: Unregister net_default_ip and net_default_mac variables + hooks on unload + +The net module is a dependency of normal. So, it shouldn't be possible +to unload the net. Though unregister variables hooks as a precaution. +It also gets in line with unregistering the other net module hooks. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index fdec64d55..9959a2ae8 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -2221,6 +2221,8 @@ GRUB_MOD_FINI(net) + + grub_register_variable_hook ("net_default_server", 0, 0); + grub_register_variable_hook ("pxe_default_server", 0, 0); ++ grub_register_variable_hook ("net_default_ip", 0, 0); ++ grub_register_variable_hook ("net_default_mac", 0, 0); + + grub_bootp_fini (); + grub_dns_fini (); diff --git a/0318-net-Remove-variables-hooks-when-interface-is-unregis.patch b/0318-net-Remove-variables-hooks-when-interface-is-unregis.patch new file mode 100644 index 00000000..c7b25c19 --- /dev/null +++ b/0318-net-Remove-variables-hooks-when-interface-is-unregis.patch @@ -0,0 +1,84 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:42:44 -0600 +Subject: [PATCH] net: Remove variables hooks when interface is unregisted + +The grub_net_network_level_interface_unregister(), previously +implemented in a header, did not remove the variables hooks that +were registered in grub_net_network_level_interface_register(). +Fix this by implementing the same logic used to register the +variables and move the function into the grub-core/net/net.c. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 33 +++++++++++++++++++++++++++++++++ + include/grub/net.h | 11 +---------- + 2 files changed, 34 insertions(+), 10 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 9959a2ae8..22d5cc3ba 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -1066,6 +1066,39 @@ grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter, + return 0; + } + ++void ++grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) ++{ ++ char *name; ++ ++ { ++ char buf[GRUB_NET_MAX_STR_HWADDR_LEN]; ++ ++ grub_net_hwaddr_to_str (&inter->hwaddress, buf); ++ name = grub_xasprintf ("net_%s_mac", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ { ++ char buf[GRUB_NET_MAX_STR_ADDR_LEN]; ++ ++ grub_net_addr_to_str (&inter->address, buf); ++ name = grub_xasprintf ("net_%s_ip", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ inter->card->num_ifaces--; ++ *inter->prev = inter->next; ++ if (inter->next) ++ inter->next->prev = inter->prev; ++ inter->next = 0; ++ inter->prev = 0; ++} ++ + grub_err_t + grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter, + int mask) +diff --git a/include/grub/net.h b/include/grub/net.h +index 868c9a2ef..273afbddf 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -625,16 +625,7 @@ void grub_bootp_fini (void); + void grub_dns_init (void); + void grub_dns_fini (void); + +-static inline void +-grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) +-{ +- inter->card->num_ifaces--; +- *inter->prev = inter->next; +- if (inter->next) +- inter->next->prev = inter->prev; +- inter->next = 0; +- inter->prev = 0; +-} ++void grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter); + + void + grub_net_tcp_retransmit (void); diff --git a/0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch b/0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch new file mode 100644 index 00000000..d0830c83 --- /dev/null +++ b/0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch @@ -0,0 +1,79 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 16:38:44 -0600 +Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file() + +The function included a call to grub_strcpy() which copied data from an +environment variable to a buffer allocated in grub_cmd_normal(). The +grub_cmd_normal() didn't consider the length of the environment variable. +So, the copy operation could exceed the allocation and lead to an OOB +write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and +pass the underlying buffers size to the grub_net_search_config_file(). + +Fixes: CVE-2025-0624 + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 7 ++++--- + grub-core/normal/main.c | 2 +- + include/grub/net.h | 2 +- + 3 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 22d5cc3ba..6c8dfcba2 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -2023,14 +2023,15 @@ grub_config_search_through (char *config, char *suffix, + } + + grub_err_t +-grub_net_search_config_file (char *config) ++grub_net_search_config_file (char *config, grub_size_t config_buf_len) + { +- grub_size_t config_len; ++ grub_size_t config_len, suffix_len; + char *suffix; + + config_len = grub_strlen (config); + config[config_len] = '-'; + suffix = config + config_len + 1; ++ suffix_len = config_buf_len - (config_len + 1); + + struct grub_net_network_level_interface *inf; + FOR_NET_NETWORK_LEVEL_INTERFACES (inf) +@@ -2056,7 +2057,7 @@ grub_net_search_config_file (char *config) + + if (client_uuid) + { +- grub_strcpy (suffix, client_uuid); ++ grub_strlcpy (suffix, client_uuid, suffix_len); + if (grub_config_search_through (config, suffix, 1, 0) == 0) + return GRUB_ERR_NONE; + } +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 86ffb388d..cad840e06 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -360,7 +360,7 @@ grub_try_normal_prefix (const char *prefix) + return err; + + grub_snprintf (config, config_len, "%s/grub.cfg", prefix); +- err = grub_net_search_config_file (config); ++ err = grub_net_search_config_file (config, config_len); + } + + if (err != GRUB_ERR_NONE) +diff --git a/include/grub/net.h b/include/grub/net.h +index 273afbddf..d280acd72 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -655,7 +655,7 @@ void + grub_net_remove_dns_server (const struct grub_net_network_level_address *s); + + grub_err_t +-grub_net_search_config_file (char *config); ++grub_net_search_config_file (char *config, grub_size_t config_buf_len); + + extern char *grub_net_default_server; + diff --git a/0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch b/0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch new file mode 100644 index 00000000..91b857d8 --- /dev/null +++ b/0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch @@ -0,0 +1,115 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 17:32:34 +0100 +Subject: [PATCH] net/tftp: Fix stack buffer overflow in tftp_open() + +An overly long filename can be passed to tftp_open() which would cause +grub_normalize_filename() to write out of bounds. + +Fixed by adding an extra argument to grub_normalize_filename() for the +space available, making it act closer to a strlcpy(). As several fixed +strings are strcpy()'d after into the same buffer, their total length is +checked to see if they exceed the remaining space in the buffer. If so, +return an error. + +On the occasion simplify code a bit by removing unneeded rrqlen zeroing. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/tftp.c | 38 ++++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index f300a9d40..3d96e50f4 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -266,17 +266,19 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), + * forward slashes to a single forward slash. + */ + static void +-grub_normalize_filename (char *normalized, const char *filename) ++grub_normalize_filename (char *normalized, const char *filename, int c) + { + char *dest = normalized; + const char *src = filename; + +- while (*src != '\0') ++ while (*src != '\0' && c > 0) + { + if (src[0] == '/' && src[1] == '/') + src++; +- else ++ else { ++ c--; + *dest++ = *src++; ++ } + } + *dest = '\0'; + } +@@ -287,7 +289,7 @@ tftp_open (struct grub_file *file, const char *filename) + struct tftphdr *tftph; + char *rrq; + int i; +- int rrqlen; ++ int rrqlen, rrqsize; + int hdrlen; + grub_uint8_t open_data[1500]; + struct grub_net_buff nb; +@@ -315,37 +317,45 @@ tftp_open (struct grub_file *file, const char *filename) + + tftph = (struct tftphdr *) nb.data; + +- rrq = (char *) tftph->u.rrq; +- rrqlen = 0; +- + tftph->opcode = grub_cpu_to_be16_compile_time (TFTP_RRQ); + ++ rrq = (char *) tftph->u.rrq; ++ rrqsize = sizeof (tftph->u.rrq); ++ + /* + * Copy and normalize the filename to work-around issues on some TFTP + * servers when file names are being matched for remapping. + */ +- grub_normalize_filename (rrq, filename); +- rrqlen += grub_strlen (rrq) + 1; ++ grub_normalize_filename (rrq, filename, rrqsize); ++ ++ rrqlen = grub_strlen (rrq) + 1; + rrq += grub_strlen (rrq) + 1; + +- grub_strcpy (rrq, "octet"); ++ /* Verify there is enough space for the remaining components. */ + rrqlen += grub_strlen ("octet") + 1; ++ rrqlen += grub_strlen ("blksize") + 1; ++ rrqlen += grub_strlen ("1024") + 1; ++ rrqlen += grub_strlen ("tsize") + 1; ++ rrqlen += grub_strlen ("0") + 1; ++ ++ if (rrqlen >= rrqsize) { ++ grub_free (data); ++ return grub_error (GRUB_ERR_BAD_FILENAME, N_("filename too long")); ++ } ++ ++ grub_strcpy (rrq, "octet"); + rrq += grub_strlen ("octet") + 1; + + grub_strcpy (rrq, "blksize"); +- rrqlen += grub_strlen ("blksize") + 1; + rrq += grub_strlen ("blksize") + 1; + + grub_strcpy (rrq, "1024"); +- rrqlen += grub_strlen ("1024") + 1; + rrq += grub_strlen ("1024") + 1; + + grub_strcpy (rrq, "tsize"); +- rrqlen += grub_strlen ("tsize") + 1; + rrq += grub_strlen ("tsize") + 1; + + grub_strcpy (rrq, "0"); +- rrqlen += grub_strlen ("0") + 1; + rrq += grub_strlen ("0") + 1; + hdrlen = sizeof (tftph->opcode) + rrqlen; + diff --git a/0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch b/0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch new file mode 100644 index 00000000..848d527f --- /dev/null +++ b/0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Fri, 8 Mar 2024 22:47:20 +1100 +Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in + JPEG + +Otherwise a subsequent header could change the height and width +allowing future OOB writes. + +Fixes: CVE-2024-45774 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/video/readers/jpeg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c +index ae634fd41..631a89356 100644 +--- a/grub-core/video/readers/jpeg.c ++++ b/grub-core/video/readers/jpeg.c +@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) + if (grub_errno != GRUB_ERR_NONE) + return grub_errno; + ++ if (data->image_height != 0 || data->image_width != 0) ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "jpeg: cannot have duplicate SOF0 markers"); ++ + if (grub_jpeg_get_byte (data) != 8) + return grub_error (GRUB_ERR_BAD_FILE_TYPE, + "jpeg: only 8-bit precision is supported"); diff --git a/0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch b/0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch new file mode 100644 index 00000000..1fee4bf0 --- /dev/null +++ b/0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch @@ -0,0 +1,138 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 16:41:57 -0600 +Subject: [PATCH] kern/dl: Fix for an integer overflow in grub_dl_ref() + +It was possible to overflow the value of mod->ref_count, a signed +integer, by repeatedly invoking insmod on an already loaded module. +This led to a use-after-free. As once ref_count was overflowed it became +possible to unload the module while there was still references to it. + +This resolves the issue by using grub_add() to check if the ref_count +will overflow and then stops further increments. Further changes were +also made to grub_dl_unref() to check for the underflow condition and +the reference count was changed to an unsigned 64-bit integer. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 2 +- + grub-core/kern/dl.c | 17 ++++++++++++----- + include/grub/dl.h | 8 ++++---- + util/misc.c | 4 ++-- + 4 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2bd3ac76f..2001043cf 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -167,7 +167,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), + { + grub_dl_dep_t dep; + +- grub_printf ("%s\t%d\t\t", mod->name, mod->ref_count); ++ grub_printf ("%s\t%" PRIuGRUB_UINT64_T "\t\t", mod->name, mod->ref_count); + for (dep = mod->dep; dep; dep = dep->next) + { + if (dep != mod->dep) +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 2eaef7150..fe7c3b940 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + + /* Platforms where modules are in a readonly area of memory. */ +@@ -613,7 +614,7 @@ grub_dl_resolve_dependencies (grub_dl_t mod, Elf_Ehdr *e) + return GRUB_ERR_NONE; + } + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -624,10 +625,13 @@ grub_dl_ref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_ref (dep->mod); + +- return ++mod->ref_count; ++ if (grub_add (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count overflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -638,10 +642,13 @@ grub_dl_unref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_unref (dep->mod); + +- return --mod->ref_count; ++ if (grub_sub (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count underflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_ref_count (grub_dl_t mod) + { + if (mod == NULL) +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 1e1262a28..055bb564e 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -177,7 +177,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t; + struct grub_dl + { + char *name; +- int ref_count; ++ grub_uint64_t ref_count; + int persistent; + grub_dl_dep_t dep; + grub_dl_segment_t segment; +@@ -206,9 +206,9 @@ grub_dl_t EXPORT_FUNC(grub_dl_load) (const char *name); + grub_dl_t grub_dl_load_core (void *addr, grub_size_t size); + grub_dl_t EXPORT_FUNC(grub_dl_load_core_noinit) (void *addr, grub_size_t size); + int EXPORT_FUNC(grub_dl_unload) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); + + extern grub_dl_t EXPORT_VAR(grub_dl_head); + +diff --git a/util/misc.c b/util/misc.c +index d545212d9..0f928e5b4 100644 +--- a/util/misc.c ++++ b/util/misc.c +@@ -190,14 +190,14 @@ grub_xputs_real (const char *str) + + void (*grub_xputs) (const char *str) = grub_xputs_real; + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + (void) mod; + return 0; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + (void) mod; diff --git a/0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch b/0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch new file mode 100644 index 00000000..213ef199 --- /dev/null +++ b/0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 17:01:26 -0600 +Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in + grub_dl_relocate_symbols() + +The grub_dl_relocate_symbols() iterates through the sections in +an ELF looking for relocation sections. According to the spec [1] +the SHF_INFO_LINK flag should be set if the sh_info field is meant +to be a section index. + +[1] https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/dl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index fe7c3b940..cb49bdc4b 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -681,6 +681,9 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + grub_dl_segment_t seg; + grub_err_t err; + ++ if (!(s->sh_flags & SHF_INFO_LINK)) ++ continue; ++ + seg = grub_dl_find_segment(mod, s->sh_info); + if (!seg) + continue; diff --git a/0324-commands-extcmd-Missing-check-for-failed-allocation.patch b/0324-commands-extcmd-Missing-check-for-failed-allocation.patch new file mode 100644 index 00000000..44e8c915 --- /dev/null +++ b/0324-commands-extcmd-Missing-check-for-failed-allocation.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:55 +0000 +Subject: [PATCH] commands/extcmd: Missing check for failed allocation + +The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate +a grub_arg_list struct but it does not verify the allocation was successful. +In case of failed allocation the NULL state pointer can be accessed in +parse_option() through grub_arg_parse() which may lead to a security issue. + +Fixes: CVE-2024-45775 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/commands/extcmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c +index 90a5ca24a..c236be13a 100644 +--- a/grub-core/commands/extcmd.c ++++ b/grub-core/commands/extcmd.c +@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args, + } + + state = grub_arg_list_alloc (ext, argc, args); ++ if (state == NULL) ++ return grub_errno; ++ + if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc)) + { + context.state = state; diff --git a/0325-commands-ls-Fix-NULL-dereference.patch b/0325-commands-ls-Fix-NULL-dereference.patch new file mode 100644 index 00000000..c58177b7 --- /dev/null +++ b/0325-commands-ls-Fix-NULL-dereference.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 11:08:23 +0100 +Subject: [PATCH] commands/ls: Fix NULL dereference + +The grub_strrchr() may return NULL when the dirname do not contain "/". +This can happen on broken filesystems. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/ls.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c +index 6a1c7f5d3..f660946a2 100644 +--- a/grub-core/commands/ls.c ++++ b/grub-core/commands/ls.c +@@ -241,7 +241,11 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human) + + grub_file_close (file); + +- p = grub_strrchr (dirname, '/') + 1; ++ p = grub_strrchr (dirname, '/'); ++ if (p == NULL) ++ goto fail; ++ ++p; ++ + ctx.dirname = grub_strndup (dirname, p - dirname); + if (ctx.dirname == NULL) + goto fail; diff --git a/0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch b/0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch new file mode 100644 index 00000000..8305f909 --- /dev/null +++ b/0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 19:24:29 +0000 +Subject: [PATCH] commands/pgp: Unregister the "check_signatures" hooks on + module unload + +If the hooks are not removed they can be called after the module has +been unloaded leading to an use-after-free. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/pgp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c +index 847a5046a..fa3ef5c75 100644 +--- a/grub-core/commands/pgp.c ++++ b/grub-core/commands/pgp.c +@@ -982,6 +982,8 @@ GRUB_MOD_INIT(pgp) + + GRUB_MOD_FINI(pgp) + { ++ grub_register_variable_hook ("check_signatures", NULL, NULL); ++ grub_env_unset ("check_signatures"); + grub_verifier_unregister (&grub_pubkey_verifier); + grub_unregister_extcmd (cmd); + grub_unregister_extcmd (cmd_trust); diff --git a/0327-normal-Remove-variables-hooks-on-module-unload.patch b/0327-normal-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 00000000..d730194a --- /dev/null +++ b/0327-normal-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:46:55 +0000 +Subject: [PATCH] normal: Remove variables hooks on module unload + +The normal module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload normal module now but fix the +issues for completeness. + +On the occasion replace 0s with NULLs for "pager" variable +hooks unregister. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/normal/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index cad840e06..dd20e5129 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -690,7 +690,9 @@ GRUB_MOD_FINI(normal) + grub_xputs = grub_xputs_saved; + + grub_set_history (0); +- grub_register_variable_hook ("pager", 0, 0); ++ grub_register_variable_hook ("pager", NULL, NULL); ++ grub_register_variable_hook ("color_normal", NULL, NULL); ++ grub_register_variable_hook ("color_highlight", NULL, NULL); + grub_fs_autoload_hook = 0; + grub_unregister_command (cmd_clear); + } diff --git a/0328-gettext-Remove-variables-hooks-on-module-unload.patch b/0328-gettext-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 00000000..9cc952ee --- /dev/null +++ b/0328-gettext-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:52:06 +0000 +Subject: [PATCH] gettext: Remove variables hooks on module unload + +The gettext module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload gettext module because normal +module depends on it. Though fix the issues for completeness. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/gettext/gettext.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 631af7a94..465143cb6 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -542,6 +542,10 @@ GRUB_MOD_INIT (gettext) + + GRUB_MOD_FINI (gettext) + { ++ grub_register_variable_hook ("locale_dir", NULL, NULL); ++ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); ++ grub_register_variable_hook ("lang", NULL, NULL); ++ + grub_gettext_delete_list (&main_context); + grub_gettext_delete_list (&secondary_context); + diff --git a/0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch b/0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch new file mode 100644 index 00000000..d8db5c15 --- /dev/null +++ b/0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:56 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read + +Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may +overflow leading to subsequent OOB write or read. This patch fixes the +issue by replacing grub_zalloc() and explicit multiplication with +grub_calloc() which does the same thing in safe manner. + +Fixes: CVE-2024-45776 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 465143cb6..c17040269 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx, + for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log; + ctx->grub_gettext_max_log++); + +- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max +- * sizeof (ctx->grub_gettext_msg_list[0])); ++ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max, ++ sizeof (ctx->grub_gettext_msg_list[0])); + if (!ctx->grub_gettext_msg_list) + { + grub_file_close (fd); diff --git a/0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch b/0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 00000000..5b22d585 --- /dev/null +++ b/0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,53 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:57 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write + +The size calculation of the translation buffer in +grub_gettext_getstr_from_position() may overflow +to 0 leading to heap OOB write. This patch fixes +the issue by using grub_add() and checking for +an overflow. + +Fixes: CVE-2024-45777 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index c17040269..fffe3a054 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + char *translation; + struct string_descriptor desc; + grub_err_t err; ++ grub_size_t alloc_sz; + + internal_position = (off + position * sizeof (desc)); + +@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + length = grub_cpu_to_le32 (desc.length); + offset = grub_cpu_to_le32 (desc.offset); + +- translation = grub_malloc (length + 1); ++ if (grub_add (length, 1, &alloc_sz)) ++ return NULL; ++ ++ translation = grub_malloc (alloc_sz); + if (!translation) + return NULL; + diff --git a/0331-commands-read-Fix-an-integer-overflow-when-supplying.patch b/0331-commands-read-Fix-an-integer-overflow-when-supplying.patch new file mode 100644 index 00000000..33ea08dd --- /dev/null +++ b/0331-commands-read-Fix-an-integer-overflow-when-supplying.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jonathan Bar Or +Date: Thu, 23 Jan 2025 19:17:05 +0100 +Subject: [PATCH] commands/read: Fix an integer overflow when supplying more + than 2^31 characters + +The grub_getline() function currently has a signed integer variable "i" +that can be overflown when user supplies more than 2^31 characters. +It results in a memory corruption of the allocated line buffer as well +as supplying large negative values to grub_realloc(). + +Fixes: CVE-2025-0690 + +Reported-by: Jonathan Bar Or +Signed-off-by: Jonathan Bar Or +Reviewed-by: Daniel Kiper +--- + grub-core/commands/read.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c +index 597c90706..8d72e45c9 100644 +--- a/grub-core/commands/read.c ++++ b/grub-core/commands/read.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -37,13 +38,14 @@ static const struct grub_arg_option options[] = + static char * + grub_getline (int silent) + { +- int i; ++ grub_size_t i; + char *line; + char *tmp; + int c; ++ grub_size_t alloc_size; + + i = 0; +- line = grub_malloc (1 + i + sizeof('\0')); ++ line = grub_malloc (1 + sizeof('\0')); + if (! line) + return NULL; + +@@ -59,8 +61,17 @@ grub_getline (int silent) + line[i] = (char) c; + if (!silent) + grub_printf ("%c", c); +- i++; +- tmp = grub_realloc (line, 1 + i + sizeof('\0')); ++ if (grub_add (i, 1, &i)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ if (grub_add (i, 1 + sizeof('\0'), &alloc_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ tmp = grub_realloc (line, alloc_size); + if (! tmp) + { + grub_free (line); diff --git a/0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch b/0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch new file mode 100644 index 00000000..3dc101b1 --- /dev/null +++ b/0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:41 +0000 +Subject: [PATCH] commands/test: Stack overflow due to unlimited recursion + depth + +The test_parse() evaluates test expression recursively. Due to lack of +recursion depth check a specially crafted expression may cause a stack +overflow. The recursion is only triggered by the parentheses usage and +it can be unlimited. However, sensible expressions are unlikely to +contain more than a few parentheses. So, this patch limits the recursion +depth to 100, which should be sufficient. + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/commands/test.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/test.c b/grub-core/commands/test.c +index 62d3fb398..b585c3d70 100644 +--- a/grub-core/commands/test.c ++++ b/grub-core/commands/test.c +@@ -29,6 +29,9 @@ + + GRUB_MOD_LICENSE ("GPLv3+"); + ++/* Set a limit on recursion to avoid stack overflow. */ ++#define MAX_TEST_RECURSION_DEPTH 100 ++ + /* A simple implementation for signed numbers. */ + static int + grub_strtosl (char *arg, const char ** const end, int base) +@@ -150,7 +153,7 @@ get_fileinfo (char *path, struct test_parse_ctx *ctx) + + /* Parse a test expression starting from *argn. */ + static int +-test_parse (char **args, int *argn, int argc) ++test_parse (char **args, int *argn, int argc, int *depth) + { + struct test_parse_ctx ctx = { + .and = 1, +@@ -387,13 +390,24 @@ test_parse (char **args, int *argn, int argc) + if (grub_strcmp (args[*argn], ")") == 0) + { + (*argn)++; ++ if (*depth > 0) ++ (*depth)--; ++ + return ctx.or || ctx.and; + } + /* Recursively invoke if parenthesis. */ + if (grub_strcmp (args[*argn], "(") == 0) + { + (*argn)++; +- update_val (test_parse (args, argn, argc), &ctx); ++ ++ if (++(*depth) > MAX_TEST_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("max recursion depth exceeded")); ++ depth--; ++ return ctx.or || ctx.and; ++ } ++ ++ update_val (test_parse (args, argn, argc, depth), &ctx); + continue; + } + +@@ -428,11 +442,12 @@ grub_cmd_test (grub_command_t cmd __attribute__ ((unused)), + int argc, char **args) + { + int argn = 0; ++ int depth = 0; + + if (argc >= 1 && grub_strcmp (args[argc - 1], "]") == 0) + argc--; + +- return test_parse (args, &argn, argc) ? GRUB_ERR_NONE ++ return test_parse (args, &argn, argc, &depth) ? GRUB_ERR_NONE + : grub_error (GRUB_ERR_TEST_FAILURE, N_("false")); + } + diff --git a/0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch b/0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch new file mode 100644 index 00000000..a9991461 --- /dev/null +++ b/0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 20:29:39 +0100 +Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode + +The dump enables a user to read memory which should not be possible +in lockdown mode. + +Fixes: CVE-2025-1118 + +Reported-by: B Horn +Reported-by: Jonathan Bar Or +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2001043cf..9efb7718c 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -215,8 +215,8 @@ GRUB_MOD_INIT(minicmd) + grub_register_command ("help", grub_mini_cmd_help, + 0, N_("Show this message.")); + cmd_dump = +- grub_register_command ("dump", grub_mini_cmd_dump, +- N_("ADDR [SIZE]"), N_("Show memory contents.")); ++ grub_register_command_lockdown ("dump", grub_mini_cmd_dump, ++ N_("ADDR [SIZE]"), N_("Show memory contents.")); + cmd_rmmod = + grub_register_command ("rmmod", grub_mini_cmd_rmmod, + N_("MODULE"), N_("Remove a module.")); diff --git a/0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch b/0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch new file mode 100644 index 00000000..e787d6f7 --- /dev/null +++ b/0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 17:12:29 -0600 +Subject: [PATCH] commands/memrw: Disable memory reading in lockdown mode + +With the rest of module being blocked in lockdown mode it does not make +a lot of sense to leave memory reading enabled. This also goes in par +with disabling the dump command. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/memrw.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index 39cf3a06d..9d8a54a4b 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -126,17 +126,20 @@ GRUB_MOD_INIT(memrw) + return; + + cmd_read_byte = +- grub_register_extcmd ("read_byte", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 8-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_byte", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 8-bit value from ADDR."), ++ options); + cmd_read_word = +- grub_register_extcmd ("read_word", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 16-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_word", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 16-bit value from ADDR."), ++ options); + cmd_read_dword = +- grub_register_extcmd ("read_dword", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 32-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_dword", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 32-bit value from ADDR."), ++ options); + cmd_write_byte = + grub_register_command_lockdown ("write_byte", grub_cmd_write, + N_("ADDR VALUE [MASK]"), diff --git a/0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch b/0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch new file mode 100644 index 00000000..ae523f80 --- /dev/null +++ b/0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 19 Apr 2024 22:31:45 +0100 +Subject: [PATCH] commands/hexdump: Disable memory reading in lockdown mode + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/hexdump.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c +index eaa12465b..d6f61d98a 100644 +--- a/grub-core/commands/hexdump.c ++++ b/grub-core/commands/hexdump.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -51,7 +52,11 @@ grub_cmd_hexdump (grub_extcmd_context_t ctxt, int argc, char **args) + length = (state[1].set) ? grub_strtoul (state[1].arg, 0, 0) : 256; + + if (!grub_strcmp (args[0], "(mem)")) +- hexdump (skip, (char *) (grub_addr_t) skip, length); ++ { ++ if (grub_is_lockdown() == GRUB_LOCKDOWN_ENABLED) ++ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("memory reading is disabled in lockdown mode")); ++ hexdump (skip, (char *) (grub_addr_t) skip, length); ++ } + else if ((args[0][0] == '(') && (args[0][namelen - 1] == ')')) + { + grub_disk_t disk; diff --git a/0336-fs-bfs-Disable-under-lockdown.patch b/0336-fs-bfs-Disable-under-lockdown.patch new file mode 100644 index 00000000..c8364628 --- /dev/null +++ b/0336-fs-bfs-Disable-under-lockdown.patch @@ -0,0 +1,52 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 15:59:43 +1100 +Subject: [PATCH] fs/bfs: Disable under lockdown + +The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown. +This will also disable the AFS. + +Fixes: CVE-2024-45778 +Fixes: CVE-2024-45779 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/bfs.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index f37b16895..c92fd7916 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1106,8 +1107,11 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); +- grub_bfs_fs.mod = mod; +- grub_fs_register (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_bfs_fs.mod = mod; ++ grub_fs_register (&grub_bfs_fs); ++ } + } + + #ifdef MODE_AFS +@@ -1116,5 +1120,6 @@ GRUB_MOD_FINI (afs) + GRUB_MOD_FINI (bfs) + #endif + { +- grub_fs_unregister (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_bfs_fs); + } diff --git a/0337-fs-Disable-many-filesystems-under-lockdown.patch b/0337-fs-Disable-many-filesystems-under-lockdown.patch new file mode 100644 index 00000000..edd6c407 --- /dev/null +++ b/0337-fs-Disable-many-filesystems-under-lockdown.patch @@ -0,0 +1,391 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 16:20:45 +1100 +Subject: [PATCH] fs: Disable many filesystems under lockdown + +The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat, +hfsplus, iso9660, squash4, tar, xfs and zfs. + +The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were +reported by Jonathan Bar Or . + +Fixes: CVE-2025-0677 +Fixes: CVE-2025-0684 +Fixes: CVE-2025-0685 +Fixes: CVE-2025-0686 +Fixes: CVE-2025-0689 + +Suggested-by: Daniel Axtens +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 11 ++++++++--- + grub-core/fs/cbfs.c | 11 ++++++++--- + grub-core/fs/jfs.c | 11 ++++++++--- + grub-core/fs/minix.c | 11 ++++++++--- + grub-core/fs/nilfs2.c | 11 ++++++++--- + grub-core/fs/ntfs.c | 11 ++++++++--- + grub-core/fs/reiserfs.c | 11 ++++++++--- + grub-core/fs/romfs.c | 11 ++++++++--- + grub-core/fs/sfs.c | 11 ++++++++--- + grub-core/fs/udf.c | 11 ++++++++--- + grub-core/fs/ufs.c | 11 ++++++++--- + 11 files changed, 88 insertions(+), 33 deletions(-) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index 9b0afb954..520a001c7 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -703,12 +704,16 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { +- grub_affs_fs.mod = mod; +- grub_fs_register (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_affs_fs.mod = mod; ++ grub_fs_register (&grub_affs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(affs) + { +- grub_fs_unregister (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_affs_fs); + } +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 2332745fe..b62c8777c 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -390,13 +391,17 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif +- grub_cbfs_fs.mod = mod; +- grub_fs_register (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_cbfs_fs.mod = mod; ++ grub_fs_register (&grub_cbfs_fs); ++ } + } + + GRUB_MOD_FINI (cbfs) + { +- grub_fs_unregister (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_cbfs_fs); + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + fini_cbfsdisk (); + #endif +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index b0283ac00..ab175c7f1 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1005,12 +1006,16 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { +- grub_jfs_fs.mod = mod; +- grub_fs_register (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_jfs_fs.mod = mod; ++ grub_fs_register (&grub_jfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(jfs) + { +- grub_fs_unregister (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_jfs_fs); + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index b7679c3e2..4440fcca8 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -734,8 +735,11 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { +- grub_minix_fs.mod = mod; +- grub_fs_register (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_minix_fs.mod = mod; ++ grub_fs_register (&grub_minix_fs); ++ } + my_mod = mod; + } + +@@ -757,5 +761,6 @@ GRUB_MOD_FINI(minix) + #endif + #endif + { +- grub_fs_unregister (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_minix_fs); + } +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index 4e1e71738..26e6077ff 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1231,12 +1232,16 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); +- grub_nilfs2_fs.mod = mod; +- grub_fs_register (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_nilfs2_fs.mod = mod; ++ grub_fs_register (&grub_nilfs2_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (nilfs2) + { +- grub_fs_unregister (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_nilfs2_fs); + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 4e144cc3c..e00349b1d 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1541,12 +1542,16 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { +- grub_ntfs_fs.mod = mod; +- grub_fs_register (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ntfs_fs.mod = mod; ++ grub_fs_register (&grub_ntfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (ntfs) + { +- grub_fs_unregister (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ntfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index e8b0b6383..ca47e0a43 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1407,12 +1408,16 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { +- grub_reiserfs_fs.mod = mod; +- grub_fs_register (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_reiserfs_fs.mod = mod; ++ grub_fs_register (&grub_reiserfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(reiserfs) + { +- grub_fs_unregister (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_reiserfs_fs); + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index 56b0b2b2f..eafab03b2 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -475,11 +476,15 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { +- grub_romfs_fs.mod = mod; +- grub_fs_register (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_romfs_fs.mod = mod; ++ grub_fs_register (&grub_romfs_fs); ++ } + } + + GRUB_MOD_FINI(romfs) + { +- grub_fs_unregister (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_romfs_fs); + } +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index f0d7cac43..88705b3a2 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -779,12 +780,16 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { +- grub_sfs_fs.mod = mod; +- grub_fs_register (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_sfs_fs.mod = mod; ++ grub_fs_register (&grub_sfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(sfs) + { +- grub_fs_unregister (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_sfs_fs); + } +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 8765c633c..3d5ee5af5 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -1455,12 +1456,16 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { +- grub_udf_fs.mod = mod; +- grub_fs_register (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_udf_fs.mod = mod; ++ grub_fs_register (&grub_udf_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (udf) + { +- grub_fs_unregister (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_udf_fs); + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index e82d9356d..8b5adbd48 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -899,8 +900,11 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { +- grub_ufs_fs.mod = mod; +- grub_fs_register (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ufs_fs.mod = mod; ++ grub_fs_register (&grub_ufs_fs); ++ } + my_mod = mod; + } + +@@ -914,6 +918,7 @@ GRUB_MOD_FINI(ufs1) + #endif + #endif + { +- grub_fs_unregister (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ufs_fs); + } + diff --git a/0338-disk-Use-safe-math-macros-to-prevent-overflows.patch b/0338-disk-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..db3d9371 --- /dev/null +++ b/0338-disk-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,543 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 11 Feb 2025 17:59:04 -0600 +Subject: [PATCH] disk: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/cryptodisk.c | 36 ++++++++++++++++++------ + grub-core/disk/diskfilter.c | 9 ++++-- + grub-core/disk/ieee1275/obdisk.c | 43 ++++++++++++++++++++++++---- + grub-core/disk/ieee1275/ofdisk.c | 60 ++++++++++++++++++++++++++++++++++------ + grub-core/disk/ldm.c | 36 ++++++++++++++++++++---- + grub-core/disk/luks2.c | 7 ++++- + grub-core/disk/memdisk.c | 7 ++++- + grub-core/disk/plainmount.c | 9 ++++-- + 8 files changed, 172 insertions(+), 35 deletions(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 06a42b2d7..872776010 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_UTIL + #include +@@ -1475,7 +1476,7 @@ static char * + luks_script_get (grub_size_t *sz) + { + grub_cryptodisk_t i; +- grub_size_t size = 0; ++ grub_size_t size = 0, mul; + char *ptr, *ret; + + *sz = 0; +@@ -1484,10 +1485,6 @@ luks_script_get (grub_size_t *sz) + if (grub_strcmp (i->modname, "luks") == 0 || + grub_strcmp (i->modname, "luks2") == 0) + { +- size += grub_strlen (i->modname); +- size += sizeof ("_mount"); +- size += grub_strlen (i->uuid); +- size += grub_strlen (i->cipher->cipher->name); + /* + * Add space in the line for (in order) spaces, cipher mode, cipher IV + * mode, sector offset, sector size and the trailing newline. This is +@@ -1495,14 +1492,35 @@ luks_script_get (grub_size_t *sz) + * in an earlier version of this code that are unaccounted for. It is + * left in the calculations in case it is needed. At worst, its short- + * lived wasted space. ++ * ++ * 60 = 5 + 5 + 8 + 20 + 6 + 1 + 15 + */ +- size += 5 + 5 + 8 + 20 + 6 + 1 + 15; ++ if (grub_add (size, grub_strlen (i->modname), &size) || ++ grub_add (size, sizeof ("_mount") + 60, &size) || ++ grub_add (size, grub_strlen (i->uuid), &size) || ++ grub_add (size, grub_strlen (i->cipher->cipher->name), &size) || ++ grub_mul (i->keysize, 2, &mul) || ++ grub_add (size, mul, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } + if (i->essiv_hash) +- size += grub_strlen (i->essiv_hash->name); +- size += i->keysize * 2; ++ { ++ if (grub_add (size, grub_strlen (i->essiv_hash->name), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } ++ } + } ++ if (grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } + +- ret = grub_malloc (size + 1); ++ ret = grub_malloc (size); + if (!ret) + return 0; + +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index c35ce8915..fef0b815a 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_UTIL + #include + #include +@@ -1041,7 +1042,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + { + struct grub_diskfilter_vg *array; + int i; +- grub_size_t j; ++ grub_size_t j, sz; + grub_uint64_t totsize; + struct grub_diskfilter_pv *pv; + grub_err_t err; +@@ -1142,7 +1143,11 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + } + array->lvs->vg = array; + +- array->lvs->idname = grub_malloc (sizeof ("mduuid/") + 2 * uuidlen); ++ if (grub_mul (uuidlen, 2, &sz) || ++ grub_add (sz, sizeof ("mduuid/"), &sz)) ++ goto fail; ++ ++ array->lvs->idname = grub_malloc (sz); + if (!array->lvs->idname) + goto fail; + +diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c +index cd923b90f..9d4c42665 100644 +--- a/grub-core/disk/ieee1275/obdisk.c ++++ b/grub-core/disk/ieee1275/obdisk.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -128,9 +129,17 @@ count_commas (const char *src) + static char * + decode_grub_devname (const char *name) + { +- char *devpath = grub_malloc (grub_strlen (name) + 1); ++ char *devpath; + char *p, c; ++ grub_size_t sz; + ++ if (grub_add (grub_strlen (name), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device name")); ++ return NULL; ++ } ++ ++ devpath = grub_malloc (sz); + if (devpath == NULL) + return NULL; + +@@ -156,12 +165,20 @@ static char * + encode_grub_devname (const char *path) + { + char *encoding, *optr; ++ grub_size_t sz; + + if (path == NULL) + return NULL; + +- encoding = grub_malloc (sizeof (IEEE1275_DEV) + count_commas (path) + +- grub_strlen (path) + 1); ++ if (grub_add (sizeof (IEEE1275_DEV) + 1, count_commas (path), &sz) || ++ grub_add (sz, grub_strlen (path), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining encoding size")); ++ grub_print_error (); ++ return NULL; ++ } ++ ++ encoding = grub_malloc (sz); + + if (encoding == NULL) + { +@@ -396,6 +413,14 @@ canonicalise_disk (const char *devname) + + real_unit_str_len = grub_strlen (op->name) + sizeof (IEEE1275_DISK_ALIAS) + + grub_strlen (real_unit_address); ++ if (grub_add (grub_strlen (op->name), sizeof (IEEE1275_DISK_ALIAS), &real_unit_str_len) || ++ grub_add (real_unit_str_len, grub_strlen (real_unit_address), &real_unit_str_len)) ++ { ++ grub_free (parent); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of canonical name")); ++ grub_print_error (); ++ return NULL; ++ } + + real_canon = grub_malloc (real_unit_str_len); + +@@ -413,6 +438,7 @@ canonicalise_disk (const char *devname) + static struct disk_dev * + add_canon_disk (const char *cname) + { ++ grub_size_t sz; + struct disk_dev *dev; + + dev = grub_zalloc (sizeof (struct disk_dev)); +@@ -428,13 +454,18 @@ add_canon_disk (const char *cname) + * arguments and allows a client program to open + * the entire (raw) disk. Any disk label is ignored. + */ +- dev->raw_name = grub_malloc (grub_strlen (cname) + sizeof (":nolabel")); ++ if (grub_add (grub_strlen (cname), sizeof (":nolabel"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while appending :nolabel to end of canonical name"); ++ goto failed; ++ } ++ ++ dev->raw_name = grub_malloc (sz); + + if (dev->raw_name == NULL) + goto failed; + +- grub_snprintf (dev->raw_name, grub_strlen (cname) + sizeof (":nolabel"), +- "%s:nolabel", cname); ++ grub_snprintf (dev->raw_name, sz, "%s:nolabel", cname); + } + + /* +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 57624fde5..6c628635f 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + static char *last_devpath; + static grub_ieee1275_ihandle_t last_ihandle; +@@ -81,6 +82,7 @@ ofdisk_hash_add_real (char *devpath) + struct ofdisk_hash_ent **head = &ofdisk_hash[ofdisk_hash_fn(devpath)]; + const char *iptr; + char *optr; ++ grub_size_t sz; + + p = grub_zalloc (sizeof (*p)); + if (!p) +@@ -88,8 +90,14 @@ ofdisk_hash_add_real (char *devpath) + + p->devpath = devpath; + +- p->grub_devpath = grub_malloc (sizeof ("ieee1275/") +- + 2 * grub_strlen (p->devpath)); ++ if (grub_mul (grub_strlen (p->devpath), 2, &sz) || ++ grub_add (sz, sizeof ("ieee1275/"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ p->grub_devpath = grub_malloc (sz); + + if (!p->grub_devpath) + { +@@ -99,7 +107,13 @@ ofdisk_hash_add_real (char *devpath) + + if (! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_NO_PARTITION_0)) + { +- p->open_path = grub_malloc (grub_strlen (p->devpath) + 3); ++ if (grub_add (grub_strlen (p->devpath), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of an open path")); ++ return NULL; ++ } ++ ++ p->open_path = grub_malloc (sz); + if (!p->open_path) + { + grub_free (p->grub_devpath); +@@ -225,7 +239,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + args; + char *buf, *bufptr; + unsigned i; +- ++ grub_size_t sz; + + RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle) + if (! ihandle) +@@ -246,7 +260,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + return; + } + +- buf = grub_malloc (grub_strlen (alias->path) + 32); ++ if (grub_add (grub_strlen (alias->path), 32, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for vscsi"); ++ grub_ieee1275_close (ihandle); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -290,9 +311,15 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + grub_uint64_t *table; + grub_uint16_t table_size; + grub_ieee1275_ihandle_t ihandle; ++ grub_size_t sz; + +- buf = grub_malloc (grub_strlen (alias->path) + +- sizeof ("/disk@7766554433221100")); ++ if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for sas_ioa"); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -432,9 +459,17 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, + static char * + compute_dev_path (const char *name) + { +- char *devpath = grub_malloc (grub_strlen (name) + 3); ++ char *devpath; + char *p, c; ++ grub_size_t sz; + ++ if (grub_add (grub_strlen (name), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ devpath = grub_malloc (sz); + if (!devpath) + return NULL; + +@@ -657,6 +692,7 @@ insert_bootpath (void) + char *bootpath; + grub_ssize_t bootpath_size; + char *type; ++ grub_size_t sz; + + if (grub_ieee1275_get_property_length (grub_ieee1275_chosen, "bootpath", + &bootpath_size) +@@ -667,7 +703,13 @@ insert_bootpath (void) + return; + } + +- bootpath = (char *) grub_malloc ((grub_size_t) bootpath_size + 64); ++ if (grub_add (bootpath_size, 64, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining bootpath size")); ++ return; ++ } ++ ++ bootpath = (char *) grub_malloc (sz); + if (! bootpath) + { + grub_print_error (); +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 34bfe6bd1..4101b15d8 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -220,6 +220,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -251,7 +252,13 @@ make_vg (grub_disk_t disk, + grub_free (pv); + goto fail2; + } +- pv->internal_id = grub_malloc (ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->internal_id = grub_malloc (sz); + if (!pv->internal_id) + { + grub_free (pv); +@@ -276,7 +283,15 @@ make_vg (grub_disk_t disk, + goto fail2; + } + pv->id.uuidlen = *ptr; +- pv->id.uuid = grub_malloc (pv->id.uuidlen + 1); ++ ++ if (grub_add (pv->id.uuidlen, 1, &sz)) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->id.uuid = grub_malloc (sz); + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +@@ -343,7 +358,13 @@ make_vg (grub_disk_t disk, + grub_free (lv); + goto fail2; + } +- lv->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (lv->segments); ++ grub_free (lv); ++ goto fail2; ++ } ++ lv->internal_id = grub_malloc (sz); + if (!lv->internal_id) + { + grub_free (lv); +@@ -455,6 +476,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -490,7 +512,12 @@ make_vg (grub_disk_t disk, + grub_free (comp); + goto fail2; + } +- comp->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (comp); ++ goto fail2; ++ } ++ comp->internal_id = grub_malloc (sz); + if (!comp->internal_id) + { + grub_free (comp); +@@ -640,7 +667,6 @@ make_vg (grub_disk_t disk, + if (lv->segments->node_alloc == lv->segments->node_count) + { + void *t; +- grub_size_t sz; + + if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || + grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) +diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c +index d5106402f..8036d76ff 100644 +--- a/grub-core/disk/luks2.c ++++ b/grub-core/disk/luks2.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -569,6 +570,7 @@ luks2_recover_key (grub_disk_t source, + gcry_err_code_t gcry_ret; + grub_json_t *json = NULL, keyslots; + grub_err_t ret; ++ grub_size_t sz; + + if (cargs->key_data == NULL || cargs->key_len == 0) + return grub_error (GRUB_ERR_BAD_ARGUMENT, "no key data"); +@@ -577,7 +579,10 @@ luks2_recover_key (grub_disk_t source, + if (ret) + return ret; + +- json_header = grub_zalloc (grub_be_to_cpu64 (header.hdr_size) - sizeof (header)); ++ if (grub_sub (grub_be_to_cpu64 (header.hdr_size), sizeof (header), &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while calculating json header size"); ++ ++ json_header = grub_zalloc (sz); + if (!json_header) + return GRUB_ERR_OUT_OF_MEMORY; + +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index 613779cf3..36de3bfab 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -96,7 +97,11 @@ GRUB_MOD_INIT(memdisk) + + grub_dprintf ("memdisk", "Found memdisk image at %p\n", memdisk_orig_addr); + +- memdisk_size = header->size - sizeof (struct grub_module_header); ++ if (grub_sub (header->size, sizeof (struct grub_module_header), &memdisk_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while obtaining memdisk size"); ++ return; ++ } + memdisk_addr = grub_malloc (memdisk_size); + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); +diff --git a/grub-core/disk/plainmount.c b/grub-core/disk/plainmount.c +index 47e64805f..21ec4072c 100644 +--- a/grub-core/disk/plainmount.c ++++ b/grub-core/disk/plainmount.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -126,7 +127,7 @@ plainmount_configure_password (grub_cryptodisk_t dev, const char *hash, + grub_uint8_t *derived_hash, *dh; + char *p; + unsigned int round, i, len, size; +- grub_size_t alloc_size; ++ grub_size_t alloc_size, sz; + grub_err_t err = GRUB_ERR_NONE; + + /* Support none (plain) hash */ +@@ -145,7 +146,11 @@ plainmount_configure_password (grub_cryptodisk_t dev, const char *hash, + * Allocate buffer for the password and for an added prefix character + * for each hash round ('alloc_size' may not be a multiple of 'len'). + */ +- p = grub_zalloc (alloc_size + (alloc_size / len) + 1); ++ if (grub_add (alloc_size, (alloc_size / len), &sz) || ++ grub_add (sz, 1, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while allocating size of password buffer")); ++ ++ p = grub_zalloc (sz); + derived_hash = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN * 2); + if (p == NULL || derived_hash == NULL) + { diff --git a/0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch b/0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch new file mode 100644 index 00000000..15a916f2 --- /dev/null +++ b/0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 12 Feb 2025 10:26:44 -0600 +Subject: [PATCH] disk: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/lvm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 794248540..a395b200d 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -671,8 +671,7 @@ grub_lvm_detect (grub_disk_t disk, + goto lvs_segment_fail; + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -760,8 +759,7 @@ grub_lvm_detect (grub_disk_t disk, + } + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "raids = ["); + if (p == NULL) diff --git a/0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch b/0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch new file mode 100644 index 00000000..efb631e9 --- /dev/null +++ b/0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch @@ -0,0 +1,152 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:11 +0000 +Subject: [PATCH] disk: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), grub_zalloc() or grub_calloc(), these functions can +fail if we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +On the occasion make a NULL check in ATA code more obvious. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ata.c | 4 ++-- + grub-core/disk/ieee1275/obdisk.c | 6 ++++++ + grub-core/disk/ldm.c | 6 ++++++ + grub-core/disk/lvm.c | 14 ++++++++++++++ + grub-core/disk/memdisk.c | 2 ++ + 5 files changed, 30 insertions(+), 2 deletions(-) + +diff --git a/grub-core/disk/ata.c b/grub-core/disk/ata.c +index 7b6ac7bfc..a2433e29e 100644 +--- a/grub-core/disk/ata.c ++++ b/grub-core/disk/ata.c +@@ -112,10 +112,10 @@ grub_ata_identify (struct grub_ata *dev) + return grub_atapi_identify (dev); + + info64 = grub_malloc (GRUB_DISK_SECTOR_SIZE); ++ if (info64 == NULL) ++ return grub_errno; + info32 = (grub_uint32_t *) info64; + info16 = (grub_uint16_t *) info64; +- if (! info16) +- return grub_errno; + + grub_memset (&parms, 0, sizeof (parms)); + parms.buffer = info16; +diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c +index 9d4c42665..fcc39e0a2 100644 +--- a/grub-core/disk/ieee1275/obdisk.c ++++ b/grub-core/disk/ieee1275/obdisk.c +@@ -423,6 +423,12 @@ canonicalise_disk (const char *devname) + } + + real_canon = grub_malloc (real_unit_str_len); ++ if (real_canon == NULL) ++ { ++ grub_free (parent); ++ grub_print_error (); ++ return NULL; ++ } + + grub_snprintf (real_canon, real_unit_str_len, "%s/disk@%s", + op->name, real_unit_address); +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 4101b15d8..048e29cd0 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -292,6 +292,12 @@ make_vg (grub_disk_t disk, + } + + pv->id.uuid = grub_malloc (sz); ++ if (pv->id.uuid == NULL) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index a395b200d..b2dff76d1 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -370,6 +370,8 @@ grub_lvm_detect (grub_disk_t disk, + break; + + pv = grub_zalloc (sizeof (*pv)); ++ if (pv == NULL) ++ goto fail4; + q = p; + while (*q != ' ' && q < mda_end) + q++; +@@ -379,6 +381,8 @@ grub_lvm_detect (grub_disk_t disk, + + s = q - p; + pv->name = grub_malloc (s + 1); ++ if (pv->name == NULL) ++ goto pvs_fail_noname; + grub_memcpy (pv->name, p, s); + pv->name[s] = '\0'; + +@@ -451,6 +455,8 @@ grub_lvm_detect (grub_disk_t disk, + break; + + lv = grub_zalloc (sizeof (*lv)); ++ if (lv == NULL) ++ goto fail4; + + q = p; + while (*q != ' ' && q < mda_end) +@@ -545,6 +551,8 @@ grub_lvm_detect (grub_disk_t disk, + goto lvs_fail; + } + lv->segments = grub_calloc (lv->segment_count, sizeof (*seg)); ++ if (lv->segments == NULL) ++ goto lvs_fail; + seg = lv->segments; + + for (i = 0; i < lv->segment_count; i++) +@@ -612,6 +620,8 @@ grub_lvm_detect (grub_disk_t disk, + + seg->nodes = grub_calloc (seg->node_count, + sizeof (*stripe)); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + stripe = seg->nodes; + + p = grub_strstr (p, "stripes = ["); +@@ -672,6 +682,8 @@ grub_lvm_detect (grub_disk_t disk, + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -760,6 +772,8 @@ grub_lvm_detect (grub_disk_t disk, + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "raids = ["); + if (p == NULL) +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index 36de3bfab..2d7afaea3 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -103,6 +103,8 @@ GRUB_MOD_INIT(memdisk) + return; + } + memdisk_addr = grub_malloc (memdisk_size); ++ if (memdisk_addr == NULL) ++ return; + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); + grub_memmove (memdisk_addr, memdisk_orig_addr, memdisk_size); diff --git a/0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch b/0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch new file mode 100644 index 00000000..2836631a --- /dev/null +++ b/0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:12 +0000 +Subject: [PATCH] disk/ieee1275/ofdisk: Call grub_ieee1275_close() when + grub_malloc() fails + +In the dev_iterate() function a handle is opened but isn't closed when +grub_malloc() returns NULL. We should fix this by closing it on error. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ieee1275/ofdisk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 6c628635f..71237b256 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -269,7 +269,10 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + + buf = grub_malloc (sz); + if (!buf) +- return; ++ { ++ grub_ieee1275_close (ihandle); ++ return; ++ } + bufptr = grub_stpcpy (buf, alias->path); + + for (i = 0; i < args.nentries; i++) diff --git a/0342-fs-Use-safe-math-macros-to-prevent-overflows.patch b/0342-fs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..43eb12c7 --- /dev/null +++ b/0342-fs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,353 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 12 Feb 2025 10:33:31 -0600 +Subject: [PATCH] fs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/archelp.c | 9 ++++++++- + grub-core/fs/btrfs.c | 34 ++++++++++++++++++++++++++++------ + grub-core/fs/cpio_common.c | 16 ++++++++++++++-- + grub-core/fs/f2fs.c | 17 +++++++++++++++-- + grub-core/fs/ntfscomp.c | 9 ++++++++- + grub-core/fs/squash4.c | 12 +++++++++--- + grub-core/fs/xfs.c | 17 +++++++++++++++-- + 7 files changed, 97 insertions(+), 17 deletions(-) + +diff --git a/grub-core/fs/archelp.c b/grub-core/fs/archelp.c +index c1dcc6285..0816b28de 100644 +--- a/grub-core/fs/archelp.c ++++ b/grub-core/fs/archelp.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -68,6 +69,7 @@ handle_symlink (struct grub_archelp_data *data, + char *rest; + char *linktarget; + grub_size_t linktarget_len; ++ grub_size_t sz; + + *restart = 0; + +@@ -98,7 +100,12 @@ handle_symlink (struct grub_archelp_data *data, + if (linktarget[0] == '\0') + return GRUB_ERR_NONE; + linktarget_len = grub_strlen (linktarget); +- target = grub_malloc (linktarget_len + grub_strlen (*name) + 2); ++ ++ if (grub_add (linktarget_len, grub_strlen (*name), &sz) || ++ grub_add (sz, 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("link target length overflow")); ++ ++ target = grub_malloc (sz); + if (!target) + return grub_errno; + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 6593f5175..3e4924b65 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2031,6 +2031,7 @@ find_path (struct grub_btrfs_data *data, + char *origpath = NULL; + unsigned symlinks_max = 32; + const char *relpath = grub_env_get ("btrfs_relative_path"); ++ grub_size_t sz; + + follow_default = 0; + origpath = grub_strdup (path); +@@ -2157,9 +2158,15 @@ find_path (struct grub_btrfs_data *data, + struct grub_btrfs_dir_item *cdirel; + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory item size overflow")); ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + grub_free (path_alloc); +@@ -2223,8 +2230,16 @@ find_path (struct grub_btrfs_data *data, + grub_free (origpath); + return err; + } +- tmp = grub_malloc (grub_le_to_cpu64 (inode.size) +- + grub_strlen (path) + 1); ++ ++ if (grub_add (grub_le_to_cpu64 (inode.size), grub_strlen (path), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_free (direl); ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ } ++ tmp = grub_malloc (sz); + if (!tmp) + { + grub_free (direl); +@@ -2371,6 +2386,7 @@ grub_btrfs_dir (grub_device_t device, const char *path, + grub_uint8_t type; + grub_size_t est_size = 0; + char *new_path = NULL; ++ grub_size_t sz; + + if (!data) + return grub_errno; +@@ -2420,9 +2436,15 @@ grub_btrfs_dir (grub_device_t device, const char *path, + } + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory element size overflow")); ++ r = -grub_errno; ++ break; ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + r = -grub_errno; +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 5d41b6fdb..6ba58b354 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -48,6 +49,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + struct head hd; + grub_size_t namesize; + grub_uint32_t modeval; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + +@@ -76,7 +78,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + + *mode = modeval; + +- *name = grub_malloc (namesize + 1); ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("file name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + +@@ -110,10 +115,17 @@ grub_cpio_get_link_target (struct grub_archelp_data *data) + { + char *ret; + grub_err_t err; ++ grub_size_t sz; + + if (data->size == 0) + return grub_strdup (""); +- ret = grub_malloc (data->size + 1); ++ ++ if (grub_add (data->size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("target data size overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (sz); + if (!ret) + return NULL; + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index f6d6beaa5..72b4aa1e6 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -958,6 +959,7 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + char *symlink; + struct grub_fshelp_node *diro = node; + grub_uint64_t filesize; ++ grub_size_t sz; + + if (!diro->inode_read) + { +@@ -968,7 +970,12 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + + filesize = grub_f2fs_file_size(&diro->inode.i); + +- symlink = grub_malloc (filesize + 1); ++ if (grub_add (filesize, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -997,6 +1004,7 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + enum FILE_TYPE ftype; + int name_len; + int ret; ++ int sz; + + if (grub_f2fs_test_bit_le (i, ctx->bitmap) == 0) + { +@@ -1010,7 +1018,12 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + if (name_len >= F2FS_NAME_LEN) + return 0; + +- filename = grub_malloc (name_len + 1); ++ if (grub_add (name_len, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory entry name length overflow")); ++ return 0; ++ } ++ filename = grub_malloc (sz); + if (!filename) + return 0; + +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index a009f2c2d..f168a318e 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -310,6 +311,7 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + { + grub_err_t ret; + grub_disk_addr_t vcn; ++ int log_sz; + + if (ctx->attr->sbuf) + { +@@ -349,7 +351,12 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + } + + ctx->comp.comp_head = ctx->comp.comp_tail = 0; +- ctx->comp.cbuf = grub_malloc (1 << (ctx->comp.log_spc + GRUB_NTFS_BLK_SHR)); ++ if (grub_add (ctx->comp.log_spc, GRUB_NTFS_BLK_SHR, &log_sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("compression buffer size overflow")); ++ return 0; ++ } ++ ctx->comp.cbuf = grub_malloc (1 << log_sz); + if (!ctx->comp.cbuf) + return 0; + +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index 6e9d63874..f91ff3bfa 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -460,11 +460,11 @@ grub_squash_read_symlink (grub_fshelp_node_t node) + { + char *ret; + grub_err_t err; +- grub_size_t sz; ++ grub_uint32_t sz; + + if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz)) + { +- grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink name length overflow")); + return NULL; + } + +@@ -580,6 +580,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + struct grub_squash_dirent di; + struct grub_squash_inode ino; + grub_size_t sz; ++ grub_uint16_t nlen; + + err = read_chunk (dir->data, &di, sizeof (di), + grub_le_to_cpu64 (dir->data->sb.diroffset) +@@ -595,7 +596,12 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + if (err) + return 0; + +- buf = grub_malloc (grub_le_to_cpu16 (di.namelen) + 2); ++ if (grub_add (grub_le_to_cpu16 (di.namelen), 2, &nlen)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return 0; ++ } ++ buf = grub_malloc (nlen); + if (!buf) + return 0; + err = read_chunk (dir->data, buf, +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 6c952aef1..c60db7361 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -718,6 +718,7 @@ static char * + grub_xfs_read_symlink (grub_fshelp_node_t node) + { + grub_ssize_t size = grub_be_to_cpu64 (node->inode.size); ++ grub_size_t sz; + + if (size < 0) + { +@@ -739,7 +740,12 @@ grub_xfs_read_symlink (grub_fshelp_node_t node) + if (node->data->hascrc) + off = 56; + +- symlink = grub_malloc (size + 1); ++ if (grub_add (size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -789,8 +795,15 @@ static int iterate_dir_call_hook (grub_uint64_t ino, const char *filename, + { + struct grub_fshelp_node *fdiro; + grub_err_t err; ++ grub_size_t sz; + +- fdiro = grub_malloc (grub_xfs_fshelp_size(ctx->diro->data) + 1); ++ if (grub_add (grub_xfs_fshelp_size(ctx->diro->data), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory data size overflow")); ++ grub_print_error (); ++ return 0; ++ } ++ fdiro = grub_malloc (sz); + if (!fdiro) + { + grub_print_error (); diff --git a/0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch b/0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch new file mode 100644 index 00000000..936c2f87 --- /dev/null +++ b/0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch @@ -0,0 +1,82 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:37 +0000 +Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +The HFS+ and squash4 security vulnerabilities were reported by +Jonathan Bar Or . + +Fixes: CVE-2025-0678 +Fixes: CVE-2025-1125 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/btrfs.c | 4 ++-- + grub-core/fs/hfspluscomp.c | 9 +++++++-- + grub-core/fs/squash4.c | 8 ++++---- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 3e4924b65..3228e1788 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -1409,8 +1409,8 @@ grub_btrfs_mount (grub_device_t dev) + } + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + if (!data->devices_attached) + { + grub_free (data); +diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c +index 48ae438d8..a80954ee6 100644 +--- a/grub-core/fs/hfspluscomp.c ++++ b/grub-core/fs/hfspluscomp.c +@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node) + return 0; + } + node->compress_index_size = grub_le_to_cpu32 (index_size); +- node->compress_index = grub_malloc (node->compress_index_size +- * sizeof (node->compress_index[0])); ++ node->compress_index = grub_calloc (node->compress_index_size, ++ sizeof (node->compress_index[0])); + if (!node->compress_index) + { + node->compressed = 0; + grub_free (attr_node); + return grub_errno; + } ++ ++ /* ++ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here ++ * due to relevant checks done in grub_calloc() above. ++ */ + if (grub_hfsplus_read_file (node, 0, 0, + 0x104 + sizeof (index_size), + node->compress_index_size +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index f91ff3bfa..cf2bca822 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -822,10 +822,10 @@ direct_read (struct grub_squash_data *data, + break; + } + total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz); +- ino->block_sizes = grub_malloc (total_blocks +- * sizeof (ino->block_sizes[0])); +- ino->cumulated_block_sizes = grub_malloc (total_blocks +- * sizeof (ino->cumulated_block_sizes[0])); ++ ino->block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->block_sizes[0])); ++ ino->cumulated_block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->cumulated_block_sizes[0])); + if (!ino->block_sizes || !ino->cumulated_block_sizes) + { + grub_free (ino->block_sizes); diff --git a/0344-fs-Prevent-overflows-when-assigning-returned-values-.patch b/0344-fs-Prevent-overflows-when-assigning-returned-values-.patch new file mode 100644 index 00000000..97f8098f --- /dev/null +++ b/0344-fs-Prevent-overflows-when-assigning-returned-values-.patch @@ -0,0 +1,105 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:38 +0000 +Subject: [PATCH] fs: Prevent overflows when assigning returned values from + read_number() + +The direct assignment of the unsigned long long value returned by +read_number() can potentially lead to an overflow on a 32-bit systems. +The fix replaces the direct assignments with calls to grub_cast() +which detects the overflows and safely assigns the values if no +overflow is detected. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/cpio_common.c | 18 ++++++++++++++---- + grub-core/fs/tar.c | 23 ++++++++++++++++------- + 2 files changed, 30 insertions(+), 11 deletions(-) + +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 6ba58b354..45ac119a8 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -62,11 +62,21 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + #endif + ) + return grub_error (GRUB_ERR_BAD_FS, "invalid cpio archive"); +- data->size = read_number (hd.filesize, ARRAY_SIZE (hd.filesize)); ++ ++ if (grub_cast (read_number (hd.filesize, ARRAY_SIZE (hd.filesize)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + if (mtime) +- *mtime = read_number (hd.mtime, ARRAY_SIZE (hd.mtime)); +- modeval = read_number (hd.mode, ARRAY_SIZE (hd.mode)); +- namesize = read_number (hd.namesize, ARRAY_SIZE (hd.namesize)); ++ { ++ if (grub_cast (read_number (hd.mtime, ARRAY_SIZE (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } ++ ++ if (grub_cast (read_number (hd.mode, ARRAY_SIZE (hd.mode)), &modeval)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ ++ if (grub_cast (read_number (hd.namesize, ARRAY_SIZE (hd.namesize)), &namesize)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("namesize overflow")); + + /* Don't allow negative numbers. */ + if (namesize >= 0x80000000) +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index fd2ec1f74..1eaa5349f 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -99,9 +99,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'L') + { + grub_err_t err; +- grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t namesize; + +- if (grub_add (namesize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &namesize) || ++ grub_add (namesize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); + + *name = grub_malloc (sz); +@@ -123,9 +124,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'K') + { + grub_err_t err; +- grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t linksize; + +- if (grub_add (linksize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &linksize) || ++ grub_add (linksize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); + + if (data->linkname_alloc < sz) +@@ -174,15 +176,22 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + (*name)[extra_size + sizeof (hd.name)] = 0; + } + +- data->size = read_number (hd.size, sizeof (hd.size)); ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + data->dofs = data->hofs + GRUB_DISK_SECTOR_SIZE; + data->next_hofs = data->dofs + ((data->size + GRUB_DISK_SECTOR_SIZE - 1) & + ~(GRUB_DISK_SECTOR_SIZE - 1)); + if (mtime) +- *mtime = read_number (hd.mtime, sizeof (hd.mtime)); ++ { ++ if (grub_cast (read_number (hd.mtime, sizeof (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } + if (mode) + { +- *mode = read_number (hd.mode, sizeof (hd.mode)); ++ if (grub_cast (read_number (hd.mode, sizeof (hd.mode)), mode)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ + switch (hd.typeflag) + { + /* Hardlink. */ diff --git a/0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch b/0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..427877de --- /dev/null +++ b/0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,138 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:02 +0000 +Subject: [PATCH] fs/zfs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 50 ++++++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 44 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index a497b1869..2f303d655 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -2387,6 +2387,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + zap_dnode->endian) << DNODE_SHIFT); + grub_err_t err; + grub_zfs_endian_t endian; ++ grub_size_t sz; + + if (zap_verify (zap, zap_dnode->endian)) + return 0; +@@ -2448,8 +2449,14 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + if (le->le_type != ZAP_CHUNK_ENTRY) + continue; + +- buf = grub_malloc (grub_zfs_to_cpu16 (le->le_name_length, endian) +- * name_elem_length + 1); ++ if (grub_mul (grub_zfs_to_cpu16 (le->le_name_length, endian), name_elem_length, &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ grub_free (l); ++ return grub_errno; ++ } ++ buf = grub_malloc (sz); + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2872,6 +2879,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + && ((grub_zfs_to_cpu64(((znode_phys_t *) DN_BONUS (&dnode_path->dn.dn))->zp_mode, dnode_path->dn.endian) >> 12) & 0xf) == 0xa) + { + char *sym_value; ++ grub_size_t sz; + grub_size_t sym_sz; + int free_symval = 0; + char *oldpath = path, *oldpathbuf = path_buf; +@@ -2923,7 +2931,18 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + break; + free_symval = 1; + } +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ if (free_symval) ++ grub_free (sym_value); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -2960,6 +2979,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + { + void *sahdrp; + int hdrsize; ++ grub_size_t sz; + + if (dnode_path->dn.dn.dn_bonuslen != 0) + { +@@ -2993,7 +3013,15 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + + SA_SIZE_OFFSET), + dnode_path->dn.endian); + char *oldpath = path, *oldpathbuf = path_buf; +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -3568,6 +3596,7 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + unsigned i; + grub_size_t nelm; + int elemsize = 0; ++ int sz; + + found = nvlist_find_value (nvlist, name, DATA_TYPE_NVLIST_ARRAY, &nvpair, + &size, &nelm); +@@ -3602,7 +3631,12 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + return 0; + } + +- ret = grub_zalloc (elemsize + sizeof (grub_uint32_t)); ++ if (grub_add (elemsize, sizeof (grub_uint32_t), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("elemsize overflow")); ++ return 0; ++ } ++ ret = grub_zalloc (sz); + if (!ret) + return 0; + grub_memcpy (ret, nvlist, sizeof (grub_uint32_t)); +@@ -4193,6 +4227,7 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + struct grub_dirhook_info info; + char *name2; + int ret; ++ grub_size_t sz; + + dnode_end_t mdn; + +@@ -4213,7 +4248,10 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return 0; + } + +- name2 = grub_malloc (grub_strlen (name) + 2); ++ if (grub_add (grub_strlen (name), 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ ++ name2 = grub_malloc (sz); + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch b/0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch new file mode 100644 index 00000000..64c0e286 --- /dev/null +++ b/0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:03 +0000 +Subject: [PATCH] fs/zfs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 2f303d655..9ab7bf319 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -723,8 +723,8 @@ fill_vdev_info_real (struct grub_zfs_data *data, + { + fill->n_children = nelm; + +- fill->children = grub_zalloc (fill->n_children +- * sizeof (fill->children[0])); ++ fill->children = grub_calloc (fill->n_children, ++ sizeof (fill->children[0])); + } + + for (i = 0; i < nelm; i++) +@@ -3712,8 +3712,8 @@ zfs_mount (grub_device_t dev) + #endif + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) diff --git a/0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch b/0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch new file mode 100644 index 00000000..7870587f --- /dev/null +++ b/0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch @@ -0,0 +1,88 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:01 +0000 +Subject: [PATCH] fs/zfs: Check if returned pointer for allocated memory is + NULL + +When using grub_malloc() or grub_zalloc(), these functions can fail if +we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 9ab7bf319..6e6d1c921 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -614,6 +614,8 @@ zfs_fetch_nvlist (struct grub_zfs_device_desc *diskdesc, char **nvlist) + return grub_error (GRUB_ERR_BUG, "member drive unknown"); + + *nvlist = grub_malloc (VDEV_PHYS_SIZE); ++ if (!*nvlist) ++ return grub_errno; + + /* Read in the vdev name-value pair list (112K). */ + err = grub_disk_read (diskdesc->dev->disk, diskdesc->vdev_phys_sector, 0, +@@ -725,6 +727,11 @@ fill_vdev_info_real (struct grub_zfs_data *data, + + fill->children = grub_calloc (fill->n_children, + sizeof (fill->children[0])); ++ if (!fill->children) ++ { ++ grub_free (type); ++ return grub_errno; ++ } + } + + for (i = 0; i < nelm; i++) +@@ -2457,6 +2464,11 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + return grub_errno; + } + buf = grub_malloc (sz); ++ if (!buf) ++ { ++ grub_free (l); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2472,6 +2484,12 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + val_length = ((int) le->le_value_length + * (int) le->le_int_size); + val = grub_malloc (grub_zfs_to_cpu16 (val_length, endian)); ++ if (!val) ++ { ++ grub_free (l); ++ grub_free (buf); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_value_chunk, + endian), +@@ -3714,6 +3732,11 @@ zfs_mount (grub_device_t dev) + data->n_devices_allocated = 16; + data->devices_attached = grub_calloc (data->n_devices_allocated, + sizeof (data->devices_attached[0])); ++ if (!data->devices_attached) ++ { ++ grub_free (data); ++ return NULL; ++ } + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) +@@ -4252,6 +4275,9 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); + + name2 = grub_malloc (sz); ++ if (!name2) ++ return grub_errno; ++ + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch b/0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch new file mode 100644 index 00000000..988bcbe7 --- /dev/null +++ b/0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:04 +0000 +Subject: [PATCH] fs/zfs: Add missing NULL check after grub_strdup() call + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 6e6d1c921..5ff647ffb 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -3309,6 +3309,8 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + filename = 0; + snapname = 0; + fsname = grub_strdup (fullpath); ++ if (!fsname) ++ return grub_errno; + } + else + { diff --git a/0349-net-Use-safe-math-macros-to-prevent-overflows.patch b/0349-net-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..60ebaf63 --- /dev/null +++ b/0349-net-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,240 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 12 Feb 2025 10:38:17 -0600 +Subject: [PATCH] net: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/bootp.c | 16 +++++++++++-- + grub-core/net/dns.c | 9 ++++++- + grub-core/net/drivers/ieee1275/ofnet.c | 20 ++++++++++++++-- + grub-core/net/net.c | 43 +++++++++++++++++++++++++++------- + 4 files changed, 75 insertions(+), 13 deletions(-) + +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index 9cbdc2264..bed70c0b2 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static int + dissect_url (const char *url, char **proto, char **host, char **path) +@@ -1479,6 +1480,7 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + unsigned num; + const grub_uint8_t *ptr; + grub_uint8_t taglength; ++ grub_uint8_t len; + + if (argc < 4) + return grub_error (GRUB_ERR_BAD_ARGUMENT, +@@ -1520,7 +1522,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "string") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (taglength + 1); ++ char *val; ++ ++ if (grub_add (taglength, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + if (!val) + return grub_errno; + grub_memcpy (val, ptr, taglength); +@@ -1553,7 +1560,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "hex") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (2 * taglength + 1); ++ char *val; ++ ++ if (grub_mul (taglength, 2, &len) || grub_add (len, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + int i; + if (!val) + return grub_errno; +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index fcc09aa65..39b0c46cf 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -224,10 +224,17 @@ get_name (const grub_uint8_t *name_at, const grub_uint8_t *head, + { + int length; + char *ret; ++ int len; + + if (!check_name_real (name_at, head, tail, NULL, &length, NULL)) + return NULL; +- ret = grub_malloc (length + 1); ++ ++ if (grub_add (length, 1, &len)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (len); + if (!ret) + return NULL; + if (!check_name_real (name_at, head, tail, NULL, NULL, ret)) +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index c56461ff1..b5336dfbb 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -392,6 +393,7 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + grub_uint8_t *pprop; + char *shortname; + char need_suffix = 1; ++ grub_size_t sz; + + if (grub_strcmp (alias->type, "network") != 0) + return 0; +@@ -449,9 +451,23 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + } + + if (need_suffix) +- ofdata->path = grub_malloc (grub_strlen (alias->path) + sizeof (SUFFIX)); ++ { ++ if (grub_add (grub_strlen (alias->path), sizeof (SUFFIX), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + else +- ofdata->path = grub_malloc (grub_strlen (alias->path) + 1); ++ { ++ if (grub_add (grub_strlen (alias->path), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + if (!ofdata->path) + { + grub_print_error (); +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 6c8dfcba2..22224453f 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_MACHINE_EFI + #include + #endif +@@ -211,6 +212,7 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + { + struct grub_net_slaac_mac_list *slaac; + char *ptr; ++ grub_size_t sz; + + for (slaac = card->slaac_list; slaac; slaac = slaac->next) + if (grub_net_hwaddr_cmp (&slaac->address, hwaddr) == 0) +@@ -220,9 +222,16 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + if (!slaac) + return NULL; + +- slaac->name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":slaac")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":slaac")), &sz)) ++ { ++ grub_free (slaac); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of slaac name"); ++ return NULL; ++ } ++ ++ slaac->name = grub_malloc (sz); + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { +@@ -293,6 +302,7 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + char *name; + char *ptr; + grub_net_network_level_address_t addr; ++ grub_size_t sz; + + addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; + addr.ipv6[0] = grub_cpu_to_be64_compile_time (0xfe80ULL << 48); +@@ -307,9 +317,14 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + return inf; + } + +- name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":link")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":link")), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of link name"); ++ return NULL; ++ } ++ name = grub_malloc (sz); + if (!name) + return NULL; + +@@ -1516,9 +1531,15 @@ grub_net_open_real (const char *name) + if (grub_strchr (port_start + 1, ':')) + { + int iplen = grub_strlen (server); ++ grub_size_t sz; + + /* Bracket bare IPv6 addr. */ +- host = grub_malloc (iplen + 3); ++ if (grub_add (iplen, 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining length of host")); ++ return NULL; ++ } ++ host = grub_malloc (sz); + if (!host) + return NULL; + +@@ -1773,6 +1794,7 @@ grub_env_set_net_property (const char *intername, const char *suffix, + { + char *varname, *varvalue; + char *ptr; ++ grub_size_t sz; + + varname = grub_xasprintf ("net_%s_%s", intername, suffix); + if (!varname) +@@ -1780,7 +1802,12 @@ grub_env_set_net_property (const char *intername, const char *suffix, + for (ptr = varname; *ptr; ptr++) + if (*ptr == ':') + *ptr = '_'; +- varvalue = grub_malloc (len + 1); ++ if (grub_add (len, 1, &sz)) ++ { ++ grub_free (varname); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining the size of an env variable"); ++ } ++ varvalue = grub_malloc (sz); + if (!varvalue) + { + grub_free (varname); diff --git a/0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch b/0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch new file mode 100644 index 00000000..c6619d2f --- /dev/null +++ b/0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 18:04:43 +0000 +Subject: [PATCH] net: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/net/dns.c | 4 ++-- + grub-core/net/net.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index 39b0c46cf..f20cd6f83 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -470,8 +470,8 @@ grub_net_dns_lookup (const char *name, + && grub_get_time_ms () < dns_cache[h].limit_time) + { + grub_dprintf ("dns", "retrieved from cache\n"); +- *addresses = grub_malloc (dns_cache[h].naddresses +- * sizeof ((*addresses)[0])); ++ *addresses = grub_calloc (dns_cache[h].naddresses, ++ sizeof ((*addresses)[0])); + if (!*addresses) + return grub_errno; + *naddresses = dns_cache[h].naddresses; +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 22224453f..d426ad2c4 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -91,8 +91,8 @@ grub_net_link_layer_add_address (struct grub_net_card *card, + /* Add sender to cache table. */ + if (card->link_layer_table == NULL) + { +- card->link_layer_table = grub_zalloc (LINK_LAYER_CACHE_SIZE +- * sizeof (card->link_layer_table[0])); ++ card->link_layer_table = grub_calloc (LINK_LAYER_CACHE_SIZE, ++ sizeof (card->link_layer_table[0])); + if (card->link_layer_table == NULL) + return; + } diff --git a/0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch b/0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch new file mode 100644 index 00000000..7b5b647b --- /dev/null +++ b/0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 18:04:44 +0000 +Subject: [PATCH] net: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), the function can fail if we are out of memory. +After allocating memory we should check if this function returned NULL +and handle this error if it did. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index d426ad2c4..bec297cb6 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -232,6 +232,11 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + } + + slaac->name = grub_malloc (sz); ++ if (slaac->name == NULL) ++ { ++ grub_free (slaac); ++ return NULL; ++ } + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { diff --git a/0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch b/0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch new file mode 100644 index 00000000..57d2960b --- /dev/null +++ b/0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 28 Jan 2025 05:15:50 +0000 +Subject: [PATCH] fs/sfs: Check if allocated memory is NULL + +When using grub_zalloc(), if we are out of memory, this function can fail. +After allocating memory, we should check if grub_zalloc() returns NULL. +If so, we should handle this error. + +Fixes: CID 473856 + +Signed-off-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/sfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 88705b3a2..bad4ae8d1 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -429,6 +429,9 @@ grub_sfs_mount (grub_disk_t disk) + - 24 /* offsetof (struct grub_sfs_objc, objects) */ + - 25); /* offsetof (struct grub_sfs_obj, filename) */ + data->label = grub_zalloc (max_len + 1); ++ if (data->label == NULL) ++ goto fail; ++ + grub_strncpy (data->label, (char *) rootobjc->objects[0].filename, max_len); + + grub_free (rootobjc_data); diff --git a/0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch b/0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch new file mode 100644 index 00000000..575c81a9 --- /dev/null +++ b/0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:37 +0000 +Subject: [PATCH] script/execute: Fix potential underflow and NULL dereference + +The result is initialized to 0 in grub_script_arglist_to_argv(). +If the for loop condition is not met both result.args and result.argc +remain 0 causing result.argc - 1 to underflow and/or result.args NULL +dereference. Fix the issues by adding relevant checks. + +Fixes: CID 473880 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 7ed3a1a03..014132703 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -794,6 +794,9 @@ cleanup: + } + } + ++ if (result.args == NULL || result.argc == 0) ++ goto fail; ++ + if (! result.args[result.argc - 1]) + result.argc--; + diff --git a/0354-osdep-unix-getroot-Fix-potential-underflow.patch b/0354-osdep-unix-getroot-Fix-potential-underflow.patch new file mode 100644 index 00000000..09c223ea --- /dev/null +++ b/0354-osdep-unix-getroot-Fix-potential-underflow.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:38 +0000 +Subject: [PATCH] osdep/unix/getroot: Fix potential underflow + +The entry_len is initialized in grub_find_root_devices_from_mountinfo() +to 0 before the while loop iterates through /proc/self/mountinfo. If the +file is empty or contains only invalid entries entry_len remains +0 causing entry_len - 1 in the subsequent for loop initialization +to underflow. To prevent this add a check to ensure entry_len > 0 before +entering the for loop. + +Fixes: CID 473877 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Ross Philipson +--- + grub-core/osdep/linux/getroot.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index b32582eb3..b83259321 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -596,6 +596,9 @@ again: + } + } + ++ if (!entry_len) ++ goto out; ++ + /* Now scan visible mounts for the ones we're interested in. */ + for (i = entry_len - 1; i >= 0; i--) + { diff --git a/0355-misc-Ensure-consistent-overflow-error-messages.patch b/0355-misc-Ensure-consistent-overflow-error-messages.patch new file mode 100644 index 00000000..411a4fbc --- /dev/null +++ b/0355-misc-Ensure-consistent-overflow-error-messages.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:39 +0000 +Subject: [PATCH] misc: Ensure consistent overflow error messages + +Update the overflow error messages to make them consistent +across the GRUB code. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 2 +- + grub-core/fs/ntfscomp.c | 2 +- + grub-core/video/readers/png.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index e00349b1d..960833a34 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -574,7 +574,7 @@ retry: + goto retry; + } + } +- return grub_error (GRUB_ERR_BAD_FS, "run list overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "run list overflow"); + } + ctx->curr_vcn = ctx->next_vcn; + ctx->next_vcn += read_run_data (run, c1, 0); /* length of current VCN */ +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index f168a318e..b68bf5e40 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -30,7 +30,7 @@ static grub_err_t + decomp_nextvcn (struct grub_ntfs_comp *cc) + { + if (cc->comp_head >= cc->comp_tail) +- return grub_error (GRUB_ERR_BAD_FS, "compression block overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "compression block overflow"); + if (grub_disk_read + (cc->disk, + (cc->comp_table[cc->comp_head].next_lcn - +diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c +index 3163e97bf..aa7524b7d 100644 +--- a/grub-core/video/readers/png.c ++++ b/grub-core/video/readers/png.c +@@ -626,7 +626,7 @@ static grub_err_t + grub_png_output_byte (struct grub_png_data *data, grub_uint8_t n) + { + if (--data->raw_bytes < 0) +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflown"); ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflow"); + + if (data->cur_column == 0) + { diff --git a/0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch b/0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch new file mode 100644 index 00000000..70342514 --- /dev/null +++ b/0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:10 +0000 +Subject: [PATCH] bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t + +The Coverity indicates that GRUB_EHCI_TOGGLE is an int that contains +a negative value and we are using it for the variable token which is +grub_uint32_t. To remedy this we can cast the definition to grub_uint32_t. + +Fixes: CID 473851 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/bus/usb/ehci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/bus/usb/ehci.c b/grub-core/bus/usb/ehci.c +index 9abebc6bd..2db07c7c0 100644 +--- a/grub-core/bus/usb/ehci.c ++++ b/grub-core/bus/usb/ehci.c +@@ -218,7 +218,7 @@ enum + + #define GRUB_EHCI_TERMINATE (1<<0) + +-#define GRUB_EHCI_TOGGLE (1<<31) ++#define GRUB_EHCI_TOGGLE ((grub_uint32_t) 1<<31) + + enum + { diff --git a/0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch b/0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch new file mode 100644 index 00000000..2ae5ec6f --- /dev/null +++ b/0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:11 +0000 +Subject: [PATCH] normal/menu: Use safe math to avoid an integer overflow + +The Coverity indicates that the variable current_entry might overflow. +To prevent this use safe math when adding GRUB_MENU_PAGE_SIZE to current_entry. + +On the occasion fix limiting condition which was broken. + +Fixes: CID 473853 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/normal/menu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index cda10fa8b..97687013c 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + /* Time to delay after displaying an error message about a default/fallback + entry failing to boot. */ +@@ -784,9 +785,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) + + case GRUB_TERM_CTRL | 'c': + case GRUB_TERM_KEY_NPAGE: +- if (current_entry + GRUB_MENU_PAGE_SIZE < menu->size) +- current_entry += GRUB_MENU_PAGE_SIZE; +- else ++ if (grub_add (current_entry, GRUB_MENU_PAGE_SIZE, ¤t_entry) || current_entry >= menu->size) + current_entry = menu->size - 1; + menu_set_chosen_entry (current_entry); + break; diff --git a/0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch b/0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch new file mode 100644 index 00000000..a170fa95 --- /dev/null +++ b/0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:56 +0000 +Subject: [PATCH] kern/partition: Add sanity check after grub_strtoul() call + +The current code incorrectly assumes that both the input and the values +returned by grub_strtoul() are always valid which can lead to potential +errors. This fix ensures proper validation to prevent any unintended issues. + +Fixes: CID 473843 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index 704512a20..c6a578cf4 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -125,14 +125,22 @@ grub_partition_probe (struct grub_disk *disk, const char *str) + for (ptr = str; *ptr;) + { + grub_partition_map_t partmap; +- int num; ++ unsigned long num; + const char *partname, *partname_end; + + partname = ptr; + while (*ptr && grub_isalpha (*ptr)) + ptr++; + partname_end = ptr; +- num = grub_strtoul (ptr, &ptr, 0) - 1; ++ ++ num = grub_strtoul (ptr, &ptr, 0); ++ if (*ptr != '\0' || num == 0 || num > GRUB_INT_MAX) ++ { ++ grub_error (GRUB_ERR_BAD_NUMBER, N_("invalid partition number")); ++ return 0; ++ } ++ ++ num -= 1; + + curpart = 0; + /* Use the first partition map type found. */ diff --git a/0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch b/0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch new file mode 100644 index 00000000..7af2fd0b --- /dev/null +++ b/0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:57 +0000 +Subject: [PATCH] kern/misc: Add sanity check after grub_strtoul() call + +When the format string, fmt0, includes a positional argument +grub_strtoul() or grub_strtoull() is called to extract the argument +position. However, the returned argument position isn't fully validated. +If the format is something like "%0$x" then these functions return +0 which leads to an underflow in the calculation of the args index, curn. +The fix is to add a check to ensure the extracted argument position is +greater than 0 before computing curn. Additionally, replace one +grub_strtoull() with grub_strtoul() and change curn type to make code +more correct. + +Fixes: CID 473841 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/misc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 98700423d..69bd655f3 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -912,7 +912,7 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + while ((c = *fmt++) != 0) + { + int longfmt = 0; +- grub_size_t curn; ++ unsigned long curn; + const char *p; + + if (c != '%') +@@ -930,7 +930,10 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + + if (*fmt == '$') + { +- curn = grub_strtoull (p, 0, 10) - 1; ++ curn = grub_strtoul (p, 0, 10); ++ if (curn == 0) ++ continue; ++ curn--; + fmt++; + } + +@@ -1116,6 +1119,8 @@ grub_vsnprintf_real (char *str, grub_size_t max_len, const char *fmt0, + + if (*fmt == '$') + { ++ if (format1 == 0) ++ continue; + curn = format1 - 1; + fmt++; + format1 = 0; diff --git a/0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch b/0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch new file mode 100644 index 00000000..9c8819bb --- /dev/null +++ b/0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 12 Feb 2025 10:56:13 -0600 +Subject: [PATCH] loader/i386/linux: Cast left shift to grub_uint32_t + +The Coverity complains that we might overflow into a negative value when +setting linux_params.kernel_alignment to (1 << align). We can remedy +this by casting it to grub_uint32_t. + +Fixes: CID 473876 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/linux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 90121e9bc..33a852197 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -823,7 +823,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, GRUB_MEM_ATTR_X); + + linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; +- linux_params.kernel_alignment = (1 << align); ++ linux_params.kernel_alignment = ((grub_uint32_t)1 << align); + linux_params.ps_mouse = linux_params.padding11 = 0; + linux_params.type_of_loader = GRUB_LINUX_BOOT_LOADER_TYPE; + diff --git a/0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch b/0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch new file mode 100644 index 00000000..272293b2 --- /dev/null +++ b/0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 5 Feb 2025 22:04:08 +0000 +Subject: [PATCH] loader/i386/bsd: Use safe math to avoid underflow + +The operation kern_end - kern_start may underflow when we input it into +grub_relocator_alloc_chunk_addr() call. To avoid this we can use safe +math for this subtraction. + +Fixes: CID 73845 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/bsd.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index 8075ac9b0..50f96ea7a 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -1341,6 +1341,7 @@ static grub_err_t + grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_err_t err; ++ grub_size_t sz; + + kern_end = 0; + kern_start = ~0; +@@ -1371,8 +1372,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + + if (grub_errno) + return grub_errno; +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, +- kern_start, kern_end - kern_start); ++ ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + +@@ -1432,8 +1436,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, +- kern_end - kern_start); ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + kern_chunk_src = get_virtual_current_address (ch); diff --git a/grub.patches b/grub.patches index 2cd34418..80d9622e 100644 --- a/grub.patches +++ b/grub.patches @@ -286,3 +286,76 @@ Patch0285: 0285-term-nns8250-spcr-return-if-redirection-is-disabled.patch Patch0286: 0286-commands-legacycfg-Avoid-closing-file-twice.patch Patch0287: 0287-disk-ahci.c-remove-conditional-operator-for-endtime.patch Patch0288: 0288-commands-bli-Fix-crash-in-get_part_uuid.patch +Patch0289: 0289-misc-Implement-grub_strlcpy.patch +Patch0290: 0290-fs-ufs-Fix-a-heap-OOB-write.patch +Patch0291: 0291-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch +Patch0292: 0292-fs-tar-Initialize-name-in-grub_cpio_find_file.patch +Patch0293: 0293-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0294: 0294-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch +Patch0295: 0295-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch +Patch0296: 0296-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch +Patch0297: 0297-fs-iso9660-Fix-invalid-free.patch +Patch0298: 0298-fs-jfs-Fix-OOB-read-in-jfs_getent.patch +Patch0299: 0299-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch +Patch0300: 0300-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch +Patch0301: 0301-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch +Patch0302: 0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch +Patch0303: 0303-fs-ntfs-Fix-out-of-bounds-read.patch +Patch0304: 0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch +Patch0305: 0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch +Patch0306: 0306-fs-ntfs-Implement-attribute-verification.patch +Patch0307: 0307-fs-xfs-Fix-out-of-bounds-read.patch +Patch0308: 0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch +Patch0309: 0309-kern-file-Ensure-file-data-is-set.patch +Patch0310: 0310-kern-file-Implement-filesystem-reference-counting.patch +Patch0311: 0311-cli_lock-Add-build-option-to-block-command-line-inte.patch +Patch0312: 0312-disk-cryptodisk-Require-authentication-after-TPM-unl.patch +Patch0313: 0313-disk-loopback-Reference-tracking-for-the-loopback.patch +Patch0314: 0314-kern-disk-Limit-recursion-depth.patch +Patch0315: 0315-kern-partition-Limit-recursion-in-part_iterate.patch +Patch0316: 0316-script-execute-Limit-the-recursion-depth.patch +Patch0317: 0317-net-Unregister-net_default_ip-and-net_default_mac-va.patch +Patch0318: 0318-net-Remove-variables-hooks-when-interface-is-unregis.patch +Patch0319: 0319-net-Fix-OOB-write-in-grub_net_search_config_file.patch +Patch0320: 0320-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch +Patch0321: 0321-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch +Patch0322: 0322-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch +Patch0323: 0323-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch +Patch0324: 0324-commands-extcmd-Missing-check-for-failed-allocation.patch +Patch0325: 0325-commands-ls-Fix-NULL-dereference.patch +Patch0326: 0326-commands-pgp-Unregister-the-check_signatures-hooks-o.patch +Patch0327: 0327-normal-Remove-variables-hooks-on-module-unload.patch +Patch0328: 0328-gettext-Remove-variables-hooks-on-module-unload.patch +Patch0329: 0329-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch +Patch0330: 0330-gettext-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0331: 0331-commands-read-Fix-an-integer-overflow-when-supplying.patch +Patch0332: 0332-commands-test-Stack-overflow-due-to-unlimited-recurs.patch +Patch0333: 0333-commands-minicmd-Block-the-dump-command-in-lockdown-.patch +Patch0334: 0334-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch +Patch0335: 0335-commands-hexdump-Disable-memory-reading-in-lockdown-.patch +Patch0336: 0336-fs-bfs-Disable-under-lockdown.patch +Patch0337: 0337-fs-Disable-many-filesystems-under-lockdown.patch +Patch0338: 0338-disk-Use-safe-math-macros-to-prevent-overflows.patch +Patch0339: 0339-disk-Prevent-overflows-when-allocating-memory-for-ar.patch +Patch0340: 0340-disk-Check-if-returned-pointer-for-allocated-memory-.patch +Patch0341: 0341-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch +Patch0342: 0342-fs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0343: 0343-fs-Prevent-overflows-when-allocating-memory-for-arra.patch +Patch0344: 0344-fs-Prevent-overflows-when-assigning-returned-values-.patch +Patch0345: 0345-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0346: 0346-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch +Patch0347: 0347-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch +Patch0348: 0348-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch +Patch0349: 0349-net-Use-safe-math-macros-to-prevent-overflows.patch +Patch0350: 0350-net-Prevent-overflows-when-allocating-memory-for-arr.patch +Patch0351: 0351-net-Check-if-returned-pointer-for-allocated-memory-i.patch +Patch0352: 0352-fs-sfs-Check-if-allocated-memory-is-NULL.patch +Patch0353: 0353-script-execute-Fix-potential-underflow-and-NULL-dere.patch +Patch0354: 0354-osdep-unix-getroot-Fix-potential-underflow.patch +Patch0355: 0355-misc-Ensure-consistent-overflow-error-messages.patch +Patch0356: 0356-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch +Patch0357: 0357-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch +Patch0358: 0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch +Patch0359: 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch +Patch0360: 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch +Patch0361: 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch diff --git a/grub2.spec b/grub2.spec index 852a6783..18afc754 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 23%{?dist} +Release: 24%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,28 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue Feb 18 2025 Leo Sandoval - 2.02-24 +- Add Several CVE fixes +- Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 +- Resolves: CVE-2024-45775 CVE-2024-45780 CVE-2024-45774 +- Resolves: CVE-2025-0690 CVE-2025-1118 CVE-2024-45782 +- Resolves: CVE-2025-0624 CVE-2024-45779 CVE-2024-45776 +- Resolves: CVE-2025-0622 CVE-2025-0677 +- Related: #RHEL-79703 +- Related: #RHEL-79708 +- Related: #RHEL-79340 +- Related: #RHEL-73786 +- Related: #RHEL-79701 +- Related: #RHEL-73784 +- Related: #RHEL-79856 +- Related: #RHEL-79874 +- Related: #RHEL-79706 +- Related: #RHEL-79836 +- Related: #RHEL-79699 +- Related: #RHEL-75736 +- Related: #RHEL-79712 +- Related: #RHEL-79848 + * Tue Feb 11 2025 Nicolas Frayer 2.12-23 - Revert commit for bootloader update proposal for now as not all components are ready From 0c53016c97b7083b94c0986d1dbcfe782f6b98df Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 25 Feb 2025 16:15:57 +0100 Subject: [PATCH 14/45] fs/ext2: Rework out-of-bounds read for inline and external extents Resolves: #2346804 Signed-off-by: Nicolas Frayer --- ...ut-of-bounds-read-for-inline-and-ext.patch | 65 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 6 +- 3 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch diff --git a/0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch b/0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch new file mode 100644 index 00000000..c237f462 --- /dev/null +++ b/0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 21 Feb 2025 09:06:12 +0800 +Subject: [PATCH] fs/ext2: Rework out-of-bounds read for inline and external + extents + +Previously, the number of extent entries was not properly capped based +on the actual available space. This could lead to insufficient reads for +external extents, since the computation was based solely on the inline +extent layout. + +In this patch, when processing the extent header, we determine whether +the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an +external extent block. We then clamp the number of entries accordingly +(using max_inline_ext for inline extents and max_external_ext for +external extent blocks). + +This change ensures that only the valid number of extent entries is +processed, preventing out-of-bound reads and potential filesystem +corruption. + +Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents) + +Signed-off-by: Michael Chang +Tested-by: Christian Hesse +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index c3058f7..a5650c3 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -496,7 +496,10 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + int i; + grub_disk_addr_t ret; + grub_uint16_t nent; ++ /* maximum number of extent entries in the inode's inline extent area */ + const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ ++ /* maximum number of extent entries in the external extent block */ ++ const grub_uint16_t max_external_ext = EXT2_BLOCK_SIZE(data) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + if (grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, + fileblock, &leaf) != GRUB_ERR_NONE) +@@ -513,8 +516,18 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + + nent = grub_le_to_cpu16 (leaf->entries); + +- if (leaf->depth == 0) ++ /* ++ * Determine the effective number of extent entries (nent) to process: ++ * If the extent header (leaf) is stored inline in the inode’s block ++ * area (i.e. at inode->blocks.dir_blocks), then only max_inline_ext ++ * entries can fit. ++ * Otherwise, if the header was read from an external extent block, use ++ * the larger limit, max_external_ext, based on the full block size. ++ */ ++ if (leaf == (struct grub_ext4_extent_header *) inode->blocks.dir_blocks) + nent = grub_min (nent, max_inline_ext); ++ else ++ nent = grub_min (nent, max_external_ext); + + for (i = 0; i < nent; i++) + { diff --git a/grub.patches b/grub.patches index 80d9622e..c526e11f 100644 --- a/grub.patches +++ b/grub.patches @@ -359,3 +359,4 @@ Patch0358: 0358-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch Patch0359: 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch Patch0360: 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch Patch0361: 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch +Patch0362: 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch diff --git a/grub2.spec b/grub2.spec index 18afc754..daa2987e 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 24%{?dist} +Release: 25%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue Feb 25 2025 Nicolas Frayer 2.12-25 +- fs/ext2: Rework out-of-bounds read for inline and external extents +- Resolves: #2346804 + * Tue Feb 18 2025 Leo Sandoval - 2.02-24 - Add Several CVE fixes - Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 From b04ed232e2addec2fbae39dfb4af4f560607a007 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 10 Mar 2025 13:08:41 -0600 Subject: [PATCH 15/45] Remove NTFS attribute verification patch The removed patch was part of the CVE patches ported recently into Fedora but unfortunately this is causing segfaults when generating the grub configuration file. At some point the same patch will come back with the corresponding fix but for the time being, it is removed. Note that patch numeration did not change on purpose: patch will be introduced again so need to mess with the numeration. Resolves: #2350327 Signed-off-by: Leo Sandoval --- ...tfs-Implement-attribute-verification.patch | 245 ------------------ grub.patches | 1 - grub2.spec | 6 +- 3 files changed, 5 insertions(+), 247 deletions(-) delete mode 100644 0306-fs-ntfs-Implement-attribute-verification.patch diff --git a/0306-fs-ntfs-Implement-attribute-verification.patch b/0306-fs-ntfs-Implement-attribute-verification.patch deleted file mode 100644 index 4ee1c392..00000000 --- a/0306-fs-ntfs-Implement-attribute-verification.patch +++ /dev/null @@ -1,245 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: B Horn -Date: Tue, 14 May 2024 12:39:56 +0100 -Subject: [PATCH] fs/ntfs: Implement attribute verification - -It was possible to read OOB when an attribute had a size that exceeded -the allocated buffer. This resolves that by making sure all attributes -that get read are fully in the allocated space by implementing -a function to validate them. - -Defining the offsets in include/grub/ntfs.h but they are only used in -the validation function and not across the rest of the NTFS code. - -Signed-off-by: B Horn -Reviewed-by: Daniel Kiper ---- - grub-core/fs/ntfs.c | 153 ++++++++++++++++++++++++++++++++++++++++++++++++++++ - include/grub/ntfs.h | 22 ++++++++ - 2 files changed, 175 insertions(+) - -diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c -index 1c678f3d0..64f4f2221 100644 ---- a/grub-core/fs/ntfs.c -+++ b/grub-core/fs/ntfs.c -@@ -70,6 +70,149 @@ res_attr_data_len (void *res_attr_ptr) - return u32at (res_attr_ptr, 0x10); - } - -+/* -+ * Check if the attribute is valid and doesn't exceed the allocated region. -+ * This accounts for resident and non-resident data. -+ * -+ * This is based off the documentation from the linux-ntfs project: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+static bool -+validate_attribute (grub_uint8_t *attr, void *end) -+{ -+ grub_size_t attr_size = 0; -+ grub_size_t min_size = 0; -+ grub_size_t spare = (grub_uint8_t *) end - attr; -+ /* -+ * Just used as a temporary variable to try and deal with cases where someone -+ * tries to overlap fields. -+ */ -+ grub_size_t curr = 0; -+ -+ /* Need verify we can entirely read the attributes header. */ -+ if (attr + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) -+ goto fail; -+ -+ /* -+ * So, the rest of this code uses a 16bit int for the attribute length but -+ * from reading the all the documentation I could find it says this field is -+ * actually 32bit. But let's be consistent with the rest of the code. -+ * -+ * https://elixir.bootlin.com/linux/v6.10.7/source/fs/ntfs3/ntfs.h#L370 -+ */ -+ attr_size = u16at (attr, GRUB_NTFS_ATTRIBUTE_LENGTH); -+ -+ if (attr_size > spare) -+ goto fail; -+ -+ /* Not an error case, just reached the end of the attributes. */ -+ if (attr_size == 0) -+ return false; -+ -+ /* -+ * Extra validation by trying to calculate a minimum possible size for this -+ * attribute. +8 from the size of the resident data struct which is the -+ * minimum that can be added. -+ */ -+ min_size = GRUB_NTFS_ATTRIBUTE_HEADER_SIZE + 8; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* Is the data is resident (0) or not (1). */ -+ if (attr[GRUB_NTFS_ATTRIBUTE_RESIDENT] == 0) -+ { -+ /* Read the offset and size of the attribute. */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_RES_OFFSET); -+ curr += u32at (attr, GRUB_NTFS_ATTRIBUTE_RES_LENGTH); -+ if (curr > min_size) -+ min_size = curr; -+ } -+ else -+ { -+ /* -+ * If the data is non-resident, the minimum size is 64 which is where -+ * the data runs start. We already have a minimum size of 24. So, just -+ * adding 40 to get to the real value. -+ */ -+ min_size += 40; -+ if (min_size > attr_size) -+ goto fail; -+ /* If the compression unit size is > 0, +8 bytes*/ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE) > 0) -+ min_size += 8; -+ -+ /* -+ * Need to consider the data runs now. Each member of the run has byte -+ * that describes the size of the data length and offset. Each being -+ * 4 bits in the byte. -+ */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_DATA_RUNS); -+ -+ if (curr + 1 > min_size) -+ min_size = curr + 1; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* -+ * Each attribute can store multiple data runs which are stored -+ * continuously in the attribute. They exist as one header byte -+ * with up to 14 bytes following it depending on the lengths. -+ * We stop when we hit a header that is just a NUL byte. -+ * -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/data_runs.html -+ */ -+ while (attr[curr] != 0) -+ { -+ /* -+ * We stop when we hit a header that is just a NUL byte. The data -+ * run header is stored as a single byte where the top 4 bits refer -+ * to the number of bytes used to store the total length of the -+ * data run, and the number of bytes used to store the offset. -+ * These directly follow the header byte, so we use them to update -+ * the minimum size. -+ */ -+ min_size += (attr[curr] & 0x7) + ((attr[curr] >> 4) & 0x7); -+ curr += min_size; -+ min_size++; -+ if (min_size > attr_size) -+ goto fail; -+ } -+ } -+ -+ /* Name offset, doing this after data residence checks. */ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET) != 0) -+ { -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET); -+ /* -+ * Multiple the name length by 2 as its UTF-16. Can be zero if this in an -+ * unamed attribute. -+ */ -+ curr += attr[GRUB_NTFS_ATTRIBUTE_NAME_LENGTH] * 2; -+ if (curr > min_size) -+ min_size = curr; -+ } -+ -+ /* Padded to 8 bytes. */ -+ if (min_size % 8 != 0) -+ min_size += 8 - (min_size % 8); -+ -+ /* -+ * At this point min_size should be exactly attr_size but being flexible -+ * here to avoid any issues. -+ */ -+ if (min_size > attr_size) -+ goto fail; -+ -+ return true; -+ -+ fail: -+ grub_dprintf ("ntfs", "spare=%" PRIuGRUB_SIZE " min_size=%" PRIuGRUB_SIZE " attr_size=%" PRIuGRUB_SIZE "\n", -+ spare, min_size, attr_size); -+ return false; -+} -+ - /* Return the next attribute if it exists, otherwise return NULL. */ - static grub_uint8_t * - next_attribute (grub_uint8_t *curr_attribute, void *end) -@@ -84,6 +227,8 @@ next_attribute (grub_uint8_t *curr_attribute, void *end) - return NULL; - - next += u16at (curr_attribute, 4); -+ if (validate_attribute (next, end) == false) -+ return NULL; - - return next; - } -@@ -290,6 +435,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - /* From this point on pa_end is the end of the buffer */ - at->end = pa_end; - -+ if (validate_attribute (at->attr_nxt, pa_end) == false) -+ return NULL; -+ - while (at->attr_nxt) - { - if ((*at->attr_nxt == attr) || (attr == 0)) -@@ -319,6 +467,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - + 1)); - pa = at->attr_nxt + u16at (pa, 4); - -+ if (validate_attribute (pa, pa_end) == true) -+ pa = NULL; -+ - while (pa) - { - if (*pa != attr) -@@ -572,6 +723,8 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, - else - vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); - pa = at->attr_nxt + u16at (at->attr_nxt, 4); -+ if (validate_attribute (pa, at->attr_end) == false) -+ pa = NULL; - - while (pa) - { -diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h -index 2c8078403..77b182acf 100644 ---- a/include/grub/ntfs.h -+++ b/include/grub/ntfs.h -@@ -91,6 +91,28 @@ enum - - #define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 - -+/* -+ * To make attribute validation clearer the offsets for each value in the -+ * attribute headers are defined as macros. -+ * -+ * These offsets are all from: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+ -+/* These offsets are part of the attribute header. */ -+#define GRUB_NTFS_ATTRIBUTE_LENGTH 4 -+#define GRUB_NTFS_ATTRIBUTE_RESIDENT 8 -+#define GRUB_NTFS_ATTRIBUTE_NAME_LENGTH 9 -+#define GRUB_NTFS_ATTRIBUTE_NAME_OFFSET 10 -+ -+/* Offsets for values needed for resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_RES_LENGTH 16 -+#define GRUB_NTFS_ATTRIBUTE_RES_OFFSET 20 -+ -+/* Offsets for values needed for non-resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_DATA_RUNS 32 -+#define GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE 34 -+ - enum - { - GRUB_NTFS_AF_ALST = 1, diff --git a/grub.patches b/grub.patches index c526e11f..a34bf7ac 100644 --- a/grub.patches +++ b/grub.patches @@ -303,7 +303,6 @@ Patch0302: 0302-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch Patch0303: 0303-fs-ntfs-Fix-out-of-bounds-read.patch Patch0304: 0304-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch Patch0305: 0305-fs-ntfs-Use-a-helper-function-to-access-attributes.patch -Patch0306: 0306-fs-ntfs-Implement-attribute-verification.patch Patch0307: 0307-fs-xfs-Fix-out-of-bounds-read.patch Patch0308: 0308-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch Patch0309: 0309-kern-file-Ensure-file-data-is-set.patch diff --git a/grub2.spec b/grub2.spec index daa2987e..4c1ebbcb 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 25%{?dist} +Release: 26%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Mon Mar 10 2025 Leo Sandoval 2.12-26 +- Remove 'fs/ntfs: Implement attribute verification' patch +- Resolves: #2350327 + * Tue Feb 25 2025 Nicolas Frayer 2.12-25 - fs/ext2: Rework out-of-bounds read for inline and external extents - Resolves: #2346804 From 50b73378ce59ba59030e03631cf6dca0841e7509 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Wed, 19 Mar 2025 17:59:28 +0100 Subject: [PATCH 16/45] powerpc: increase MIN RMA size for CAS negotiation Signed-off-by: Nicolas Frayer --- ...ase-MIN-RMA-size-for-CAS-negotiation.patch | 117 ++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 +- 3 files changed, 122 insertions(+), 1 deletion(-) create mode 100644 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch diff --git a/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch b/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch new file mode 100644 index 00000000..1e7dc90d --- /dev/null +++ b/0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch @@ -0,0 +1,117 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Avnish Chouhan +Date: Thu, 13 Mar 2025 19:45:50 +0530 +Subject: [PATCH] powerpc: increase MIN RMA size for CAS negotiation + +Change RMA size from 512 MB to 768 MB which will result +in more memory at boot time for PowerPC. When vTPM, Secure Boot or +FADump are enabled on PowerPC, the 512 MB RMA memory is not sufficient for +booting. With this 512 MB RMA, GRUB2 runs out of memory and fails to +boot the machine. Sometimes even usage of CDROM requires more memory +for installation and along with the options mentioned above exhausts +the boot memory which results in boot failures. Increasing the RMA size +will resolves multiple out of memory issues observed in PowerPC. + +Failure details (GRUB2 debugs): + + kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 1 + kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space + kern/ieee1275/init.c:550: mm requested region of size 8513000, flags 0 + kern/ieee1275/init.c:563: Cannot satisfy allocation and retain minimum runtime space + kern/file.c:215: Closing `/ppc/ppc64/initrd.img' ... + kern/disk.c:297: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000'... + kern/disk.c:311: Closing `ieee1275//vdevice/v-scsi@30000067/disk@8300000000000000' succeeded. + kern/file.c:225: Closing `/ppc/ppc64/initrd.img' failed with 3. + kern/file.c:148: Opening `/ppc/ppc64/initrd.img' succeeded. + error: ../../grub-core/kern/mm.c:552:out of memory. + +Signed-off-by: Avnish Chouhan +--- + grub-core/kern/ieee1275/init.c | 51 +++++++++++++++++++++++++++++++++++++----- + 1 file changed, 46 insertions(+), 5 deletions(-) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 4ec6598cfbb8..bb791f80f41c 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -737,7 +737,7 @@ struct cas_vector + + /* + * Call ibm,client-architecture-support to try to get more RMA. +- * We ask for 512MB which should be enough to verify a distro kernel. ++ * We ask for 768MB which should be enough to verify a distro kernel. + * We ignore most errors: if we don't succeed we'll proceed with whatever + * memory we have. + */ +@@ -809,7 +809,7 @@ grub_ieee1275_ibm_cas (void) + .vec1 = 0x80, /* ignore */ + .vec2_size = 1 + sizeof (struct option_vector2) - 2, + .vec2 = { +- 0, 0, -1, -1, -1, -1, -1, 512, -1, 0, 48 ++ 0, 0, -1, -1, -1, -1, -1, 768, -1, 0, 48 + }, + .vec3_size = 2 - 1, + .vec3 = 0x00e0, /* ask for FP + VMX + DFP but don't halt if unsatisfied */ +@@ -846,6 +846,10 @@ grub_claim_heap (void) + { + grub_err_t err; + grub_uint32_t total = HEAP_MAX_SIZE; ++#if defined(__powerpc__) ++ grub_uint32_t ibm_ca_support_reboot = 0; ++ grub_ssize_t actual; ++#endif + + err = grub_ieee1275_total_mem (&rmo_top); + +@@ -858,11 +862,48 @@ grub_claim_heap (void) + grub_mm_add_region_fn = grub_ieee1275_mm_add_region; + + #if defined(__powerpc__) ++ /* Check if it's a CAS reboot with below property. If so, we will skip CAS call */ ++ if (grub_ieee1275_get_integer_property (grub_ieee1275_chosen, ++ "ibm,client-architecture-support-reboot", ++ &ibm_ca_support_reboot, ++ sizeof (ibm_ca_support_reboot), ++ &actual) >= 0) ++ grub_dprintf ("ieee1275", "ibm,client-architecture-support-reboot: %" PRIuGRUB_UINT32_T "\n", ++ ibm_ca_support_reboot); ++ + if (grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_CAN_TRY_CAS_FOR_MORE_MEMORY)) + { +- /* if we have an error, don't call CAS, just hope for the best */ +- if (err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) +- grub_ieee1275_ibm_cas (); ++ /* ++ * If we have an error, don't call CAS. Just hope for the best. ++ * Along with the above, if the rmo_top is 512 MB or above. We ++ * will skip the CAS call. However, if we call CAS, the rmo_top ++ * will be set to 768 MB via CAS Vector2. But we need to call ++ * CAS with "rmo_top < 512 MB" to avoid the issue on the older ++ * Linux kernel, which still uses rmo_top as 512 MB. If we call ++ * CAS with a condition "rmo_top < 768 MB", it will result in an ++ * issue due to the IBM CAS reboot feature and we won't be able ++ * to boot the newer kernel. Whenever a reboot is detected as ++ * the CAS reboot by GRUB. It will boot the machine with the ++ * last booted kernel by reading the variable "boot-last-label" ++ * which has the info related to the last boot and it's specific ++ * to IBM PowerPC. Due to this, the machine will boot with the ++ * last booted kernel which has rmo_top as 512 MB. Also, if the ++ * reboot is detected as a CAS reboot, the GRUB will skip the CAS ++ * call. As the CAS has already been called earlier, so it is ++ * not required to call CAS even if the other conditions are met. ++ * This condition will also prevent a scenario where the machine ++ * get stuck in the CAS reboot loop while booting. A machine with ++ * an older kernel, having option_vector2 MIN_RMA as 512 MB in ++ * Linux prom_init.c and GRUB uses "rmo_top < 768 MB" condition ++ * for calling CAS. Due to their respective conditions, linux ++ * CAS and GRUB CAS will keep doing the CAS calls and change ++ * the MIN_RMA from 768(changed by GRUB) to 512(changed by Linux) ++ * to 768(changed by GRUB) to 512(changed by Linux) and so on, ++ * and the machine will stuck in this CAS reboot loop forever. ++ * IBM PAPR : https://openpower.foundation/specifications/linuxonpower/ ++ */ ++ if (!ibm_ca_support_reboot && err == GRUB_ERR_NONE && rmo_top < (512 * 1024 * 1024)) ++ grub_ieee1275_ibm_cas (); + } + #endif + diff --git a/grub.patches b/grub.patches index a34bf7ac..1c9cbf18 100644 --- a/grub.patches +++ b/grub.patches @@ -359,3 +359,4 @@ Patch0359: 0359-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch Patch0360: 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch Patch0361: 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch Patch0362: 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch +Patch0363: 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch diff --git a/grub2.spec b/grub2.spec index 4c1ebbcb..df46e8cd 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 26%{?dist} +Release: 27%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Wed Mar 19 2025 Nicolas Frayer 2.12-27 +- powerpc: increase MIN RMA size for CAS negotiation + * Mon Mar 10 2025 Leo Sandoval 2.12-26 - Remove 'fs/ntfs: Implement attribute verification' patch - Resolves: #2350327 From c48d4f67195675dbfbcdfd8406e61ac1a9aef2f5 Mon Sep 17 00:00:00 2001 From: Nils Kattenbeck Date: Fri, 14 Mar 2025 19:15:04 +0000 Subject: [PATCH 17/45] Drop 'which' requirement Since 28a7e597de0d5584f65e36f9588ff9041936e617, occurrences of 'which' were replaced by 'command -v' Signed-off-by: Nils Kattenbeck --- grub.macros | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub.macros b/grub.macros index 417b3649..ee1687aa 100644 --- a/grub.macros +++ b/grub.macros @@ -323,7 +323,7 @@ This subpackage provides support for rebuilding your own grub.efi. \ %{expand:%%{?!buildsubdir:%%define buildsubdir grub-%%{1}-%{tarversion}}}\ %{expand:%%package %%{1}-tools} \ Summary: Support tools for GRUB. \ -Requires: gettext-runtime os-prober which file system-logos \ +Requires: gettext-runtime os-prober file system-logos \ Requires: grub2-common = %{evr} \ Requires: grub2-tools-minimal = %{evr} \ Requires: os-prober >= 1.58-11 \ From 42b2a048bf4e6497046ac6e96896d97d7957d898 Mon Sep 17 00:00:00 2001 From: James Le Cuirot Date: Mon, 24 Mar 2025 15:54:10 +0000 Subject: [PATCH 18/45] Fix the fallback mechanism when menu entries fail to boot Patch 0098 accidentally broke the fallback mechanism, although it also exposed another bug in upstream GRUB. The first of these new patches fixes the upstream bug. It has already been merged there. The second patch deals with the main issue. Signed-off-by: James Le Cuirot --- ...on-t-let-trailing-blank-lines-determ.patch | 66 +++++++++++++++++++ ...k-return-code-of-the-script-when-exe.patch | 45 +++++++++++++ grub.patches | 2 + grub2.spec | 5 +- 4 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch create mode 100644 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch diff --git a/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch b/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch new file mode 100644 index 00000000..fd2eb2bf --- /dev/null +++ b/0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch @@ -0,0 +1,66 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: James Le Cuirot +Date: Thu, 24 Oct 2024 14:42:46 +0100 +Subject: [PATCH] script/execute: Don't let trailing blank lines determine the + return code + +grub_script_execute_sourcecode() parses and executes code one line at a +time, updating the return code each time because only the last line +determines the final status. However, trailing new lines were also +executed, masking any failure on the previous line. Fix this by only +trying to execute the command when there is actually one present. + +This has presumably never been noticed because this code is not used by +regular functions, only in special cases like eval and menu entries. The +latter generally don't return at all, having booted an OS. When failing +to boot, upstream GRUB triggers the fallback mechanism regardless of the +return code. + +We noticed the problem while using Red Hat's patches, which change this +behaviour to take account of the return code. In that case, a failure +takes you back to the menu rather than triggering a fallback. + +Signed-off-by: James Le Cuirot +--- + grub-core/script/execute.c | 5 ++++- + tests/grub_script_eval.in | 10 +++++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 014132703..3d26a3fe4 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -952,7 +952,10 @@ grub_script_execute_sourcecode (const char *source) + break; + } + +- ret = grub_script_execute (parsed_script); ++ /* Don't let trailing blank lines determine the return code. */ ++ if (parsed_script->cmd) ++ ret = grub_script_execute (parsed_script); ++ + grub_script_free (parsed_script); + grub_free (line); + } +diff --git a/tests/grub_script_eval.in b/tests/grub_script_eval.in +index c97b78d77..9c6211042 100644 +--- a/tests/grub_script_eval.in ++++ b/tests/grub_script_eval.in +@@ -3,4 +3,12 @@ + eval echo "Hello world" + valname=tst + eval $valname=hi +-echo $tst +\ No newline at end of file ++echo $tst ++ ++if eval " ++false ++"; then ++ echo should have failed ++else ++ echo failed as expected ++fi +-- +2.48.1 + diff --git a/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch b/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch new file mode 100644 index 00000000..3ce0eec3 --- /dev/null +++ b/0365-normal-menu-Check-return-code-of-the-script-when-exe.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: James Le Cuirot +Date: Thu, 24 Oct 2024 15:00:26 +0100 +Subject: [PATCH] normal/menu: Check return code of the script when executing a + menu entry + +Don't rely on grub_errno here because grub_script_execute_new_scope() +calls grub_print_error(), which always resets grub_errno back to +GRUB_ERR_NONE. It may also get reset by grub_wait_after_message(). + +This problem was observed when a "bad signature" error resulted in the +menu being redisplayed rather than the fallback mechanism being +triggered, although another change was also needed to fix it. This only +happens with Red Hat's patches because upstream GRUB triggers the +fallback mechanism regardless of the return code. + +Signed-off-by: James Le Cuirot +--- + grub-core/normal/menu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index 97687013c..a2703dabb 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -377,14 +377,14 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot) + if (ptr && ptr[0] && ptr[1]) + grub_env_set ("default", ptr + 1); + +- grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); ++ err = grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args); + + if (errs_before != grub_err_printed_errors) + grub_wait_after_message (); + + errs_before = grub_err_printed_errors; + +- if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ()) ++ if (err == GRUB_ERR_NONE && grub_loader_is_loaded ()) + /* Implicit execution of boot, only if something is loaded. */ + err = grub_command_execute ("boot", 0, 0); + +-- +2.48.1 + diff --git a/grub.patches b/grub.patches index 1c9cbf18..b2beb130 100644 --- a/grub.patches +++ b/grub.patches @@ -360,3 +360,5 @@ Patch0360: 0360-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch Patch0361: 0361-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch Patch0362: 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch Patch0363: 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch +Patch0364: 0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch +Patch0365: 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch diff --git a/grub2.spec b/grub2.spec index df46e8cd..61e883cf 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 27%{?dist} +Release: 28%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue Mar 25 2025 Nicolas Frayer 2.12-28 +- Fix the fallback mechanism when menu entries fail to boot + * Wed Mar 19 2025 Nicolas Frayer 2.12-27 - powerpc: increase MIN RMA size for CAS negotiation From cbf45b1f246d8ce54cb403866569b021caafb882 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 25 Mar 2025 19:17:46 +0100 Subject: [PATCH 19/45] ieee1275/ofnet: Fix grub_malloc() removed after added safe Signed-off-by: Nicolas Frayer --- ...ix-grub_malloc-removed-after-added-s.patch | 32 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 ++- 3 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch diff --git a/0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch b/0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch new file mode 100644 index 00000000..92da0261 --- /dev/null +++ b/0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 19 Mar 2025 17:39:41 +0100 +Subject: [PATCH] ieee1275/ofnet: Fix grub_malloc() removed after added safe + math functions + +grub_malloc() has been inadvertently removed from the ieee1275/ofnet +code after it has been modified to use safe match function. + +Fixes: 4beeff8a (net: Use safe math macros to prevent overflows) + +Tested-by: Marta Lewandowska +Reviewed-by: Daniel Kiper +Signed-off-by: Nicolas Frayer +--- + grub-core/net/drivers/ieee1275/ofnet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index 3e1b9094e2ab..37bc82467f60 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -463,6 +463,9 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + return 0; + } + } ++ ++ ofdata->path = grub_malloc(sz); ++ + if (!ofdata->path) + { + grub_print_error (); diff --git a/grub.patches b/grub.patches index b2beb130..f66be291 100644 --- a/grub.patches +++ b/grub.patches @@ -362,3 +362,4 @@ Patch0362: 0362-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch Patch0363: 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch Patch0364: 0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch Patch0365: 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch +Patch0366: 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch diff --git a/grub2.spec b/grub2.spec index 61e883cf..fd57f0a2 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 28%{?dist} +Release: 29%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue Mar 25 2025 Nicolas Frayer 2.12-29 +- ieee1275/ofnet: Fix grub_malloc() removed after added safe + * Tue Mar 25 2025 Nicolas Frayer 2.12-28 - Fix the fallback mechanism when menu entries fail to boot From 439310c622c2e8b6f8485c438741098f61aca61f Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Tue, 25 Mar 2025 13:12:15 -0600 Subject: [PATCH 20/45] do-sync: helper script to sync dist-git and git branches The bootloader team manually synchronizes several git branches on the rhboot/grub (git) repository based on dist-git (dist-git) repository. Although this task is simple, it is a maintenance burden, usually done much after the dist-git repository is updated, having out-of-sync git branches most of the time. The goal of the included script is to create a temporal branch based on latest git branch then include those possible missing dist-git patches and finally push it. Signed-off-by: Leo Sandoval --- do-sync | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100755 do-sync diff --git a/do-sync b/do-sync new file mode 100755 index 00000000..bfb2371c --- /dev/null +++ b/do-sync @@ -0,0 +1,89 @@ +#!/bin/bash + +set -o nounset +set -o errexit + +usage() { + echo "Usage $0 :::" + echo "Generates a (rhboot) grub2 branch which contains latest patches from dist-git based on specific Fedora/RHEL version" + echo "Command expects a single parameter delimited with colons, with the following meanings:" + echo " pkgtool: Package tool, e.g. fedpkg, rhpkg, etc." + echo " dist_git_branch: The dist-git branch/release to sync" + echo " git_branch: The git branch/release to sync" + echo " git_base_commit: base commit where git_branch is based on" + echo + echo "Examples:" + echo + echo " $0 fedpkg:rawhide:fedora-43:grub-2.12" + echo " $0 fedpkg:f42:fedora-42:grub-2.12" + echo " $0 fedpkg:f41:fedora-41:grub-2.12" + echo " $0 fedpkg:f40:fedora-40:grub-2.12" + echo + echo "Also handles RHEL branches:" + echo + echo " $0 rhpkg:rhel-10-main:rhel-10-main:grub-2.12" + echo " $0 rhpkg:rhel-9-main:rhel-9-main:grub-2.06" + echo " $0 rhpkg:rhel-8-main:rhel-8-main:f28-branchpoint" + exit 1 +} + +# check params +[ $# -eq 1 ] || usage + +args=$1 + +pkgtool=$(echo "$args" | awk -F ':' '{print $1}') +dist_git_branch=$(echo "$args" | awk -F ':' '{print $2}') +git_branch=$(echo "$args" | awk -F ':' '{print $3}') +git_base_commit=$(echo "$args" | awk -F ':' '{print $4}') + +# working dirs +dist_git_dir=/tmp/grub/dist-git +git_dir=/tmp/grub/git + +rm -rf $dist_git_dir $git_dir +mkdir -p $dist_git_dir $git_dir + + +pushd $dist_git_dir > /dev/null +{ + # clone grub2 package anonymously + $pkgtool clone -a grub2 . 2>/dev/null + + # create a local branch, all fine if already exists + git checkout -q -b "$dist_git_branch" origin/"$dist_git_branch" 2> /dev/null || true +} +popd > /dev/null + + +pushd $git_dir > /dev/null +{ + git clone -q git@github.com:rhboot/grub2.git . 2>/dev/null + + dist_git_sync_branch=${git_branch}-dist-git-$(date +"%Y-%m-%d-%H_%M_%S") + git checkout -q -b "$dist_git_sync_branch" "$git_base_commit" + while read -r line; do + p=$(echo "$line" | awk '{print $2}') + git am -q "$dist_git_dir/$p" 2>/dev/null + done < $dist_git_dir/grub.patches + + # brach current git_branch based on upstream git_branch + git branch -D "$git_branch" 2>/dev/null || true + git checkout -q -b "$git_branch" origin/"$git_branch" + + missing_commits=$(git cherry "${git_branch}" "${dist_git_sync_branch}" | grep ^+ | wc -l) + if [[ $missing_commits -eq 0 ]]; then + echo "Branch $git_branch is up-to-date, no need to sync" + else + echo "Missing commits ($missing_commits) which would be integrated in final branch" + git cherry "$git_branch" "$dist_git_sync_branch" -v | grep ^+ + # finally cherry pick those missing patches + git cherry "$git_branch" "$dist_git_sync_branch" 2>/dev/null | grep ^+ | sed 's/\+ //' | xargs git cherry-pick 2>/dev/null + + echo "Pushing latest commits" + cd "$git_dir" + git push -v origin "$git_branch" + fi +} +popd > /dev/null + From 5c361bf70675268ba79cc904eaa601e3b3470a99 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Fri, 18 Apr 2025 16:42:30 +0200 Subject: [PATCH 21/45] ppc/mkimage: SBAT support on powerpc Signed-off-by: Nicolas Frayer --- ...mkimage-Create-new-ELF-note-for-SBAT.patch | 167 ++++++++++++++++++ ...-SBAT-metadata-into-ELF-note-for-Pow.patch | 45 +++++ grub.patches | 2 + grub2.spec | 5 +- 4 files changed, 218 insertions(+), 1 deletion(-) create mode 100644 0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch create mode 100644 0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch diff --git a/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch b/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch new file mode 100644 index 00000000..25023c80 --- /dev/null +++ b/0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch @@ -0,0 +1,167 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Sudhakar Kuppusamy +Date: Wed, 23 Oct 2024 17:54:32 +0530 +Subject: [PATCH] grub-mkimage: Create new ELF note for SBAT + +In order to store the SBAT data we create a new ELF note. The string +".sbat", zero-padded to 4 byte alignment, shall be entered in the name +field. The string "SBAT"'s ASCII values, 0x53424154, should be entered +in the type field. + +Signed-off-by: Daniel Axtens +Signed-off-by: Sudhakar Kuppusamy +Reviewed-by: Daniel Kiper +--- + include/grub/util/mkimage.h | 4 ++-- + util/grub-mkimagexx.c | 48 +++++++++++++++++++++++++++++++++++++++++++-- + util/mkimage.c | 5 +++-- + 3 files changed, 51 insertions(+), 6 deletions(-) + +diff --git a/include/grub/util/mkimage.h b/include/grub/util/mkimage.h +index 6f1da89b9b65..881e3031f41f 100644 +--- a/include/grub/util/mkimage.h ++++ b/include/grub/util/mkimage.h +@@ -51,12 +51,12 @@ grub_mkimage_load_image64 (const char *kernel_path, + const struct grub_install_image_target_desc *image_target); + void + grub_mkimage_generate_elf32 (const struct grub_install_image_target_desc *image_target, +- int note, size_t appsig_size, char **core_img, size_t *core_size, ++ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, + Elf32_Addr target_addr, + struct grub_mkimage_layout *layout); + void + grub_mkimage_generate_elf64 (const struct grub_install_image_target_desc *image_target, +- int note, size_t appsig_size, char **core_img, size_t *core_size, ++ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, + Elf64_Addr target_addr, + struct grub_mkimage_layout *layout); + +diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c +index 9488f052510a..b9930544889d 100644 +--- a/util/grub-mkimagexx.c ++++ b/util/grub-mkimagexx.c +@@ -116,6 +116,14 @@ struct section_metadata + const char *strtab; + }; + ++#define GRUB_SBAT_NOTE_NAME ".sbat" ++#define GRUB_SBAT_NOTE_TYPE 0x53424154 /* "SBAT" */ ++ ++struct grub_sbat_note { ++ Elf32_Nhdr header; ++ char name[ALIGN_UP(sizeof(GRUB_SBAT_NOTE_NAME), 4)]; ++}; ++ + static int + is_relocatable (const struct grub_install_image_target_desc *image_target) + { +@@ -217,7 +225,7 @@ grub_arm_reloc_jump24 (grub_uint32_t *target, Elf32_Addr sym_addr) + + void + SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc *image_target, +- int note, size_t appsig_size, char **core_img, size_t *core_size, ++ int note, size_t appsig_size, char *sbat, char **core_img, size_t *core_size, + Elf_Addr target_addr, + struct grub_mkimage_layout *layout) + { +@@ -226,10 +234,17 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc + Elf_Ehdr *ehdr; + Elf_Phdr *phdr; + Elf_Shdr *shdr; +- int header_size, footer_size = 0; ++ int header_size, footer_size = 0, footer_offset = 0; + int phnum = 1; + int shnum = 4; + int string_size = sizeof (".text") + sizeof ("mods") + 1; ++ char *footer; ++ ++ if (sbat) ++ { ++ phnum++; ++ footer_size += ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); ++ } + + if (appsig_size) + { +@@ -263,6 +278,7 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc + ehdr = (void *) elf_img; + phdr = (void *) (elf_img + sizeof (*ehdr)); + shdr = (void *) (elf_img + sizeof (*ehdr) + phnum * sizeof (*phdr)); ++ footer = elf_img + program_size + header_size; + memcpy (ehdr->e_ident, ELFMAG, SELFMAG); + ehdr->e_ident[EI_CLASS] = ELFCLASSXX; + if (!image_target->bigendian) +@@ -435,6 +451,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc + phdr->p_filesz = grub_host_to_target32 (XEN_NOTE_SIZE); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size); ++ footer = ptr; ++ footer_offset = XEN_NOTE_SIZE; + } + + if (image_target->id == IMAGE_XEN_PVH) +@@ -468,6 +486,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc + phdr->p_filesz = grub_host_to_target32 (XEN_PVH_NOTE_SIZE); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size); ++ footer = ptr; ++ footer_offset = XEN_PVH_NOTE_SIZE; + } + + if (note) +@@ -498,6 +518,30 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc + phdr->p_filesz = grub_host_to_target32 (note_size); + phdr->p_memsz = 0; + phdr->p_offset = grub_host_to_target32 (header_size + program_size); ++ footer = (elf_img + program_size + header_size + note_size); ++ footer_offset += note_size; ++ } ++ ++ if (sbat) ++ { ++ int note_size = ALIGN_UP (sizeof (struct grub_sbat_note) + layout->sbat_size, 4); ++ struct grub_sbat_note *note_ptr = (struct grub_sbat_note *) footer; ++ ++ note_ptr->header.n_namesz = grub_host_to_target32 (sizeof (GRUB_SBAT_NOTE_NAME)); ++ note_ptr->header.n_descsz = grub_host_to_target32 (ALIGN_UP(layout->sbat_size, 4)); ++ note_ptr->header.n_type = grub_host_to_target32 (GRUB_SBAT_NOTE_TYPE); ++ memcpy (note_ptr->name, GRUB_SBAT_NOTE_NAME, sizeof (GRUB_SBAT_NOTE_NAME)); ++ memcpy ((char *)(note_ptr + 1), sbat, layout->sbat_size); ++ ++ phdr++; ++ phdr->p_type = grub_host_to_target32 (PT_NOTE); ++ phdr->p_flags = grub_host_to_target32 (PF_R); ++ phdr->p_align = grub_host_to_target32 (image_target->voidp_sizeof); ++ phdr->p_vaddr = 0; ++ phdr->p_paddr = 0; ++ phdr->p_filesz = grub_host_to_target32 (note_size); ++ phdr->p_memsz = 0; ++ phdr->p_offset = grub_host_to_target32 (header_size + program_size + footer_offset); + } + + if (appsig_size) { +diff --git a/util/mkimage.c b/util/mkimage.c +index f31fdefa814a..7fa6a7b21954 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -1848,6 +1848,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + case IMAGE_I386_IEEE1275: + { + grub_uint64_t target_addr; ++ char *sbat = NULL; + if (image_target->id == IMAGE_LOONGSON_ELF) + { + if (comp == GRUB_COMPRESSION_NONE) +@@ -1859,10 +1860,10 @@ grub_install_generate_image (const char *dir, const char *prefix, + else + target_addr = image_target->link_addr; + if (image_target->voidp_sizeof == 4) +- grub_mkimage_generate_elf32 (image_target, note, appsig_size, &core_img, ++ grub_mkimage_generate_elf32 (image_target, note, appsig_size, sbat, &core_img, + &core_size, target_addr, &layout); + else +- grub_mkimage_generate_elf64 (image_target, note, appsig_size, &core_img, ++ grub_mkimage_generate_elf64 (image_target, note, appsig_size, sbat, &core_img, + &core_size, target_addr, &layout); + } + break; diff --git a/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch b/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch new file mode 100644 index 00000000..1ce74aed --- /dev/null +++ b/0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Sudhakar Kuppusamy +Date: Wed, 23 Oct 2024 17:54:33 +0530 +Subject: [PATCH] grub-mkimage: Add SBAT metadata into ELF note for PowerPC + targets + +The SBAT metadata is read from CSV file and transformed into an ELF note +with the -s option. + +Signed-off-by: Daniel Axtens +Signed-off-by: Sudhakar Kuppusamy +Reviewed-by: Daniel Kiper +--- + util/mkimage.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/util/mkimage.c b/util/mkimage.c +index 7fa6a7b21954..f92949d1df25 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -957,8 +957,8 @@ grub_install_generate_image (const char *dir, const char *prefix, + total_module_size += dtb_size + sizeof (struct grub_module_header); + } + +- if (sbat_path != NULL && image_target->id != IMAGE_EFI) +- grub_util_error (_(".sbat section can be embedded into EFI images only")); ++ if (sbat_path != NULL && (image_target->id != IMAGE_EFI && image_target->id != IMAGE_PPC)) ++ grub_util_error (_("SBAT data can be added only to EFI or powerpc-ieee1275 images")); + + if (disable_shim_lock) + total_module_size += sizeof (struct grub_module_header); +@@ -1849,6 +1849,13 @@ grub_install_generate_image (const char *dir, const char *prefix, + { + grub_uint64_t target_addr; + char *sbat = NULL; ++ if (sbat_path != NULL) ++ { ++ sbat_size = grub_util_get_image_size (sbat_path); ++ sbat = xmalloc (sbat_size); ++ grub_util_load_image (sbat_path, sbat); ++ layout.sbat_size = sbat_size; ++ } + if (image_target->id == IMAGE_LOONGSON_ELF) + { + if (comp == GRUB_COMPRESSION_NONE) diff --git a/grub.patches b/grub.patches index f66be291..84b88325 100644 --- a/grub.patches +++ b/grub.patches @@ -363,3 +363,5 @@ Patch0363: 0363-powerpc-increase-MIN-RMA-size-for-CAS-negotiation.patch Patch0364: 0364-script-execute-Don-t-let-trailing-blank-lines-determ.patch Patch0365: 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch Patch0366: 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch +Patch0367: 0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch +Patch0368: 0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch diff --git a/grub2.spec b/grub2.spec index fd57f0a2..80339324 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 29%{?dist} +Release: 30%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Fri Apr 18 2025 Nicolas Frayer - 2.12-30 +- ppc/mkimage: SBAT support on powerpc + * Tue Mar 25 2025 Nicolas Frayer 2.12-29 - ieee1275/ofnet: Fix grub_malloc() removed after added safe From ffc692d90ebf145f491a91deb22fb715cd699ec4 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Wed, 7 May 2025 14:03:06 -0600 Subject: [PATCH 22/45] Handle special kernel parameter characters properly Resolves: #2362821 Signed-off-by: Leo Sandoval --- ...pe-kernel-option-characters-properly.patch | 47 +++++++++++++++++++ ...variable-is-escaped-before-consideri.patch | 26 ++++++++++ grub.patches | 2 + grub2.spec | 6 ++- 4 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 0369-10_linux.in-escape-kernel-option-characters-properly.patch create mode 100644 0370-blscfg-check-if-variable-is-escaped-before-consideri.patch diff --git a/0369-10_linux.in-escape-kernel-option-characters-properly.patch b/0369-10_linux.in-escape-kernel-option-characters-properly.patch new file mode 100644 index 00000000..fe245e8e --- /dev/null +++ b/0369-10_linux.in-escape-kernel-option-characters-properly.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:23:37 -0600 +Subject: [PATCH] 10_linux.in: escape kernel option characters properly + +This handles cases where kernel options, specifically the values, +contain special characters, in this case ';', '&' and '$'. + +For example, the user defines the following GRUB_CMDLINE_LINUX on the +default grub file /etc/default/grub, note the dolar sign on the 'memmap' +option + + GRUB_CMDLINE_LINUX="console=ttyS0 memmap=32g\\\$0x2000000000" + +then regenerating the grub cfg and BLS options line with the +grub2-mkconfig command, resulting into + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g\$0x2000000000 + +without this patch, we would end up with + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g$0x2000000000 + +Note the missing '\' which is required to escape the '$', otherwise +it would be consider a variable by blscfg parser which is not the case. + +Signed-off-by: Leo Sandoval +--- + util/grub.d/10_linux.in | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 11c19304f8..cdfb72a1e3 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -178,6 +178,9 @@ update_bls_cmdline() + options="${options} ${GRUB_CMDLINE_LINUX_DEBUG}" + fi + options="$(echo "${options}" | sed -e 's/\//\\\//g')" ++ options="$(echo "${options}" | sed -e 's/\;/\\\;/g')" ++ options="$(echo "${options}" | sed -e 's/\\&/\\\\&/g')" ++ options="$(echo "${options}" | sed -e 's/\$/\\\$/g')" + sed -i -e "s/^options.*/options ${options}/" "${blsdir}/${bls}.conf" + done + } diff --git a/0370-blscfg-check-if-variable-is-escaped-before-consideri.patch b/0370-blscfg-check-if-variable-is-escaped-before-consideri.patch new file mode 100644 index 00000000..fba69064 --- /dev/null +++ b/0370-blscfg-check-if-variable-is-escaped-before-consideri.patch @@ -0,0 +1,26 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:49:47 -0600 +Subject: [PATCH] blscfg: check if variable is escaped before considering one + +Otherwise escaped variables are considered real variables. + +Signed-off-by: Leo Sandoval +--- + grub-core/commands/blscfg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 6e398fc175..5d931b0c9b 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -695,7 +695,8 @@ static char *expand_val(const char *value) + return NULL; + + while (*value) { +- if (*value == '$') { ++ /* It's a variable only when *value is '$' and it is not escaped with '\'*/ ++ if (*value == '$' && *end != '\\') { + if (start != end) { + buffer = field_append(is_var, buffer, start, end); + if (!buffer) diff --git a/grub.patches b/grub.patches index 84b88325..35da1c35 100644 --- a/grub.patches +++ b/grub.patches @@ -365,3 +365,5 @@ Patch0365: 0365-normal-menu-Check-return-code-of-the-script-when-exe.patch Patch0366: 0366-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch Patch0367: 0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch Patch0368: 0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch +Patch0369: 0369-10_linux.in-escape-kernel-option-characters-properly.patch +Patch0370: 0370-blscfg-check-if-variable-is-escaped-before-consideri.patch diff --git a/grub2.spec b/grub2.spec index 80339324..24a99e05 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 30%{?dist} +Release: 31%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue May 6 2025 Leo Sandoval 2.12-31 +- Handle special kernel parameter characters properly +- Resolves: #2362821 + * Fri Apr 18 2025 Nicolas Frayer - 2.12-30 - ppc/mkimage: SBAT support on powerpc From 9fa1c31cb25091d51f93d1b0104eb0ebf2e3ca08 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Tue, 6 May 2025 12:50:25 -0600 Subject: [PATCH 23/45] Fix cryptodisk vulnerabilities Resolves: CVE-2025-4382 Signed-off-by: Leo Sandoval --- ...er-Block-the-rescue-mode-until-the-C.patch | 30 ++++ ...Introduce-the-cryptodisk-only-argume.patch | 133 ++++++++++++++++ ...er-Introduce-the-cryptocheck-command.patch | 133 ++++++++++++++++ ...ds-search-Add-the-diskfilter-support.patch | 67 ++++++++ ...cument-available-crypto-disks-checks.patch | 68 ++++++++ ...odisk-Add-the-erase-secrets-function.patch | 147 ++++++++++++++++++ ...disk-Wipe-the-passphrase-from-memory.patch | 29 ++++ 0378-cryptocheck-Add-quiet-option.patch | 114 ++++++++++++++ grub.patches | 8 + grub2.spec | 6 +- 10 files changed, 734 insertions(+), 1 deletion(-) create mode 100644 0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch create mode 100644 0372-commands-search-Introduce-the-cryptodisk-only-argume.patch create mode 100644 0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch create mode 100644 0374-commands-search-Add-the-diskfilter-support.patch create mode 100644 0375-docs-Document-available-crypto-disks-checks.patch create mode 100644 0376-disk-cryptodisk-Add-the-erase-secrets-function.patch create mode 100644 0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch create mode 100644 0378-cryptocheck-Add-quiet-option.patch diff --git a/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch b/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch new file mode 100644 index 00000000..5d588b1c --- /dev/null +++ b/0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Fri, 28 Feb 2025 17:00:53 +0300 +Subject: [PATCH] kern/rescue_reader: Block the rescue mode until the CLI + authentication + +This further mitigates potential misuse of the CLI after the +root device has been successfully unlocked via TPM. + +Fixes: CVE-2025-4382 + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/kern/rescue_reader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c +index 4259857ba9..a71ada8fb7 100644 +--- a/grub-core/kern/rescue_reader.c ++++ b/grub-core/kern/rescue_reader.c +@@ -79,7 +79,7 @@ void __attribute__ ((noreturn)) + grub_rescue_run (void) + { + /* Stall if the CLI has been disabled */ +- if (grub_is_cli_disabled ()) ++ if (grub_is_cli_disabled () || grub_is_cli_need_auth ()) + { + grub_printf ("Rescue mode has been disabled...\n"); + diff --git a/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch b/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch new file mode 100644 index 00000000..53e7eaae --- /dev/null +++ b/0372-commands-search-Introduce-the-cryptodisk-only-argume.patch @@ -0,0 +1,133 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Sat, 1 Mar 2025 14:16:48 +0300 +Subject: [PATCH] commands/search: Introduce the --cryptodisk-only argument + +This allows users to restrict the "search" command's scope to +encrypted disks only. + +Typically, this command is used to "rebase" $root and $prefix +before loading additional configuration files via "source" or +"configfile". Unfortunately, this leads to security problems, +like CVE-2023-4001, when an unexpected, attacker-controlled +device is chosen by the "search" command. + +The --cryptodisk-only argument allows users to ensure that the +file system picked is encrypted. + +This feature supports the CLI authentication, blocking bypass +attempts. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/commands/search.c | 20 ++++++++++++++++++++ + grub-core/commands/search_wrap.c | 7 ++++++- + grub-core/normal/main.c | 3 ++- + include/grub/search.h | 9 +++++---- + 4 files changed, 33 insertions(+), 6 deletions(-) + +diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c +index d538b36219..84362b54b3 100644 +--- a/grub-core/commands/search.c ++++ b/grub-core/commands/search.c +@@ -182,6 +182,26 @@ iterate_device (const char *name, void *data) + grub_device_close (dev); + } + ++ /* Limit to encrypted disks when requested. */ ++ if (ctx->flags & SEARCH_FLAGS_CRYPTODISK_ONLY) ++ { ++ grub_device_t dev; ++ ++ dev = grub_device_open (name); ++ if (dev == NULL) ++ { ++ grub_errno = GRUB_ERR_NONE; ++ return 0; ++ } ++ if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) ++ { ++ grub_device_close (dev); ++ grub_errno = GRUB_ERR_NONE; ++ return 0; ++ } ++ grub_device_close (dev); ++ } ++ + /* Skip it if it's not the root device when requested. */ + if (ctx->flags & SEARCH_FLAGS_ROOTDEV_ONLY) + { +diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c +index 4fe6440c65..ec2fb638f1 100644 +--- a/grub-core/commands/search_wrap.c ++++ b/grub-core/commands/search_wrap.c +@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] = + ARG_TYPE_STRING}, + {"no-floppy", 'n', 0, N_("Do not probe any floppy drive."), 0, 0}, + {"efidisk-only", 0, 0, N_("Only probe EFI disks."), 0, 0}, ++ {"cryptodisk-only", 0, 0, N_("Only probe encrypted disks."), 0, 0}, + {"root-dev-only", 'r', 0, N_("Only probe root device."), 0, 0}, + {"hint", 'h', GRUB_ARG_OPTION_REPEATABLE, + N_("First try the device HINT. If HINT ends in comma, " +@@ -76,6 +77,7 @@ enum options + SEARCH_SET, + SEARCH_NO_FLOPPY, + SEARCH_EFIDISK_ONLY, ++ SEARCH_CRYPTODISK_ONLY, + SEARCH_ROOTDEV_ONLY, + SEARCH_HINT, + SEARCH_HINT_IEEE1275, +@@ -191,6 +193,9 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args) + if (state[SEARCH_EFIDISK_ONLY].set) + flags |= SEARCH_FLAGS_EFIDISK_ONLY; + ++ if (state[SEARCH_CRYPTODISK_ONLY].set) ++ flags |= SEARCH_FLAGS_CRYPTODISK_ONLY; ++ + if (state[SEARCH_ROOTDEV_ONLY].set) + flags |= SEARCH_FLAGS_ROOTDEV_ONLY; + +@@ -215,7 +220,7 @@ GRUB_MOD_INIT(search) + cmd = + grub_register_extcmd ("search", grub_cmd_search, + GRUB_COMMAND_FLAG_EXTRACTOR | GRUB_COMMAND_ACCEPT_DASH, +- N_("[-f|-l|-u|-s|-n] [--hint HINT [--hint HINT] ...]" ++ N_("[-f|-l|-u|-s|-n] [--cryptodisk-only] [--hint HINT [--hint HINT] ...]" + " NAME"), + N_("Search devices by file, filesystem label" + " or filesystem UUID." +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index dd20e51290..6f7290a897 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -615,7 +615,8 @@ static const char *features[] = { + "feature_chainloader_bpb", "feature_ntldr", "feature_platform_search_hint", + "feature_default_font_path", "feature_all_video_module", + "feature_menuentry_id", "feature_menuentry_options", "feature_200_final", +- "feature_nativedisk_cmd", "feature_timeout_style" ++ "feature_nativedisk_cmd", "feature_timeout_style", ++ "feature_search_cryptodisk_only" + }; + + GRUB_MOD_INIT(normal) +diff --git a/include/grub/search.h b/include/grub/search.h +index 9343c66b13..b6b5c8be1f 100644 +--- a/include/grub/search.h ++++ b/include/grub/search.h +@@ -21,10 +21,11 @@ + + enum search_flags + { +- SEARCH_FLAGS_NONE = 0, +- SEARCH_FLAGS_NO_FLOPPY = 1, +- SEARCH_FLAGS_EFIDISK_ONLY = 2, +- SEARCH_FLAGS_ROOTDEV_ONLY = 4 ++ SEARCH_FLAGS_NONE = 0, ++ SEARCH_FLAGS_NO_FLOPPY = 1, ++ SEARCH_FLAGS_EFIDISK_ONLY = 2, ++ SEARCH_FLAGS_ROOTDEV_ONLY = 4, ++ SEARCH_FLAGS_CRYPTODISK_ONLY = 8 + }; + + void grub_search_fs_file (const char *key, const char *var, diff --git a/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch b/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch new file mode 100644 index 00000000..a56fc858 --- /dev/null +++ b/0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch @@ -0,0 +1,133 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Sun, 2 Mar 2025 18:08:22 +0300 +Subject: [PATCH] disk/diskfilter: Introduce the "cryptocheck" command + +This command examines a given diskfilter device, e.g., an LVM disk, +and checks if underlying disks, physical volumes, are cryptodisks, +e.g., LUKS disks, this layout is called "LVM-on-LUKS". + +The return value is 0 when all underlying disks (of a given device) +are cryptodisks (1 if at least one disk is unencrypted or in an +unknown state). + +Users are encouraged to include the relevant check before loading +anything from an LVM disk that is supposed to be encrypted. + +This further supports the CLI authentication, blocking bypass +attempts when booting from an encrypted LVM disk. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/disk/diskfilter.c | 75 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 75 insertions(+) + +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index fef0b815ab..216be6a782 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1365,6 +1366,73 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk, + } + #endif + ++static int ++grub_diskfilter_check_pvs_encrypted (grub_disk_t disk, int *pvs_cnt) ++{ ++ struct grub_diskfilter_lv *lv = disk->data; ++ struct grub_diskfilter_pv *pv; ++ ++ *pvs_cnt = 0; ++ ++ if (lv->vg->pvs) ++ for (pv = lv->vg->pvs; pv; pv = pv->next) ++ { ++ (*pvs_cnt)++; ++ ++ if (pv->disk == NULL) ++ { ++ /* Can be a partially activated VG, bail out. */ ++ return GRUB_ERR_TEST_FAILURE; ++ } ++ ++ if (pv->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) ++ { ++ /* All backing devices must be cryptodisks, stop. */ ++ return GRUB_ERR_TEST_FAILURE; ++ } ++ } ++ return GRUB_ERR_NONE; ++} ++ ++static grub_err_t ++grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), ++ int argc, char **args) ++{ ++ grub_disk_t disk; ++ int check_pvs_res; ++ int namelen; ++ int pvs_cnt; ++ ++ if (argc != 1) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); ++ ++ namelen = grub_strlen (args[0]); ++ if (namelen > 2 && (args[0][0] == '(') && (args[0][namelen - 1] == ')')) ++ args[0][namelen - 1] = 0; ++ else ++ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("invalid disk: %s"), ++ args[0]); ++ ++ if (!is_valid_diskfilter_name (&args[0][1])) ++ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("unrecognized disk: %s"), ++ &args[0][1]); ++ ++ disk = grub_disk_open (&args[0][1]); ++ if (disk == NULL) ++ return grub_error (GRUB_ERR_UNKNOWN_DEVICE, N_("no such disk: %s"), ++ &args[0][1]); ++ ++ check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); ++ grub_disk_close (disk); ++ ++ grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], ++ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", ++ pvs_cnt, ++ (pvs_cnt > 1) ? "s" : ""); ++ ++ return check_pvs_res; ++} ++ + static struct grub_disk_dev grub_diskfilter_dev = + { + .name = "diskfilter", +@@ -1381,14 +1449,21 @@ static struct grub_disk_dev grub_diskfilter_dev = + .next = 0 + }; + ++static grub_command_t cmd; ++ + + GRUB_MOD_INIT(diskfilter) + { + grub_disk_dev_register (&grub_diskfilter_dev); ++ cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, ++ N_("DEVICE"), ++ N_("Check if a logical volume resides on encrypted disks.")); + } + + GRUB_MOD_FINI(diskfilter) + { + grub_disk_dev_unregister (&grub_diskfilter_dev); ++ if (cmd != NULL) ++ grub_unregister_command (cmd); + free_array (); + } diff --git a/0374-commands-search-Add-the-diskfilter-support.patch b/0374-commands-search-Add-the-diskfilter-support.patch new file mode 100644 index 00000000..5edb3ea8 --- /dev/null +++ b/0374-commands-search-Add-the-diskfilter-support.patch @@ -0,0 +1,67 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Sun, 2 Mar 2025 23:32:43 +0300 +Subject: [PATCH] commands/search: Add the diskfilter support + +When the --cryptodisk-only argument is given, also check the target +device using the "cryptocheck" command, if available. + +This extends the checks to common layouts like LVM-on-LUKS, so the +--cryptodisk-only argument transparently handles such setups. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/commands/search.c | 32 +++++++++++++++++++++++++++++++- + 1 file changed, 31 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c +index 84362b54b3..1cf714ad7d 100644 +--- a/grub-core/commands/search.c ++++ b/grub-core/commands/search.c +@@ -150,6 +150,36 @@ check_for_duplicate (const char *name, void *data) + return ret; + } + ++static bool ++is_unencrypted_disk (grub_disk_t disk) ++{ ++ grub_command_t cmd; ++ char *disk_str; ++ int disk_str_len; ++ int res; ++ ++ if (disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) ++ return false; /* This is (crypto) disk. */ ++ ++ if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) ++ { ++ cmd = grub_command_find ("cryptocheck"); ++ if (cmd == NULL) /* No diskfilter module loaded for some reason. */ ++ return true; ++ ++ disk_str_len = grub_strlen (disk->name) + 2 + 1; ++ disk_str = grub_malloc (disk_str_len); ++ if (disk_str == NULL) /* Something is wrong, better report as unencrypted. */ ++ return true; ++ ++ grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); ++ res = cmd->func (cmd, 1, &disk_str); ++ grub_free (disk_str); ++ return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ ++ } ++ return true; ++} ++ + /* Helper for FUNC_NAME. */ + static int + iterate_device (const char *name, void *data) +@@ -193,7 +223,7 @@ iterate_device (const char *name, void *data) + grub_errno = GRUB_ERR_NONE; + return 0; + } +- if (dev->disk == NULL || dev->disk->dev->id != GRUB_DISK_DEVICE_CRYPTODISK_ID) ++ if (dev->disk == NULL || is_unencrypted_disk (dev->disk) == true) + { + grub_device_close (dev); + grub_errno = GRUB_ERR_NONE; diff --git a/0375-docs-Document-available-crypto-disks-checks.patch b/0375-docs-Document-available-crypto-disks-checks.patch new file mode 100644 index 00000000..ac22920f --- /dev/null +++ b/0375-docs-Document-available-crypto-disks-checks.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 10 Mar 2025 15:33:46 +0300 +Subject: [PATCH] docs: Document available crypto disks checks + +Document the --cryptodisk-only argument. Also, document the +"cryptocheck" command invoked when that argument is processed. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 2d6d73a78d..93e23be99d 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4365,6 +4365,7 @@ you forget a command, you can run the command @command{help} + * configfile:: Load a configuration file + * cpuid:: Check for CPU features + * crc:: Compute or check CRC32 checksums ++* cryptocheck:: Check if a device is encrypted + * cryptomount:: Mount a crypto device + * cutmem:: Remove memory regions + * date:: Display or set current date and time +@@ -4674,6 +4675,16 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} + (@pxref{hashsum}) for full description. + @end deffn + ++@node cryptocheck ++@subsection cryptocheck ++ ++@deffn Command cryptocheck device ++Check if a given diskfilter device is backed by encrypted devices ++(@pxref{cryptomount} for additional information). ++ ++The command examines all backing devices, physical volumes, of a specified ++logical volume, like LVM2, and fails when at least one of them is unencrypted. ++@end deffn + + @node cryptomount + @subsection cryptomount +@@ -5522,7 +5533,8 @@ unbootable. @xref{Using GPG-style digital signatures}, for more information. + + @deffn Command search @ + [@option{--file}|@option{--label}|@option{--fs-uuid}] @ +- [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}] name ++ [@option{--set} [var]] [@option{--no-floppy}|@option{--efidisk-only}|@option{--cryptodisk-only}] @ ++ name + Search devices by file (@option{-f}, @option{--file}), filesystem label + (@option{-l}, @option{--label}), or filesystem UUID (@option{-u}, + @option{--fs-uuid}). +@@ -5537,6 +5549,14 @@ devices, which can be slow. + The (@option{--efidisk-only}) option prevents searching any other devices then + EFI disks. This is typically used when chainloading to local EFI partition. + ++The (@option{--cryptodisk-only}) option prevents searching any devices other ++than encrypted disks. This is typically used when booting from an encrypted ++file system to ensure that no code gets executed from an unencrypted device ++having the same filesystem UUID or label. ++ ++This option implicitly invokes the command @command{cryptocheck}, if it is ++available (@pxref{cryptocheck} for additional information). ++ + The @samp{search.file}, @samp{search.fs_label}, and @samp{search.fs_uuid} + commands are aliases for @samp{search --file}, @samp{search --label}, and + @samp{search --fs-uuid} respectively. diff --git a/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch b/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch new file mode 100644 index 00000000..5a995cf3 --- /dev/null +++ b/0376-disk-cryptodisk-Add-the-erase-secrets-function.patch @@ -0,0 +1,147 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Tue, 6 May 2025 12:25:20 -0600 +Subject: [PATCH] disk/cryptodisk: Add the "erase secrets" function + +This commit adds the grub_cryptodisk_erasesecrets() function to wipe +master keys from all cryptodisks. This function is EFI-only. + +Since there is no easy way to "force unmount" a given encrypted disk, +this function renders all mounted cryptodisks unusable. An attempt to +read them will return garbage. + +This is why this function must be used in "no way back" conditions. + +Currently, it is used when unloading the cryptodisk module and when +performing the "exit" command (it is often used to switch to the next +EFI application). This function is not called when performing the +"chainloader" command, because the callee may return to GRUB. For this +reason, users are encouraged to use "exit" instead of "chainloader" to +execute third-party boot applications. + +This function does not guarantee that all secrets are wiped from RAM. +Console output, chunks from disk read requests and other may remain. + +This function does not clear the IV prefix and rekey key for geli disks. + +Also, this commit adds the relevant documentation improvements. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 6 ++++++ + grub-core/commands/minicmd.c | 11 +++++++++++ + grub-core/disk/cryptodisk.c | 28 ++++++++++++++++++++++++++++ + include/grub/cryptodisk.h | 1 + + 4 files changed, 46 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 93e23be99d..0af47b5ade 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4721,6 +4721,11 @@ namespace in addition to the cryptodisk namespace. + + Support for plain encryption mode (plain dm-crypt) is provided via separate + @command{@pxref{plainmount}} command. ++ ++On the EFI platform, GRUB tries to erase master keys from memory when the cryptodisk ++module is unloaded or the command @command{exit} is executed. All secrets remain in ++memory when the command @command{chainloader} is issued, because execution can ++return to GRUB on the EFI platform. + @end deffn + + @node cutmem +@@ -6982,6 +6987,7 @@ USB support provides benefits similar to ATA (for USB disks) or AT (for USB + keyboards). In addition it allows USBserial. + + Chainloading refers to the ability to load another bootloader through the same protocol ++and on some platforms, like EFI, allow that bootloader to return to the GRUB. + + Hints allow faster disk discovery by already knowing in advance which is the disk in + question. On some platforms hints are correct unless you move the disk between boots. +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 9efb7718c3..eb786766a8 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -29,6 +29,10 @@ + #include + #include + ++#ifdef GRUB_MACHINE_EFI ++#include ++#endif ++ + GRUB_MOD_LICENSE ("GPLv3+"); + + /* cat FILE */ +@@ -199,6 +203,13 @@ grub_mini_cmd_exit (struct grub_command *cmd __attribute__ ((unused)), + retval = n; + } + ++#ifdef GRUB_MACHINE_EFI ++ /* ++ * The "exit" command is often used to launch the next boot application. ++ * So, erase the secrets. ++ */ ++ grub_cryptodisk_erasesecrets (); ++#endif + grub_exit (retval); + /* Not reached. */ + } +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 8727760100..9597d2d3bd 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -1677,6 +1677,31 @@ grub_cryptodisk_challenge_password (void) + + return GRUB_ERR_NONE; + } ++ ++void ++grub_cryptodisk_erasesecrets (void) ++{ ++ grub_cryptodisk_t i; ++ grub_uint8_t *buf; ++ ++ buf = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN); ++ if (buf == NULL) ++ grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory"); ++ ++ for (i = cryptodisk_list; i != NULL; i = i->next) ++ if (grub_cryptodisk_setkey (i, buf, i->keysize)) ++ grub_fatal ("grub_cryptodisk_erasesecrets: cannot erase secrets for %s", i->source); ++ else ++ grub_printf ("Erased crypto secrets for %s\n", i->source); ++ /* ++ * Unfortunately, there is no way to "force unmount" a given disk, it may ++ * have mounted "child" disks as well, e.g., an LVM volume. So, this ++ * function MUST be called when there is no way back, e.g., when exiting. ++ * Otherwise, subsequent read calls for a cryptodisk will return garbage. ++ */ ++ ++ grub_free (buf); ++} + #endif /* GRUB_MACHINE_EFI */ + + struct grub_procfs_entry luks_script = +@@ -1700,6 +1725,9 @@ GRUB_MOD_INIT (cryptodisk) + + GRUB_MOD_FINI (cryptodisk) + { ++#ifdef GRUB_MACHINE_EFI ++ grub_cryptodisk_erasesecrets (); ++#endif + grub_disk_dev_unregister (&grub_cryptodisk_dev); + cryptodisk_cleanup (); + grub_unregister_extcmd (cmd); +diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h +index d2572f8b05..ef307dfd5d 100644 +--- a/include/grub/cryptodisk.h ++++ b/include/grub/cryptodisk.h +@@ -189,5 +189,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); + + #ifdef GRUB_MACHINE_EFI + grub_err_t grub_cryptodisk_challenge_password (void); ++void grub_cryptodisk_erasesecrets (void); + #endif + #endif diff --git a/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch b/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch new file mode 100644 index 00000000..17405318 --- /dev/null +++ b/0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Tue, 4 Mar 2025 15:27:59 +0300 +Subject: [PATCH] disk/cryptodisk: Wipe the passphrase from memory + +Switching to another EFI boot application while there are secrets in +RAM is dangerous, because not all firmware is wiping memory on free. + +To reduce the attack surface, wipe the passphrase acquired when +unlocking an encrypted volume. + +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/disk/cryptodisk.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 9597d2d3bd..26457095d3 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -1164,6 +1164,7 @@ grub_cryptodisk_scan_device_real (const char *name, + + if (askpass) + { ++ grub_memset (cargs->key_data, 0, cargs->key_len); + cargs->key_len = 0; + grub_free (cargs->key_data); + } diff --git a/0378-cryptocheck-Add-quiet-option.patch b/0378-cryptocheck-Add-quiet-option.patch new file mode 100644 index 00000000..b62c6403 --- /dev/null +++ b/0378-cryptocheck-Add-quiet-option.patch @@ -0,0 +1,114 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 14 Mar 2025 19:03:39 +0800 +Subject: [PATCH] cryptocheck: Add --quiet option + +The option can be used to suppress output if we only want to test the +return value of the command. + +Also, mention this option in the documentation. + +Signed-off-by: Michael Chang +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 4 +++- + grub-core/commands/search.c | 7 ++++++- + grub-core/disk/diskfilter.c | 25 +++++++++++++++++++------ + 3 files changed, 28 insertions(+), 8 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 0af47b5ade..ae01e8c994 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4678,12 +4678,14 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See command @command{hashsum} + @node cryptocheck + @subsection cryptocheck + +-@deffn Command cryptocheck device ++@deffn Command cryptocheck [ @option{--quiet} ] device + Check if a given diskfilter device is backed by encrypted devices + (@pxref{cryptomount} for additional information). + + The command examines all backing devices, physical volumes, of a specified + logical volume, like LVM2, and fails when at least one of them is unencrypted. ++ ++The option @option{--quiet} can be given to suppress the output. + @end deffn + + @node cryptomount +diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c +index 1cf714ad7d..c432c0ac6f 100644 +--- a/grub-core/commands/search.c ++++ b/grub-core/commands/search.c +@@ -163,6 +163,9 @@ is_unencrypted_disk (grub_disk_t disk) + + if (disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID) + { ++ char opt[] = "--quiet"; ++ char *args[2]; ++ + cmd = grub_command_find ("cryptocheck"); + if (cmd == NULL) /* No diskfilter module loaded for some reason. */ + return true; +@@ -173,7 +176,9 @@ is_unencrypted_disk (grub_disk_t disk) + return true; + + grub_snprintf (disk_str, disk_str_len, "(%s)", disk->name); +- res = cmd->func (cmd, 1, &disk_str); ++ args[0] = opt; ++ args[1] = disk_str; ++ res = cmd->func (cmd, 2, args); + grub_free (disk_str); + return (res != GRUB_ERR_NONE) ? true : false; /* GRUB_ERR_NONE for encrypted. */ + } +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index 216be6a782..04b64aebc6 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -1402,6 +1402,19 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), + int check_pvs_res; + int namelen; + int pvs_cnt; ++ int opt_quiet = 0; ++ ++ if (argc == 2) ++ { ++ if (grub_strcmp (args[0], "--quiet") == 0) ++ { ++ opt_quiet = 1; ++ argc--; ++ args++; ++ } ++ else ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("unrecognized option: %s"), args[0]); ++ } + + if (argc != 1) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("disk name expected")); +@@ -1424,11 +1437,11 @@ grub_cmd_cryptocheck (grub_command_t cmd __attribute__ ((unused)), + + check_pvs_res = grub_diskfilter_check_pvs_encrypted (disk, &pvs_cnt); + grub_disk_close (disk); +- +- grub_printf("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], +- (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", +- pvs_cnt, +- (pvs_cnt > 1) ? "s" : ""); ++ if (!opt_quiet) ++ grub_printf ("%s is %sencrypted (%d pv%s examined)\n", &args[0][1], ++ (check_pvs_res == GRUB_ERR_NONE) ? "" : "un", ++ pvs_cnt, ++ (pvs_cnt > 1) ? "s" : ""); + + return check_pvs_res; + } +@@ -1456,7 +1469,7 @@ GRUB_MOD_INIT(diskfilter) + { + grub_disk_dev_register (&grub_diskfilter_dev); + cmd = grub_register_command ("cryptocheck", grub_cmd_cryptocheck, +- N_("DEVICE"), ++ N_("[--quiet] DEVICE"), + N_("Check if a logical volume resides on encrypted disks.")); + } + diff --git a/grub.patches b/grub.patches index 35da1c35..099a466a 100644 --- a/grub.patches +++ b/grub.patches @@ -367,3 +367,11 @@ Patch0367: 0367-grub-mkimage-Create-new-ELF-note-for-SBAT.patch Patch0368: 0368-grub-mkimage-Add-SBAT-metadata-into-ELF-note-for-Pow.patch Patch0369: 0369-10_linux.in-escape-kernel-option-characters-properly.patch Patch0370: 0370-blscfg-check-if-variable-is-escaped-before-consideri.patch +Patch0371: 0371-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch +Patch0372: 0372-commands-search-Introduce-the-cryptodisk-only-argume.patch +Patch0373: 0373-disk-diskfilter-Introduce-the-cryptocheck-command.patch +Patch0374: 0374-commands-search-Add-the-diskfilter-support.patch +Patch0375: 0375-docs-Document-available-crypto-disks-checks.patch +Patch0376: 0376-disk-cryptodisk-Add-the-erase-secrets-function.patch +Patch0377: 0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch +Patch0378: 0378-cryptocheck-Add-quiet-option.patch diff --git a/grub2.spec b/grub2.spec index 24a99e05..6e47a6f2 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 31%{?dist} +Release: 32%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Tue May 06 2025 Leo Sandoval - 2.12-32 +- Fix several cryptodisk vulnerabilities +- Resolves: CVE-2025-4382 + * Tue May 6 2025 Leo Sandoval 2.12-31 - Handle special kernel parameter characters properly - Resolves: #2362821 From 90894071215470197c875b23b79e9b1306e4243e Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Fri, 16 May 2025 11:35:27 +0200 Subject: [PATCH 24/45] sbat: bump grub sbat Signed-off-by: Nicolas Frayer --- grub2.spec | 5 ++++- sbat.csv.in | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/grub2.spec b/grub2.spec index 6e47a6f2..ec8c3015 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 32%{?dist} +Release: 33%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Fri May 16 2025 Nicolas Frayer - 2.12-33 +- sbat: bump grub sbat + * Tue May 06 2025 Leo Sandoval - 2.12-32 - Fix several cryptodisk vulnerabilities - Resolves: CVE-2025-4382 diff --git a/sbat.csv.in b/sbat.csv.in index b338b5f5..f8372dfd 100755 --- a/sbat.csv.in +++ b/sbat.csv.in @@ -1,3 +1,3 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/ +grub,5,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/ grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com From 9400ee8e83f5b78ad1ec6d0a74381caa0109f9eb Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Wed, 28 May 2025 18:23:00 +0200 Subject: [PATCH 25/45] Some fixes addressing memory freeing and dereferencing Resolves: #2368939 Resolves: #2368945 Signed-off-by: Nicolas Frayer --- ...ader-efi-chainloader-Fix-double-free.patch | 25 +++++++++++++++ ...nloader-Fix-null-pointer-dereference.patch | 31 +++++++++++++++++++ grub.patches | 2 ++ grub2.spec | 7 ++++- 4 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 0379-loader-efi-chainloader-Fix-double-free.patch create mode 100644 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch diff --git a/0379-loader-efi-chainloader-Fix-double-free.patch b/0379-loader-efi-chainloader-Fix-double-free.patch new file mode 100644 index 00000000..ae51483b --- /dev/null +++ b/0379-loader-efi-chainloader-Fix-double-free.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Thomas Frauendorfer | Miray Software +Date: Wed, 21 May 2025 10:56:19 +0200 +Subject: [PATCH] loader/efi/chainloader: Fix double free + +Signed-off-by: Thomas Frauendorfer | Miray Software +Reviewed-by: Nicolas Frayer +--- + grub-core/loader/efi/chainloader.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 7652f5a..0a78d0d 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1193,9 +1193,6 @@ fail: + if (address) + grub_efi_free_pages (address, pages); + +- if (cmdline) +- grub_free (cmdline); +- + if (image_handle != NULL) + grub_efi_unload_image (image_handle); + diff --git a/0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch b/0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch new file mode 100644 index 00000000..1a5048ab --- /dev/null +++ b/0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Thomas Frauendorfer | Miray Software +Date: Tue, 20 May 2025 09:20:46 +0200 +Subject: [PATCH] loader/efi/chainloader: Fix null pointer dereference + +This fixes a null pointer access during netboot +introduced in +* Allow chainloading EFI apps from loop mounts. + +The commit accesses dev->disk without testing it. +But when booting through network dev->disk will be NULL + +Signed-off-by: Thomas Frauendorfer | Miray Software +Reviewed-by: Nicolas Frayer +--- + grub-core/loader/efi/chainloader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 0a78d0d..a004020 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1006,7 +1006,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_free (devname); + + /* if device is loopback, use underlying dev */ +- if (dev && dev->disk->dev->id == GRUB_DISK_DEVICE_LOOPBACK_ID) ++ if (dev && dev->disk && dev->disk->dev->id == GRUB_DISK_DEVICE_LOOPBACK_ID) + { + struct grub_loopback *d; + orig_dev = dev; diff --git a/grub.patches b/grub.patches index 099a466a..3601fbc0 100644 --- a/grub.patches +++ b/grub.patches @@ -375,3 +375,5 @@ Patch0375: 0375-docs-Document-available-crypto-disks-checks.patch Patch0376: 0376-disk-cryptodisk-Add-the-erase-secrets-function.patch Patch0377: 0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch Patch0378: 0378-cryptocheck-Add-quiet-option.patch +Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch +Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch diff --git a/grub2.spec b/grub2.spec index ec8c3015..f253bd9c 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 33%{?dist} +Release: 34%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,11 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Wed May 28 2025 Nicolas Frayer - 2.12-34 +- Some fixes addressing memory freeing and dereferencing +- Resolves: #2368939 +- Resolves: #2368945 + * Fri May 16 2025 Nicolas Frayer - 2.12-33 - sbat: bump grub sbat From 0e28d5ff185ac8a0e5ecd3a8417af7c0b5c39766 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Thu, 5 Jun 2025 10:56:47 +0200 Subject: [PATCH 26/45] osdep/linux/getroot: Detect DDF container similar to IMSM Signed-off-by: Nicolas Frayer --- ...oot-Detect-DDF-container-similar-to-.patch | 86 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 +- 3 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch diff --git a/0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch b/0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch new file mode 100644 index 00000000..95628b3b --- /dev/null +++ b/0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch @@ -0,0 +1,86 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= +Date: Thu, 24 Apr 2025 11:43:28 +0200 +Subject: [PATCH] osdep/linux/getroot: Detect DDF container similar to IMSM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Similarly to Intel IMSM, there are BIOS and UEFI implementations that +support DDF containers natively. + +DDF and IMSM are very similar in handling, especially these should not +be considered as RAID abstraction. This fixes the requirement of having +a device map when probing DDF containers. + +Fixes: https://issues.redhat.com/browse/RHEL-44336 + +Signed-off-by: Renaud Métrich +Reviewed-by: Daniel Kiper +--- + grub-core/osdep/linux/getroot.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index b832593213e6..4bf386b590b5 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -127,7 +127,7 @@ struct btrfs_ioctl_search_args { + struct btrfs_ioctl_fs_info_args) + + static int +-grub_util_is_imsm (const char *os_dev); ++grub_util_is_imsm_or_ddf (const char *os_dev); + + + #define ESCAPED_PATH_MAX (4 * PATH_MAX) +@@ -759,10 +759,10 @@ out: + } + + static int +-grub_util_is_imsm (const char *os_dev) ++grub_util_is_imsm_or_ddf (const char *os_dev) + { + int retry; +- int is_imsm = 0; ++ int is_imsm_or_ddf = 0; + int container_seen = 0; + const char *dev = os_dev; + +@@ -823,10 +823,17 @@ grub_util_is_imsm (const char *os_dev) + if (strncmp (buf, "MD_METADATA=imsm", + sizeof ("MD_METADATA=imsm") - 1) == 0) + { +- is_imsm = 1; ++ is_imsm_or_ddf = 1; + grub_util_info ("%s is imsm", dev); + break; + } ++ if (strncmp (buf, "MD_METADATA=ddf", ++ sizeof ("MD_METADATA=ddf") - 1) == 0) ++ { ++ is_imsm_or_ddf = 1; ++ grub_util_info ("%s is ddf", dev); ++ break; ++ } + } + + free (buf); +@@ -837,7 +844,7 @@ grub_util_is_imsm (const char *os_dev) + + if (dev != os_dev) + free ((void *) dev); +- return is_imsm; ++ return is_imsm_or_ddf; + } + + char * +@@ -1202,7 +1209,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) + + /* Check for RAID. */ + if (!strncmp (os_dev, "/dev/md", 7) && ! grub_util_device_is_mapped (os_dev) +- && !grub_util_is_imsm (os_dev)) ++ && !grub_util_is_imsm_or_ddf (os_dev)) + return GRUB_DEV_ABSTRACTION_RAID; + return GRUB_DEV_ABSTRACTION_NONE; + } diff --git a/grub.patches b/grub.patches index 3601fbc0..c3e7abee 100644 --- a/grub.patches +++ b/grub.patches @@ -377,3 +377,4 @@ Patch0377: 0377-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch Patch0378: 0378-cryptocheck-Add-quiet-option.patch Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch +Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch diff --git a/grub2.spec b/grub2.spec index f253bd9c..41ead8a7 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 34%{?dist} +Release: 35%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -605,6 +605,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Thu Jun 5 2025 Nicolas Frayer - 2.12-35 +- osdep/linux/getroot: Detect DDF container similar to IMSM + * Wed May 28 2025 Nicolas Frayer - 2.12-34 - Some fixes addressing memory freeing and dereferencing - Resolves: #2368939 From 828e1c5448e998fff63625b2bac192bfaa17f356 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Fri, 30 May 2025 08:26:25 +0200 Subject: [PATCH 27/45] spec/posttrans: move grub config stub creation out of spec Signed-off-by: Nicolas Frayer --- gen_grub_cfgstub | 28 ++++++++++++++++++++++++++++ grub.macros | 3 +++ grub2.spec | 16 ++++++---------- 3 files changed, 37 insertions(+), 10 deletions(-) create mode 100644 gen_grub_cfgstub diff --git a/gen_grub_cfgstub b/gen_grub_cfgstub new file mode 100644 index 00000000..c1d061d4 --- /dev/null +++ b/gen_grub_cfgstub @@ -0,0 +1,28 @@ +#!/bin/sh +set -eu + +if [ $# -ne 2 ] + then + echo "Missing argument" + echo "Usage: script.sh GRUB_HOME EFI_HOME" + exit 1 +fi + +GRUB_HOME=$1 +EFI_HOME=$2 + +# create a stub grub2 config in EFI +BOOT_UUID=$(grub2-probe --target=fs_uuid "${GRUB_HOME}") +GRUB_DIR=$(grub2-mkrelpath "${GRUB_HOME}") + +echo "Generating grub stub config for drive " "${BOOT_UUID}" +echo "GRUB_DIR=" "${GRUB_DIR}" +echo "EFI_HOME=" "${EFI_HOME}" + +cat << EOF > "${EFI_HOME}"/grub.cfg.stb +search --no-floppy --root-dev-only --fs-uuid --set=dev ${BOOT_UUID} +set prefix=(\$dev)${GRUB_DIR} +export \$prefix +configfile \$prefix/grub.cfg +EOF + diff --git a/grub.macros b/grub.macros index ee1687aa..a2cab587 100644 --- a/grub.macros +++ b/grub.macros @@ -727,6 +727,8 @@ install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ %ifarch %{arm} \ install -D -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_boot}/BOOTARM.EFI \ %endif \ +install -D -m 700 %{SOURCE13} \\\ + ${RPM_BUILD_ROOT}/usr/bin/gen_grub_cfgstub \ install -D -m 700 unicode.pf2 \\\ ${RPM_BUILD_ROOT}/boot/grub2/fonts/unicode.pf2 \ ${RPM_BUILD_ROOT}/%{_bindir}/grub2-editenv \\\ @@ -876,6 +878,7 @@ ln -s ../boot/grub2/grub.cfg \\\ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ %endif \ %attr(0700,root,root)/boot/grub2/fonts \ +%attr(0700,root,root)/usr/bin/gen_grub_cfgstub \ %dir %attr(0700,root,root)/boot/loader/entries \ %ghost %config(noreplace) %attr(0600,root,root)/boot/grub2/grub.cfg \ %ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ diff --git a/grub2.spec b/grub2.spec index 41ead8a7..21cf5096 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 35%{?dist} +Release: 36%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -35,6 +35,7 @@ Source9: strtoull_test.c Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in +Source13: gen_grub_cfgstub %include %{SOURCE1} @@ -411,15 +412,7 @@ if test -f ${EFI_HOME}/grub.cfg; then fi # create a stub grub2 config in EFI -BOOT_UUID=$(grub2-probe --target=fs_uuid ${GRUB_HOME}) -GRUB_DIR=$(grub2-mkrelpath ${GRUB_HOME}) - -cat << EOF > ${EFI_HOME}/grub.cfg.stb -search --no-floppy --root-dev-only --fs-uuid --set=dev ${BOOT_UUID} -set prefix=(\$dev)${GRUB_DIR} -export \$prefix -configfile \$prefix/grub.cfg -EOF +gen_grub_cfgstub $GRUB_HOME $EFI_HOME || : if test -f ${EFI_HOME}/grubenv; then cp -a ${EFI_HOME}/grubenv ${EFI_HOME}/grubenv.rpmsave @@ -605,6 +598,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog +* Fri Jun 12 2025 Nicolas Frayer - 2.12-36 +- spec: moved grub stub cfg creation into a script + * Thu Jun 5 2025 Nicolas Frayer - 2.12-35 - osdep/linux/getroot: Detect DDF container similar to IMSM From 159b7b546ad6cc11dfea800213712e465257b997 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 20 Jun 2025 16:14:57 -0400 Subject: [PATCH 28/45] Remove package.cfg This did not consistently work as intended, and the ELN automation can now build this properly. Signed-off-by: Yaakov Selkowitz --- package.cfg | 3 --- 1 file changed, 3 deletions(-) delete mode 100644 package.cfg diff --git a/package.cfg b/package.cfg deleted file mode 100644 index 0cf8855f..00000000 --- a/package.cfg +++ /dev/null @@ -1,3 +0,0 @@ -[koji] -targets = rawhide eln - From 01b420564214242141779b584270b996eda5d964 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 8 Jul 2025 11:42:50 +0200 Subject: [PATCH 29/45] spec: fix grub stub cfg creation script Signed-off-by: Nicolas Frayer --- gen_grub_cfgstub | 1 + grub2.spec | 10 +++++----- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/gen_grub_cfgstub b/gen_grub_cfgstub index c1d061d4..c73ee533 100644 --- a/gen_grub_cfgstub +++ b/gen_grub_cfgstub @@ -26,3 +26,4 @@ export \$prefix configfile \$prefix/grub.cfg EOF +mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg diff --git a/grub2.spec b/grub2.spec index 21cf5096..15e9d404 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 36%{?dist} +Release: 37%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -419,9 +419,6 @@ if test -f ${EFI_HOME}/grubenv; then mv --force ${EFI_HOME}/grubenv ${GRUB_HOME}/grubenv fi -# ensure we exit 0 -mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : - %files common -f grub.lang %dir %{_libdir}/grub/ %dir %{_datarootdir}/grub/ @@ -598,7 +595,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg || : %endif %changelog -* Fri Jun 12 2025 Nicolas Frayer - 2.12-36 +* Tue Jul 8 2025 Nicolas Frayer - 2.12-37 +- spec: fix grub stub cfg creation script + +* Thu Jun 12 2025 Nicolas Frayer - 2.12-36 - spec: moved grub stub cfg creation into a script * Thu Jun 5 2025 Nicolas Frayer - 2.12-35 From 42ca1a56a1744939603b11a1dbb0c722ee1bd88b Mon Sep 17 00:00:00 2001 From: Jan Stancek Date: Mon, 14 Jul 2025 06:28:03 -0400 Subject: [PATCH 30/45] more robust kernel updates Set boot entry only after sucessful ramdisk creation to prevent booting into broken environments in cases where ramdisk is corrupt or missing. Signed-off-by: Jan Stancek --- 20-grub.install | 2 +- 55-set-boot-entry.install | 44 +++++++++++++++++++++++++++++++++++++++ grub2.spec | 3 +++ 3 files changed, 48 insertions(+), 1 deletion(-) create mode 100755 55-set-boot-entry.install diff --git a/20-grub.install b/20-grub.install index d5ab5875..52992c54 100755 --- a/20-grub.install +++ b/20-grub.install @@ -174,7 +174,7 @@ case "$COMMAND" in fi fi if [ -n "$NEWDEFAULT" ]; then - grub2-editenv - set "saved_entry=${NEWDEFAULT}" + grub2-editenv - set "tmp_saved_entry=${NEWDEFAULT}" fi # this probably isn't the best place to do this, but it will do for now. diff --git a/55-set-boot-entry.install b/55-set-boot-entry.install new file mode 100755 index 00000000..196edd8c --- /dev/null +++ b/55-set-boot-entry.install @@ -0,0 +1,44 @@ +#!/bin/bash + +[[ -f /etc/default/grub ]] && . /etc/default/grub +[[ -f /etc/os-release ]] && . /etc/os-release + +COMMAND="$1" +KERNEL_VERSION="$2" +BOOT_DIR_ABS="$3" +KERNEL_IMAGE="$4" + +case "$COMMAND" in + add) + if [[ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]] || [[ ! -f /sbin/new-kernel-pkg ]]; then + entry=$(grub2-editenv list | grep tmp_saved_entry) + if [ -n "$entry" ]; then + BLS_ID=${entry##tmp_saved_entry=} + BLS_DIR="/boot/loader/entries" + BLS_TARGET="${BLS_DIR}/${BLS_ID}.conf" + + LINUX="$(grep '^linux[ \t]' "${BLS_TARGET}" | sed -e 's,^linux[ \t]*,,')" + INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,')" + ROOTPREFIX="$(dirname "/boot${LINUX}")" + + if [ ! -e "${ROOTPREFIX}${INITRD}" ]; then + echo "${INITRD} not found" + exit 1 + fi + if ! lsinitrd ${ROOTPREFIX}${INITRD} > /dev/null; then + echo "Error: ${INITRD} appears to be corrupt." + exit 1 + fi + if [ ! -e "${ROOTPREFIX}${LINUX}" ]; then + echo "Error: ${LINUX} not found." + exit 1 + fi + + grub2-editenv - unset "tmp_saved_entry" + grub2-editenv - set "saved_entry=$BLS_ID" + fi + fi + ;; + *) + ;; +esac diff --git a/grub2.spec b/grub2.spec index 15e9d404..fd13f4a1 100644 --- a/grub2.spec +++ b/grub2.spec @@ -36,6 +36,7 @@ Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in Source13: gen_grub_cfgstub +Source14: 55-set-boot-entry.install %include %{SOURCE1} @@ -301,6 +302,7 @@ rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/grub2-macbless # Install kernel-install scripts install -d -m 0755 %{buildroot}%{_prefix}/lib/kernel/install.d/ install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE10} +install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE14} install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE3} install -d -m 0755 %{buildroot}%{_sysconfdir}/kernel/install.d/ # Install systemd user service to set the boot_success flag @@ -424,6 +426,7 @@ fi %dir %{_datarootdir}/grub/ %attr(0700,root,root) %dir %{_sysconfdir}/grub.d %{_prefix}/lib/kernel/install.d/20-grub.install +%{_prefix}/lib/kernel/install.d/55-set-boot-entry.install %{_prefix}/lib/kernel/install.d/99-grub-mkconfig.install %dir %{_datarootdir}/grub %exclude %{_datarootdir}/grub/* From 8f843cc6efed887f8dbfd25005553dc666c303c9 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Tue, 29 Jul 2025 09:53:33 -0600 Subject: [PATCH 31/45] Set correctly the memory attributes for the kernel PE sections Signed-off-by: Leo Sandoval --- ...e-memory-attributes-for-the-kernel-P.patch | 291 ++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 +- 3 files changed, 296 insertions(+), 1 deletion(-) create mode 100644 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch diff --git a/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch b/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch new file mode 100644 index 00000000..6fe22da7 --- /dev/null +++ b/0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch @@ -0,0 +1,291 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Tue, 29 Jul 2025 09:43:37 -0600 +Subject: [PATCH] Set correctly the memory attributes for the kernel PE + sections + +Currently the whole kernel memory region is set to RO, so at some +point when execution is passed to the kernel, the latter faults on a +memory write access, e.g. zeroing .bss section. The proposed change +sets the memory attribute appropriately for each kernel PE section. + +Signed-off-by: Leo Sandoval +--- + grub-core/loader/efi/linux.c | 170 +++++++++++++++++++++++++++----------- + grub-core/loader/i386/efi/linux.c | 5 +- + include/grub/efi/linux.h | 6 ++ + 3 files changed, 134 insertions(+), 47 deletions(-) + +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index ef55556f2d..111edf0e1d 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -202,22 +203,133 @@ grub_efi_check_nx_required (int *nx_required) + typedef void (*handover_func) (void *, grub_efi_system_table_t *, void *); + + grub_err_t +-grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, ++grub_efi_mem_set_att(grub_addr_t k_address, grub_size_t k_size, ++ grub_size_t k_start, int nx_supported) ++{ ++ grub_addr_t k_start_address = k_address + k_start; ++ ++ grub_uint64_t default_set_attrs = GRUB_MEM_ATTR_R | GRUB_MEM_ATTR_W | GRUB_MEM_ATTR_X; ++ grub_uint64_t default_clear_attrs = 0; ++ grub_uint64_t stack_set_attrs = default_set_attrs; ++ grub_uint64_t stack_clear_attrs = default_clear_attrs; ++ grub_uint64_t kernel_set_attrs = default_set_attrs; ++ grub_uint64_t kernel_clear_attrs = default_clear_attrs; ++ grub_uint64_t attrs; ++ ++ struct grub_msdos_image_header *header; ++ struct grub_pe_image_header *pe_image_header; ++ struct grub_pe32_coff_header *coff_header; ++ struct grub_pe32_section_table *section, *sections; ++ grub_uint16_t i; ++ grub_size_t sz; ++ ++ header = (struct grub_msdos_image_header *)k_address; ++ ++ if (grub_add ((grub_addr_t) header, header->pe_image_header_offset, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE image header address calculation")); ++ ++ pe_image_header = (struct grub_pe_image_header *) (sz); ++ ++ if (pe_image_header > (k_address + k_size)) ++ return grub_error (GRUB_ERR_BAD_OS, N_("PE image header address is invalid")); ++ ++ if (grub_memcmp (pe_image_header->signature, GRUB_PE32_SIGNATURE, ++ GRUB_PE32_SIGNATURE_SIZE) != 0) ++ return grub_error (GRUB_ERR_BAD_OS, N_("kernel PE magic is invalid")); ++ ++ coff_header = &(pe_image_header->coff_header); ++ grub_dprintf ("nx", "coff_header 0x%"PRIxGRUB_ADDR" machine %08x\n", (grub_addr_t)coff_header, coff_header->machine); ++ ++ if (grub_add ((grub_addr_t) coff_header, sizeof (*coff_header), &sz) || ++ grub_add (sz, coff_header->optional_header_size, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE sections calculation")); ++ ++ sections = (struct grub_pe32_section_table *) (sz); ++ ++ if (sections > (k_address + k_size)) ++ return grub_error (GRUB_ERR_BAD_OS, N_("Section address is invalid")); ++ ++ /* Parse the PE, remove W for code section, remove X for data sections, RO for the rest */ ++ for (i = 0, section = sections; i < coff_header->num_sections; i++, section++) ++ { ++ kernel_set_attrs = default_set_attrs; ++ kernel_clear_attrs = default_clear_attrs; ++ ++ if (nx_supported) ++ { ++ if (section->characteristics & GRUB_PE32_SCN_MEM_EXECUTE) ++ { ++ /* RX section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_W; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_W; ++ } ++ else if (section->characteristics & GRUB_PE32_SCN_MEM_WRITE) ++ { ++ /* RW section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_X; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_X; ++ } ++ else ++ { ++ /* RO section */ ++ kernel_set_attrs &= ~GRUB_MEM_ATTR_W & ~GRUB_MEM_ATTR_X; ++ kernel_clear_attrs |= GRUB_MEM_ATTR_X | GRUB_MEM_ATTR_W ; ++ } ++ } ++ ++ /* Make sure we are inside range */ ++ if (grub_add ((grub_addr_t) k_address, section->raw_data_offset, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("Error on PE Executable section calculation")); ++ ++ grub_update_mem_attrs (sz, section->raw_data_size, kernel_set_attrs, kernel_clear_attrs); ++ ++ grub_get_mem_attrs (sz, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for section %s 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ section->name, ++ (grub_addr_t)sz, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ } ++ ++ if (grub_stack_addr != (grub_addr_t)-1ll) ++ { ++ if (nx_supported) ++ { ++ stack_set_attrs &= ~GRUB_MEM_ATTR_X; ++ stack_clear_attrs |= GRUB_MEM_ATTR_X; ++ } ++ ++ grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", ++ grub_stack_addr, grub_stack_addr + grub_stack_size - 1, ++ (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); ++ ++ grub_update_mem_attrs (grub_stack_addr, grub_stack_size, ++ stack_set_attrs, stack_clear_attrs); ++ ++ grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); ++ grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", ++ grub_stack_addr, ++ (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", ++ (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", ++ (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ ++ ++grub_err_t ++grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, grub_size_t k_start, + grub_off_t h_offset, void *k_params, + int nx_supported) + { ++ grub_addr_t k_start_address = k_address + k_start; + grub_efi_loaded_image_t *loaded_image = NULL; + handover_func hf; + int offset = 0; +- grub_uint64_t stack_set_attrs = GRUB_MEM_ATTR_R | +- GRUB_MEM_ATTR_W | +- GRUB_MEM_ATTR_X; +- grub_uint64_t stack_clear_attrs = 0; +- grub_uint64_t kernel_set_attrs = stack_set_attrs; +- grub_uint64_t kernel_clear_attrs = stack_clear_attrs; +- grub_uint64_t attrs; + int nx_required = 0; +- ++ + #ifdef __x86_64__ + offset = 512; + #endif +@@ -241,47 +353,13 @@ grub_efi_linux_boot (grub_addr_t k_address, grub_size_t k_size, + if (nx_required && !nx_supported) + return grub_error (GRUB_ERR_BAD_OS, N_("kernel does not support NX loading required by policy")); + +- if (nx_supported) +- { +- kernel_set_attrs &= ~GRUB_MEM_ATTR_W; +- kernel_clear_attrs |= GRUB_MEM_ATTR_W; +- stack_set_attrs &= ~GRUB_MEM_ATTR_X; +- stack_clear_attrs |= GRUB_MEM_ATTR_X; +- } +- +- grub_dprintf ("nx", "Setting attributes for 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to r%cx\n", +- k_address, k_address + k_size - 1, +- (kernel_set_attrs & GRUB_MEM_ATTR_W) ? 'w' : '-'); +- grub_update_mem_attrs (k_address, k_size, +- kernel_set_attrs, kernel_clear_attrs); +- +- grub_get_mem_attrs (k_address, 4096, &attrs); +- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", +- (grub_addr_t)k_address, +- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", +- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", +- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); +- if (grub_stack_addr != (grub_addr_t)-1ll) +- { +- grub_dprintf ("nx", "Setting attributes for stack at 0x%"PRIxGRUB_ADDR"-0x%"PRIxGRUB_ADDR" to rw%c\n", +- grub_stack_addr, grub_stack_addr + grub_stack_size - 1, +- (stack_set_attrs & GRUB_MEM_ATTR_X) ? 'x' : '-'); +- grub_update_mem_attrs (grub_stack_addr, grub_stack_size, +- stack_set_attrs, stack_clear_attrs); +- +- grub_get_mem_attrs (grub_stack_addr, 4096, &attrs); +- grub_dprintf ("nx", "permissions for 0x%"PRIxGRUB_ADDR" are %s%s%s\n", +- grub_stack_addr, +- (attrs & GRUB_MEM_ATTR_R) ? "r" : "-", +- (attrs & GRUB_MEM_ATTR_W) ? "w" : "-", +- (attrs & GRUB_MEM_ATTR_X) ? "x" : "-"); +- } ++ grub_efi_mem_set_att (k_address, k_size, k_start, nx_supported); + + #if defined(__i386__) || defined(__x86_64__) + asm volatile ("cli"); + #endif + +- hf = (handover_func)((char *)k_address + h_offset + offset); ++ hf = (handover_func)((char *)k_start_address + h_offset + offset); + hf (grub_efi_image_handle, grub_efi_system_table, k_params); + + return GRUB_ERR_BUG; +@@ -451,7 +529,7 @@ grub_arch_efi_linux_boot_image (grub_addr_t addr, grub_size_t size, char *args, + + grub_dprintf ("linux", "linux command line: '%s'\n", args); + +- retval = grub_efi_linux_boot (addr, size, handover_offset, ++ retval = grub_efi_linux_boot (addr, size, 0, handover_offset, + (void *)addr, nx_supported); + + /* Never reached... */ +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index abbf6b24f5..6c310d9879 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -41,6 +41,7 @@ static grub_command_t cmd_linuxefi, cmd_initrdefi; + struct grub_linuxefi_context { + void *kernel_mem; + grub_uint64_t kernel_size; ++ grub_uint64_t kernel_start; + grub_uint32_t handover_offset; + struct linux_kernel_params *params; + char *cmdline; +@@ -169,6 +170,7 @@ grub_linuxefi_boot (void *data) + + return grub_efi_linux_boot ((grub_addr_t)context->kernel_mem, + context->kernel_size, ++ context->kernel_start, + context->handover_offset, + context->params, + context->nx_supported); +@@ -527,7 +529,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + LOW_U32(kernel_mem)); + lh->code32_start = LOW_U32(kernel_mem); + +- grub_memcpy (kernel_mem, (char *)kernel + start, filelen - start); ++ grub_memcpy (kernel_mem, (char *)kernel, filelen); + + lh->type_of_loader = 0x6; + grub_dprintf ("linux", "setting lh->type_of_loader = 0x%02x\n", +@@ -544,6 +546,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + goto fail; + context->kernel_mem = kernel_mem; + context->kernel_size = kernel_size; ++ context->kernel_start = start; + context->handover_offset = handover_offset; + context->params = params; + context->cmdline = cmdline; +diff --git a/include/grub/efi/linux.h b/include/grub/efi/linux.h +index 5b4e626c37..cd17be506a 100644 +--- a/include/grub/efi/linux.h ++++ b/include/grub/efi/linux.h +@@ -27,6 +27,7 @@ + grub_err_t + EXPORT_FUNC(grub_efi_linux_boot) (grub_addr_t kernel_address, + grub_size_t kernel_size, ++ grub_size_t kernel_start, + grub_off_t handover_offset, + void *kernel_param, int nx_enabled); + +@@ -38,4 +39,9 @@ EXPORT_FUNC(grub_efi_check_nx_image_support) (grub_addr_t kernel_addr, + grub_err_t + EXPORT_FUNC(grub_efi_check_nx_required) (int *nx_required); + ++grub_err_t ++EXPORT_FUNC(grub_efi_mem_set_att) (grub_addr_t k_address, ++ grub_size_t k_size, ++ grub_size_t k_start, int nx_supported); ++ + #endif /* ! GRUB_EFI_LINUX_HEADER */ diff --git a/grub.patches b/grub.patches index c3e7abee..f236c38a 100644 --- a/grub.patches +++ b/grub.patches @@ -378,3 +378,4 @@ Patch0378: 0378-cryptocheck-Add-quiet-option.patch Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch +Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index fd13f4a1..2bb1ad43 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 37%{?dist} +Release: 38%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -598,6 +598,9 @@ fi %endif %changelog +* Tue Jul 29 2025 Leo Sandoval 2.12-38 +- Set correctly the memory attributes for the kernel PE sections + * Tue Jul 8 2025 Nicolas Frayer - 2.12-37 - spec: fix grub stub cfg creation script From 06e458e5ebdfb50d01e7b9cd766d05587d73de90 Mon Sep 17 00:00:00 2001 From: Yuxin Sun Date: Thu, 17 Jul 2025 10:47:47 +0800 Subject: [PATCH 32/45] 20-grub.install: Skip BLS removal when entry type is type2 UKI(package is kernel-uki-virt) is a single, bootable file that bundles everything needed to start a Linux system. It contains its own bootable stub and bypasses GRUB2 completely. The kernel-core and kernel-uki-virt can coexist in one machine. And both of them call kernel-install remove upon package removal and this leads to the complete removal of both the traditional kernel & its artifacts(initramfs, BLS entry file,...). For example, if the customer remove kernel-uki-virt, currently it also removes BLS entry which causes the regular kernel fails to boot up. In https://github.com/systemd/systemd/pull/37897 it added --entry-type=type1|type2 option to kernel-install. type1 stands for normal kernel, type2 stands for uki. When kernel-install is invoked with --entry-type=type2 which is for UKI, we should not remove the BLS entry. Signed-off-by: Yuxin Sun --- 20-grub.install | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/20-grub.install b/20-grub.install index 52992c54..e402a4ce 100755 --- a/20-grub.install +++ b/20-grub.install @@ -193,7 +193,11 @@ case "$COMMAND" in exit 77 ;; remove) - + # If the boot entry type is type2, we are not removing the BLS entry + if [[ "x${KERNEL_INSTALL_BOOT_ENTRY_TYPE}" = "xtype2" ]]; then + [ "${KERNEL_INSTALL_VERBOSE}" -gt 0 ] && echo "The boot entry type is type2. Skip removing BLS entry." + exit 0 + fi if [[ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]] || [[ ! -f /sbin/new-kernel-pkg ]]; then BLS_TARGET="${BLS_DIR}/${MACHINE_ID}-${KERNEL_VERSION}.conf" BLS_DEBUG="$(echo ${BLS_TARGET} | sed -e "s/${KERNEL_VERSION}/${KERNEL_VERSION}~debug/")" From 8f6e9e55c19c21032133cdb4def20e03d31fb463 Mon Sep 17 00:00:00 2001 From: "FeRD (Frank Dana)" Date: Tue, 15 Jul 2025 19:56:55 -0400 Subject: [PATCH 33/45] Suppress warnings about missing /etc/default/grub Signed-off-by: FeRD (Frank Dana) --- 99-grub-mkconfig.install | 4 ++-- grub2.spec | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index a14f5fd8..1a5fed8c 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -5,7 +5,7 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then fi # Run grub2-mkconfig if ENABLE_BLSCFG is false -if grep -q '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then +if grep -sq '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then RUN_MKCONFIG=true DISABLE_BLS=true fi @@ -28,7 +28,7 @@ if [[ $ARCH = "ppc64le" ]] && [ -d /sys/firmware/opal ]; then fi if [[ $DISABLE_BLS = "true" ]]; then - if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then + if grep -sq '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub fi fi diff --git a/grub2.spec b/grub2.spec index 2bb1ad43..839607d6 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 38%{?dist} +Release: 39%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -598,6 +598,10 @@ fi %endif %changelog +* Tue Jul 15 2025 FeRD (Frank Dana) - 2.12-39 +- kernel-install: Suppress warnings about missing /etc/default/grub + file when attempting to grep its contents + * Tue Jul 29 2025 Leo Sandoval 2.12-38 - Set correctly the memory attributes for the kernel PE sections From 354c77b195316a4aa09979793a73ea4485217769 Mon Sep 17 00:00:00 2001 From: Jan Stancek Date: Wed, 6 Aug 2025 10:11:49 +0200 Subject: [PATCH 34/45] 55-set-boot-entry.install: fix initrd check Fix where to look for initrd file, as /boot may not be a separate partition, in which case adding /boot unconditionally leads to a duplicate "/boot/boot/...". Fix initrd line parsing to take only first word - it can contain extra parameters, e.g. "$tuned_initrd", which are not part of initrd filename. Resolves: #2386118 Reported-by: Mikhail Gavrilov Tested-by: Mikhail Gavrilov Signed-off-by: Jan Stancek --- 55-set-boot-entry.install | 28 ++++++++++++++-------------- grub2.spec | 6 +++++- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/55-set-boot-entry.install b/55-set-boot-entry.install index 196edd8c..be505e30 100755 --- a/55-set-boot-entry.install +++ b/55-set-boot-entry.install @@ -17,21 +17,21 @@ case "$COMMAND" in BLS_DIR="/boot/loader/entries" BLS_TARGET="${BLS_DIR}/${BLS_ID}.conf" - LINUX="$(grep '^linux[ \t]' "${BLS_TARGET}" | sed -e 's,^linux[ \t]*,,')" - INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,')" - ROOTPREFIX="$(dirname "/boot${LINUX}")" + LINUX="$(grep '^linux[ \t]' "${BLS_TARGET}" | sed -e 's,^linux[ \t]*,,' | awk '{print $1}')" + INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,' | awk '{print $1}')" - if [ ! -e "${ROOTPREFIX}${INITRD}" ]; then - echo "${INITRD} not found" - exit 1 - fi - if ! lsinitrd ${ROOTPREFIX}${INITRD} > /dev/null; then - echo "Error: ${INITRD} appears to be corrupt." - exit 1 - fi - if [ ! -e "${ROOTPREFIX}${LINUX}" ]; then - echo "Error: ${LINUX} not found." - exit 1 + ROOTPREFIX="" + [ -z "$(grub2-mkrelpath /boot)" ] && ROOTPREFIX="/boot" + + if [ -e "${ROOTPREFIX}${LINUX}" -a -n "${INITRD}" ]; then + if [ ! -e "${ROOTPREFIX}${INITRD}" ]; then + echo "Error: ${INITRD} not found" + exit 1 + fi + if ! lsinitrd ${ROOTPREFIX}${INITRD} > /dev/null; then + echo "Error: ${INITRD} appears to be corrupt." + exit 1 + fi fi grub2-editenv - unset "tmp_saved_entry" diff --git a/grub2.spec b/grub2.spec index 839607d6..edd26b40 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 39%{?dist} +Release: 40%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -598,6 +598,10 @@ fi %endif %changelog +* Wed Aug 6 2025 Jan Stancek - 2.12-40 +- 55-set-boot-entry.install: fix initrd check +- Resolves: #2386118 + * Tue Jul 15 2025 FeRD (Frank Dana) - 2.12-39 - kernel-install: Suppress warnings about missing /etc/default/grub file when attempting to grep its contents From e02b6e88c71642ecc063ae7aefbd09b9be80d50e Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Mon, 19 May 2025 13:21:50 -0600 Subject: [PATCH 35/45] Phase 1 of the bootloader updates proposal implementation https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 Signed-off-by: Marta Lewandoska Signed-off-by: Nicolas Frayer Signed-off-by: Leo Sandoval --- gen_grub_cfgstub | 1 + grub.macros | 26 +++++++++++++++++--------- grub2.spec | 25 ++++++++++++++++++++----- 3 files changed, 38 insertions(+), 14 deletions(-) diff --git a/gen_grub_cfgstub b/gen_grub_cfgstub index c73ee533..a6a97123 100644 --- a/gen_grub_cfgstub +++ b/gen_grub_cfgstub @@ -27,3 +27,4 @@ configfile \$prefix/grub.cfg EOF mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg +chmod 0600 ${EFI_HOME}/grub.cfg diff --git a/grub.macros b/grub.macros index a2cab587..dfc9707d 100644 --- a/grub.macros +++ b/grub.macros @@ -1,6 +1,12 @@ # vim:filetype=spec # Modules always contain just 32-bit code +%global evr %{epoch}:%{version}-%{release} %global _libdir %{_exec_prefix}/lib + +%global os_id %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) +%global grub_evr_dir %{_libdir}/efi/grub2/%{evr} +%global grub_efi_dir %{grub_evr_dir}/EFI/%{os_id} + %global _binaries_in_noarch_packages_terminate_build 0 #%%undefine _missing_build_ids_terminate_build %{expand:%%{!?buildsubdir:%%global buildsubdir grub-%{tarversion}}} @@ -280,8 +286,6 @@ %global grubelfname core.elf %endif -%global evr %{epoch}:%{version}-%{release} - %ifarch x86_64 %global with_efi_common 1 %global with_legacy_modules 1 @@ -704,8 +708,8 @@ find . '(' -iname gdb_grub \\\ ')' \\\ -exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \ find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \ -install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ %{expand:%%do_install_protected_file grub2-%{alt_package_arch}} \ cd .. \ %{nil} @@ -722,8 +726,8 @@ fi \ find $RPM_BUILD_ROOT -iname "*.module" -exec chmod a-x {} '\;' \ ln -s ../boot/grub2/grub.cfg \\\ $RPM_BUILD_ROOT%{_sysconfdir}/grub2-efi.cfg \ -install -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_dir}/%{2} \ -install -m 700 %{3} $RPM_BUILD_ROOT%{efi_esp_dir}/%{3} \ +install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ +install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ %ifarch %{arm} \ install -D -m 700 %{2} $RPM_BUILD_ROOT%{efi_esp_boot}/BOOTARM.EFI \ %endif \ @@ -826,6 +830,7 @@ cp docs/grub.info $RPM_BUILD_ROOT%{_infodir}/grub2.info \ cp docs/grub-dev.info \\\ $RPM_BUILD_ROOT%{_infodir}/grub2-dev.info \ install -d -m 0700 ${RPM_BUILD_ROOT}%{efi_esp_dir}/ \ +install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/loader/entries \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/themes/system \ @@ -873,7 +878,8 @@ ln -s ../boot/grub2/grub.cfg \\\ %defattr(-,root,root,-) \ %config(noreplace) %{_sysconfdir}/grub2.cfg \ %config(noreplace) %{_sysconfdir}/grub2-efi.cfg \ -%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{2} \ +%ghost %attr(0700,root,root) %{efi_esp_dir}/%{2} \ +%attr(0700,root,root) %{grub_efi_dir}/%{2} \ %ifarch %{arm} \ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ %endif \ @@ -881,7 +887,8 @@ ln -s ../boot/grub2/grub.cfg \\\ %attr(0700,root,root)/usr/bin/gen_grub_cfgstub \ %dir %attr(0700,root,root)/boot/loader/entries \ %ghost %config(noreplace) %attr(0600,root,root)/boot/grub2/grub.cfg \ -%ghost %config(noreplace) %verify(not mtime) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ +%ghost %config(noreplace) %attr(0700,root,root)%{efi_esp_dir}/grub.cfg \ +%ghost %config(noreplace) %attr(0600,root,root)%{grub_efi_dir}/grub.cfg \ %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv \ %attr(0644,root,root) %config(noreplace) /etc/dnf/protected.d/grub2-%{1}.conf \ %{expand:%if 0%{?without_efi_modules} \ @@ -899,7 +906,8 @@ ln -s ../boot/grub2/grub.cfg \\\ \ %{expand:%%files %{1}-cdboot} \ %defattr(-,root,root,-) \ -%attr(0700,root,root) %verify(not mtime) %{efi_esp_dir}/%{3} \ +%ghost %attr(0700,root,root) %{efi_esp_dir}/%{3} \ +%attr(0700,root,root) %{grub_efi_dir}/%{3} \ %attr(0700,root,root)/boot/grub2/fonts \ %{nil} diff --git a/grub2.spec b/grub2.spec index edd26b40..3d9b3d2a 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 40%{?dist} +Release: 41%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -387,7 +387,7 @@ fi %posttrans common set -eu -EFI_HOME=%{efi_esp_dir} +EFI_HOME=%{grub_efi_dir} GRUB_HOME=/boot/grub2 ESP_PATH=/boot/efi @@ -421,6 +421,17 @@ if test -f ${EFI_HOME}/grubenv; then mv --force ${EFI_HOME}/grubenv ${GRUB_HOME}/grubenv fi +%if 0%{with_efi_arch} +%posttrans efi-%{efiarch} +set -eu + +# On image mode, bootupd takes care of installing bootloader updates to the ESP +if [[ ! -e "/run/ostree-booted" ]]; then + cp -a %{grub_efi_dir}/. %{efi_esp_dir} || : +fi + +%endif + %files common -f grub.lang %dir %{_libdir}/grub/ %dir %{_datarootdir}/grub/ @@ -435,8 +446,8 @@ fi %dir /boot/grub2/themes/system %attr(0700,root,root) %dir /boot/grub2 %exclude /boot/grub2/* -%dir %attr(0700,root,root) %{efi_esp_dir} -%exclude %{efi_esp_dir}/* +%dir %attr(0700,root,root) %{grub_efi_dir} +%exclude %{grub_efi_dir}/* %ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv %license COPYING %doc THANKS @@ -598,11 +609,15 @@ fi %endif %changelog +* Mon Aug 11 2025 Marta Lewandowska - 2.12-41 +- Phase 1 of the bootloader updates proposal implementation +- https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 + * Wed Aug 6 2025 Jan Stancek - 2.12-40 - 55-set-boot-entry.install: fix initrd check - Resolves: #2386118 -* Tue Jul 15 2025 FeRD (Frank Dana) - 2.12-39 +* Fri Aug 1 2025 FeRD (Frank Dana) - 2.12-39 - kernel-install: Suppress warnings about missing /etc/default/grub file when attempting to grep its contents From f6bc25c3e72a962cb59f568ec5fcc4dd374a9be2 Mon Sep 17 00:00:00 2001 From: Jan Stancek Date: Mon, 18 Aug 2025 15:56:46 +0200 Subject: [PATCH 36/45] 55-set-boot-entry.install: move to 95 When KERNEL_INSTALL_STAGING_AREA is used (for example with initrd_generator=mkosi-initrd), initrd gets installed to /boot only later at 90-loaderentry.install. Move the plugin to 95 so it runs after. Related: #2389020 Signed-off-by: Jan Stancek --- 55-set-boot-entry.install => 95-set-boot-entry.install | 4 ++-- grub2.spec | 10 +++++++--- 2 files changed, 9 insertions(+), 5 deletions(-) rename 55-set-boot-entry.install => 95-set-boot-entry.install (89%) diff --git a/55-set-boot-entry.install b/95-set-boot-entry.install similarity index 89% rename from 55-set-boot-entry.install rename to 95-set-boot-entry.install index be505e30..9f92f9f4 100755 --- a/55-set-boot-entry.install +++ b/95-set-boot-entry.install @@ -25,11 +25,11 @@ case "$COMMAND" in if [ -e "${ROOTPREFIX}${LINUX}" -a -n "${INITRD}" ]; then if [ ! -e "${ROOTPREFIX}${INITRD}" ]; then - echo "Error: ${INITRD} not found" + echo "Error: ${ROOTPREFIX}${INITRD} not found." exit 1 fi if ! lsinitrd ${ROOTPREFIX}${INITRD} > /dev/null; then - echo "Error: ${INITRD} appears to be corrupt." + echo "Error: ${ROOTPREFIX}${INITRD} appears to be corrupt." exit 1 fi fi diff --git a/grub2.spec b/grub2.spec index 3d9b3d2a..a1a7400c 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 41%{?dist} +Release: 42%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -36,7 +36,7 @@ Source10: 20-grub.install Source11: grub.patches Source12: sbat.csv.in Source13: gen_grub_cfgstub -Source14: 55-set-boot-entry.install +Source14: 95-set-boot-entry.install %include %{SOURCE1} @@ -437,7 +437,7 @@ fi %dir %{_datarootdir}/grub/ %attr(0700,root,root) %dir %{_sysconfdir}/grub.d %{_prefix}/lib/kernel/install.d/20-grub.install -%{_prefix}/lib/kernel/install.d/55-set-boot-entry.install +%{_prefix}/lib/kernel/install.d/95-set-boot-entry.install %{_prefix}/lib/kernel/install.d/99-grub-mkconfig.install %dir %{_datarootdir}/grub %exclude %{_datarootdir}/grub/* @@ -609,6 +609,10 @@ fi %endif %changelog +* Wed Aug 20 2025 Jan Stancek - 2.12-42 +- move 55-set-boot-entry.install to 95 +- Related: #2389020 + * Mon Aug 11 2025 Marta Lewandowska - 2.12-41 - Phase 1 of the bootloader updates proposal implementation - https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 From 730ce277473cc673793f79437426c1403ea47621 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 19 Aug 2025 12:05:25 +0200 Subject: [PATCH 37/45] gen_grub_cfgstub: Removed output messages Signed-off-by: Nicolas Frayer --- gen_grub_cfgstub | 4 ---- grub2.spec | 5 ++++- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/gen_grub_cfgstub b/gen_grub_cfgstub index a6a97123..8f77c0f5 100644 --- a/gen_grub_cfgstub +++ b/gen_grub_cfgstub @@ -15,10 +15,6 @@ EFI_HOME=$2 BOOT_UUID=$(grub2-probe --target=fs_uuid "${GRUB_HOME}") GRUB_DIR=$(grub2-mkrelpath "${GRUB_HOME}") -echo "Generating grub stub config for drive " "${BOOT_UUID}" -echo "GRUB_DIR=" "${GRUB_DIR}" -echo "EFI_HOME=" "${EFI_HOME}" - cat << EOF > "${EFI_HOME}"/grub.cfg.stb search --no-floppy --root-dev-only --fs-uuid --set=dev ${BOOT_UUID} set prefix=(\$dev)${GRUB_DIR} diff --git a/grub2.spec b/grub2.spec index a1a7400c..0e804eac 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 42%{?dist} +Release: 43%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,9 @@ fi %endif %changelog +* Tue Aug 19 2025 Nicolas Frayer - 2.12-43 +- gen_grub_cfgstub: Removed output messages + * Wed Aug 20 2025 Jan Stancek - 2.12-42 - move 55-set-boot-entry.install to 95 - Related: #2389020 From b9b1d1e384bc49e29f4398d0e3ac176c584684a0 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 15 Sep 2025 14:06:19 -0600 Subject: [PATCH 38/45] Include function name on debug and error print functions With the following change, we see standard (grub_dprintf) and error (grub_error) logs with the function name embedded (see below) into the log which is particular useful when debugging commands/efi/tpm.c:grub_tpm_measure:281:tpm: log_event, pcr = 8, size = 0xb, Including one more field on the print log impacts the binary sizes and in turn their respective packages, the latter with an increase of 20k approximately (compared to 2.12-43) for most the the packages. Signed-off-by: Leo Sandoval --- ...unction-name-on-debug-print-function.patch | 102 ++++++++++++++++++ grub.patches | 3 +- grub2.spec | 7 +- 3 files changed, 109 insertions(+), 3 deletions(-) create mode 100644 0383-Include-function-name-on-debug-print-function.patch diff --git a/0383-Include-function-name-on-debug-print-function.patch b/0383-Include-function-name-on-debug-print-function.patch new file mode 100644 index 00000000..e38ad7f3 --- /dev/null +++ b/0383-Include-function-name-on-debug-print-function.patch @@ -0,0 +1,102 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 11 Apr 2025 15:31:53 -0600 +Subject: [PATCH] Include function name on debug and error print functions + +Together with the line number, the debug log gives more context when +debugging. + +Signed-off-by: Leo Sandoval +--- + grub-core/kern/err.c | 4 ++-- + grub-core/kern/misc.c | 4 ++-- + include/grub/err.h | 6 +++--- + include/grub/misc.h | 5 +++-- + 4 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/grub-core/kern/err.c b/grub-core/kern/err.c +index aebfe0cf83..ba04b57fb7 100644 +--- a/grub-core/kern/err.c ++++ b/grub-core/kern/err.c +@@ -38,14 +38,14 @@ static int grub_error_stack_assert; + #endif + + grub_err_t +-grub_error (grub_err_t n, const char *file, const int line, const char *fmt, ...) ++grub_error (grub_err_t n, const char *file, const char *function, const int line, const char *fmt, ...) + { + va_list ap; + int m; + + grub_errno = n; + +- m = grub_snprintf (grub_errmsg, sizeof (grub_errmsg), "%s:%d:", file, line); ++ m = grub_snprintf (grub_errmsg, sizeof (grub_errmsg), "%s:%s:%d:", file, function, line); + if (m < 0) + m = 0; + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 69bd655f3d..541c7bb80c 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -248,7 +248,7 @@ grub_debug_enabled (const char * condition) + } + + void +-grub_real_dprintf (const char *file, const int line, const char *condition, ++grub_real_dprintf (const char *file, const char *function, const int line, const char *condition, + const char *fmt, ...) + { + va_list args; +@@ -272,7 +272,7 @@ grub_real_dprintf (const char *file, const int line, const char *condition, + else + last_had_cr = 0; + #endif +- grub_printf ("%s:%d:%s: ", file, line, condition); ++ grub_printf ("%s:%s:%d:%s: ", file, function, line, condition); + va_start (args, fmt); + grub_vprintf (fmt, args); + va_end (args); +diff --git a/include/grub/err.h b/include/grub/err.h +index 7530f58b29..6379a6baf8 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -88,10 +88,10 @@ struct grub_error_saved + extern grub_err_t EXPORT_VAR(grub_errno); + extern char EXPORT_VAR(grub_errmsg)[GRUB_MAX_ERRMSG]; + +-grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *file, const int line, const char *fmt, ...) +- __attribute__ ((format (GNU_PRINTF, 4, 5))); ++grub_err_t EXPORT_FUNC(grub_error) (grub_err_t n, const char *file, const char *function, const int line, const char *fmt, ...) ++ __attribute__ ((format (GNU_PRINTF, 5, 6))); + +-#define grub_error(n, fmt, ...) grub_error (n, __FILE__, __LINE__, fmt, ##__VA_ARGS__) ++#define grub_error(n, fmt, ...) grub_error (n, __FILE__, __FUNCTION__, __LINE__, fmt, ##__VA_ARGS__) + + + void EXPORT_FUNC(grub_fatal) (const char *fmt, ...) __attribute__ ((noreturn)); +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 0429339ef3..2b9096a0b3 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -43,7 +43,7 @@ + #define CONCAT(a, b) CONCAT_(a, b) + #endif + +-#define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __LINE__, condition, __VA_ARGS__) ++#define grub_dprintf(condition, ...) grub_real_dprintf(GRUB_FILE, __FUNCTION__, __LINE__, condition, __VA_ARGS__) + + void *EXPORT_FUNC(grub_memmove) (void *dest, const void *src, grub_size_t n); + char *EXPORT_FUNC(grub_strcpy) (char *dest, const char *src); +@@ -420,9 +420,10 @@ int EXPORT_FUNC(grub_puts_) (const char *s); + int EXPORT_FUNC(grub_debug_is_enabled) (void); + int EXPORT_FUNC(grub_debug_enabled) (const char *condition); + void EXPORT_FUNC(grub_real_dprintf) (const char *file, ++ const char *function, + const int line, + const char *condition, +- const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 4, 5))); ++ const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 5, 6))); + int EXPORT_FUNC(grub_printf) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); + int EXPORT_FUNC(grub_printf_) (const char *fmt, ...) __attribute__ ((format (GNU_PRINTF, 1, 2))); + void EXPORT_FUNC(grub_qdprintf) (const char *condition, diff --git a/grub.patches b/grub.patches index f236c38a..66e0b693 100644 --- a/grub.patches +++ b/grub.patches @@ -378,4 +378,5 @@ Patch0378: 0378-cryptocheck-Add-quiet-option.patch Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch -Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch \ No newline at end of file +Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch +Patch0383: 0383-Include-function-name-on-debug-print-function.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index 0e804eac..4563828d 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 43%{?dist} +Release: 44%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,7 +609,10 @@ fi %endif %changelog -* Tue Aug 19 2025 Nicolas Frayer - 2.12-43 +* Mon Sep 15 2025 Leo Sandoval - 2.12-44 +- Include function name on debug print function + +* Fri Aug 29 2025 Nicolas Frayer - 2.12-43 - gen_grub_cfgstub: Removed output messages * Wed Aug 20 2025 Jan Stancek - 2.12-42 From 4614a09b9fba8c2ebd3f52f39d9a49ecb12c4c59 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Wed, 15 Oct 2025 15:11:39 -0600 Subject: [PATCH 39/45] Include upstream blsuki related patches Signed-off-by: Leo Sandoval --- 0001-kern-misc-Implement-grub_strtok.patch | 109 ++ ...g-command-to-parse-Boot-Loader-Speci.patch | 1354 +++++++++++++++++ ...ge-offset-type-for-grub_util_write_i.patch | 43 + ...blsuki-Check-for-mounted-boot-in-emu.patch | 342 +++++ ...ommand-to-load-Unified-Kernel-Image-.patch | 822 ++++++++++ ...p-Tweaks-in-preparation-for-libtasn1.patch | 168 ++ grub.macros | 2 +- grub.patches | 9 +- grub2.spec | 5 +- 9 files changed, 2851 insertions(+), 3 deletions(-) create mode 100644 0001-kern-misc-Implement-grub_strtok.patch create mode 100644 0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch create mode 100644 0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch create mode 100644 0004-blsuki-Check-for-mounted-boot-in-emu.patch create mode 100644 0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch create mode 100644 0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch diff --git a/0001-kern-misc-Implement-grub_strtok.patch b/0001-kern-misc-Implement-grub_strtok.patch new file mode 100644 index 00000000..e9e0e1ec --- /dev/null +++ b/0001-kern-misc-Implement-grub_strtok.patch @@ -0,0 +1,109 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 12 Aug 2025 03:45:32 +0000 +Subject: [PATCH] kern/misc: Implement grub_strtok() + +Add the functions grub_strtok() and grub_strtok_r() to help parse strings into +tokens separated by characters in the "delim" parameter. These functions are +present in gnulib but calling them directly from the gnulib code is quite +challenging since the call "#include " would include the header file +grub-core/lib/posix_wrap/string.h instead of grub-core/lib/gnulib/string.h, +where strtok() and strtok_r() are declared. Since this overlap is quite +problematic, the simpler solution was to implement the code in the GRUB based +on gnulib's implementation. For more information on these functions, visit the +Linux Programmer's Manual, man strtok. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/kern/misc.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++++++ + include/grub/misc.h | 3 +++ + 2 files changed, 65 insertions(+) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 69bd655f3d..c69fe7fb19 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -453,6 +453,68 @@ grub_strword (const char *haystack, const char *needle) + return 0; + } + ++char * ++grub_strtok_r (char *s, const char *delim, char **save_ptr) ++{ ++ char *token; ++ const char *c; ++ bool is_delim; ++ ++ if (s == NULL) ++ s = *save_ptr; ++ ++ /* Scan leading delimiters. */ ++ while (*s != '\0') ++ { ++ is_delim = false; ++ for (c = delim; *c != '\0'; c++) ++ { ++ if (*s == *c) ++ { ++ is_delim = true; ++ break; ++ } ++ } ++ if (is_delim == true) ++ s++; ++ else ++ break; ++ } ++ ++ if (*s == '\0') ++ { ++ *save_ptr = s; ++ return NULL; ++ } ++ ++ /* Find the end of the token. */ ++ token = s; ++ while (*s != '\0') ++ { ++ for (c = delim; *c != '\0'; c++) ++ { ++ if (*s == *c) ++ { ++ *s = '\0'; ++ *save_ptr = s + 1; ++ return token; ++ } ++ } ++ s++; ++ } ++ ++ *save_ptr = s; ++ return token; ++} ++ ++char * ++grub_strtok (char *s, const char *delim) ++{ ++ static char *last; ++ ++ return grub_strtok_r (s, delim, &last); ++} ++ + int + grub_isspace (int c) + { +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 0429339ef3..626f0c3535 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -134,6 +134,9 @@ char *EXPORT_FUNC(grub_strchr) (const char *s, int c); + char *EXPORT_FUNC(grub_strrchr) (const char *s, int c); + int EXPORT_FUNC(grub_strword) (const char *s, const char *w); + ++char *EXPORT_FUNC(grub_strtok_r) (char *s, const char *delim, char **save_ptr); ++char *EXPORT_FUNC(grub_strtok) (char *s, const char *delim); ++ + /* Copied from gnulib. + Written by Bruno Haible , 2005. */ + static inline char * diff --git a/0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch b/0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch new file mode 100644 index 00000000..e2bf790a --- /dev/null +++ b/0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch @@ -0,0 +1,1354 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 12 Aug 2025 03:45:33 +0000 +Subject: [PATCH] blsuki: Add blscfg command to parse Boot Loader Specification + snippets + +The BootLoaderSpec (BLS) defines a scheme where different bootloaders can +share a format for boot items and a configuration directory that accepts +these common configurations as drop-in files. + +The BLS Specification: https://uapi-group.org/specifications/specs/boot_loader_specification/ + +Signed-off-by: Peter Jones +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Will Thompson +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + bootstrap.conf | 1 + + docs/grub.texi | 74 ++- + grub-core/Makefile.core.def | 12 + + grub-core/commands/blscfg.c | 2 +- + grub-core/commands/blsuki.c | 1028 ++++++++++++++++++++++++++++++++++++++++ + grub-core/commands/legacycfg.c | 4 +- + grub-core/commands/menuentry.c | 7 +- + grub-core/normal/main.c | 4 + + include/grub/menu.h | 14 + + include/grub/normal.h | 2 +- + 10 files changed, 1140 insertions(+), 8 deletions(-) + create mode 100644 grub-core/commands/blsuki.c + +diff --git a/bootstrap.conf b/bootstrap.conf +index 60de0597c5..799cdb1a35 100644 +--- a/bootstrap.conf ++++ b/bootstrap.conf +@@ -24,6 +24,7 @@ gnulib_modules=" + argp + base64 + error ++ filevercmp + fnmatch + getdelim + getline +diff --git a/docs/grub.texi b/docs/grub.texi +index ae01e8c994..336f8e87ed 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3275,6 +3275,7 @@ These variables have special meaning to GRUB. + + @menu + * biosnum:: ++* blsuki_save_default:: + * check_appended_signatures:: + * check_signatures:: + * chosen:: +@@ -3339,6 +3340,11 @@ this. + For an alternative approach which also changes BIOS drive mappings for the + chain-loaded system, @pxref{drivemap}. + ++@node blsuki_save_default ++@subsection blsuki_save_default ++ ++If this variable is set, menu entries generated from BLS config files ++(@pxref{blscfg}) will be set as the default boot entry when selected. + + @node check_appended_signatures + @subsection check_appended_signatures +@@ -3346,7 +3352,6 @@ chain-loaded system, @pxref{drivemap}. + This variable controls whether GRUB enforces appended signature validation on + certain loaded files. @xref{Using appended signatures}. + +- + @node check_signatures + @subsection check_signatures + +@@ -4355,6 +4360,7 @@ you forget a command, you can run the command @command{help} + * background_image:: Load background image for active terminal + * badram:: Filter out bad regions of RAM + * blocklist:: Print a block list ++* blscfg:: Load Boot Loader Specification menu entries + * boot:: Start up your operating system + * cat:: Show the contents of a file + * clear:: Clear the screen +@@ -4542,6 +4548,72 @@ Print a block list (@pxref{Block list syntax}) for @var{file}. + @end deffn + + ++@node blscfg ++@subsection blscfg ++ ++@deffn Command blscfg [@option{-p|--path} dir] [@option{-f|--enable-fallback}] [@option{-d|--show-default}] [@option{-n|--show-non-default}] [@option{-e|--entry} file] ++Load Boot Loader Specification (BLS) entries into the GRUB menu. Boot entries ++generated from @command{blscfg} won't interfere with entries from @file{grub.cfg} appearing in ++the GRUB menu. Also, entries generated from @command{blscfg} exists only in memory and ++don't update @file{grub.cfg}. ++ ++By default, the BLS entries are stored in the @file{/loader/entries} directory in the ++boot partition. If BLS entries are stored elsewhere, the @option{--path} option can be ++used to check a different directory instead of the default location. If no BLS ++entries are found while using the @option{--path} option, the @option{--enable-fallback} option ++can be used to check for entries in the default location. ++ ++The @option{--show-default} option allows the default boot entry to be added to the ++GRUB menu from the BLS entries. ++ ++The @option{--show-non-default} option allows non-default boot entries to be added to ++the GRUB menu from the BLS entries. ++ ++The @option{--entry} option allows specific boot entries to be added to the GRUB menu ++from the BLS entries. ++ ++The @option{--entry}, @option{--show-default}, and @option{--show-non-default} options ++are used to filter which BLS entries are added to the GRUB menu. If none are ++used, all entries in the default location or the location specified by @option{--path} ++will be added to the GRUB menu. ++ ++A BLS config file example: ++@example ++# /boot/loader/entries/6a9857a393724b7a981ebb5b8495b9ea-3.8.0-2.fc19.x86_64.conf ++title Fedora 19 (Rawhide) ++sort-key fedora ++machine-id 6a9857a393724b7a981ebb5b8495b9ea ++version 3.8.0-2.fc19.x86_64 ++options root=UUID=6d3376e4-fc93-4509-95ec-a21d68011da2 quiet ++architecture x64 ++linux /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/linux ++initrd /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/initrd ++@end example ++ ++For more information on BLS entry keys as well as other information on BLS, ++see: @uref{https://uapi-group.org/specifications/specs/boot_loader_specification/, The Boot Loader Specification}. For the GRUB, there are a few additional ++BLS entry keys based on the @command{menuentry} command (@pxref{menuentry}). ++ ++The @code{grub_class} key may be used any number of times to group menu entries into ++classes. Menu themes may display different classes using different styles. ++ ++The @code{grub_users} key grants specific users access to specific menu ++entries. @xref{Security}. ++ ++The @code{grub_hotkey} key associates a hotkey with a menu entry. ++@var{key} may be a single letter, or one of the aliases @samp{backspace}, ++@samp{tab}, or @samp{delete}. ++ ++The @code{grub_args} key can be used for any other argument to be passed as positonal ++parameters when the list of commands generated from the BLS config file are ++executed. ++ ++Variable expansion using the @samp{$} character (@xref{Shell-like scripting}) may be ++used with BLS config files for the GRUB but might not be compatible with other ++bootloaders. ++@end deffn ++ ++ + @node boot + @subsection boot + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 95fd18d2dd..5e0e757344 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -884,6 +884,18 @@ module = { + enable = i386_xen_pvh; + }; + ++module = { ++ name = blsuki; ++ common = commands/blsuki.c; ++ common = lib/gnulib/filevercmp.c; ++ enable = powerpc_ieee1275; ++ enable = efi; ++ enable = i386_pc; ++ enable = emu; ++ cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; ++ cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; ++}; ++ + module = { + name = boot; + common = commands/boot.c; +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 5d931b0c9b..38913d6964 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -955,7 +955,7 @@ static void create_entry (struct bls_entry *entry) + clinux, options ? " " : "", options ? options : "", + initrd ? initrd : "", dt ? dt : ""); + +- grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry); ++ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, &index, entry, NULL); + grub_dprintf ("blscfg", "Added entry %d id:\"%s\"\n", index, id); + + finish: +diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c +new file mode 100644 +index 0000000000..9440adb100 +--- /dev/null ++++ b/grub-core/commands/blsuki.c +@@ -0,0 +1,1028 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2025 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++GRUB_MOD_LICENSE ("GPLv3+"); ++ ++#define GRUB_BLS_CONFIG_PATH "/loader/entries/" ++ ++#define BLS_EXT_LEN (sizeof (".conf") - 1) ++ ++/* ++ * It is highly unlikely to ever receive a large amount of keyval pairs. A ++ * limit of 10000 is more than enough. ++ */ ++#define BLSUKI_KEYVALS_MAX 10000 ++ ++static const struct grub_arg_option bls_opt[] = ++ { ++ {"path", 'p', 0, "Specify path to find BLS entries.", N_("DIR"), ARG_TYPE_PATHNAME}, ++ {"enable-fallback", 'f', 0, "Fallback to the default BLS path if --path fails to find BLS entries.", 0, ARG_TYPE_NONE}, ++ {"show-default", 'd', 0, "Allow the default BLS entry to be added to the GRUB menu.", 0, ARG_TYPE_NONE}, ++ {"show-non-default", 'n', 0, "Allow the non-default BLS entries to be added to the GRUB menu.", 0, ARG_TYPE_NONE}, ++ {"entry", 'e', 0, "Allow specific BLS entries to be added to the GRUB menu.", N_("FILE"), ARG_TYPE_FILE}, ++ {0, 0, 0, 0, 0, 0} ++ }; ++ ++struct keyval ++{ ++ const char *key; ++ char *val; ++}; ++ ++struct read_entry_info ++{ ++ const char *devid; ++ const char *dirname; ++ grub_file_t file; ++}; ++ ++struct find_entry_info ++{ ++ const char *dirname; ++ const char *devid; ++ grub_device_t dev; ++ grub_fs_t fs; ++}; ++ ++static grub_blsuki_entry_t *entries; ++ ++#define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) ++ ++/* ++ * This function will add a new keyval pair to a list of keyvals stored in the ++ * entry parameter. ++ */ ++static grub_err_t ++blsuki_add_keyval (grub_blsuki_entry_t *entry, char *key, char *val) ++{ ++ char *k, *v; ++ struct keyval **kvs, *kv; ++ grub_size_t size; ++ int new_n = entry->nkeyvals + 1; ++ ++ if (new_n > BLSUKI_KEYVALS_MAX) ++ return grub_error (GRUB_ERR_BAD_NUMBER, "too many keyval pairs"); ++ ++ if (entry->keyvals_size == 0) ++ { ++ size = sizeof (struct keyval *); ++ kvs = grub_malloc (size); ++ if (kvs == NULL) ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't allocate space for BLS key values"); ++ ++ entry->keyvals = kvs; ++ entry->keyvals_size = size; ++ } ++ else if (entry->keyvals_size < new_n * sizeof (struct keyval *)) ++ { ++ size = entry->keyvals_size * 2; ++ kvs = grub_realloc (entry->keyvals, size); ++ if (kvs == NULL) ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't reallocate space for BLS key values"); ++ ++ entry->keyvals = kvs; ++ entry->keyvals_size = size; ++ } ++ ++ kv = grub_malloc (sizeof (struct keyval)); ++ if (kv == NULL) ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); ++ ++ k = grub_strdup (key); ++ if (k == NULL) ++ { ++ grub_free (kv); ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); ++ } ++ ++ v = grub_strdup (val); ++ if (v == NULL) ++ { ++ grub_free (k); ++ grub_free (kv); ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "couldn't find space for new BLS key value"); ++ } ++ ++ kv->key = k; ++ kv->val = v; ++ entry->keyvals[entry->nkeyvals] = kv; ++ entry->nkeyvals = new_n; ++ ++ return GRUB_ERR_NONE; ++} ++ ++/* ++ * Find the value of the key named by keyname. If there are allowed to be ++ * more than one, pass a pointer set to -1 to the last parameter the first ++ * time, and pass the same pointer through each time after, and it'll return ++ * them in sorted order as defined in the BLS fragment file. ++ */ ++static char * ++blsuki_get_val (grub_blsuki_entry_t *entry, const char *keyname, int *last) ++{ ++ int idx, start = (last != NULL) ? (*last + 1) : 0; ++ struct keyval *kv = NULL; ++ char *ret = NULL; ++ ++ for (idx = start; idx < entry->nkeyvals; idx++) ++ { ++ kv = entry->keyvals[idx]; ++ ++ if (grub_strcmp (keyname, kv->key) == 0) ++ { ++ ret = kv->val; ++ break; ++ } ++ } ++ ++ if (last != NULL) ++ { ++ if (idx == entry->nkeyvals) ++ *last = -1; ++ else ++ *last = idx; ++ } ++ ++ return ret; ++} ++ ++/* ++ * Add a new grub_blsuki_entry_t struct to the entries list and sort it's ++ * position on the list. ++ */ ++static grub_err_t ++blsuki_add_entry (grub_blsuki_entry_t *entry) ++{ ++ grub_blsuki_entry_t *e, *last = NULL; ++ int rc; ++ ++ if (entries == NULL) ++ { ++ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); ++ entries = entry; ++ return GRUB_ERR_NONE; ++ } ++ ++ FOR_BLSUKI_ENTRIES (e) ++ { ++ rc = filevercmp (entry->filename, e->filename); ++ if (rc == 0) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("duplicate file: `%s'"), entry->filename); ++ ++ if (rc > 0) ++ { ++ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); ++ grub_list_push (GRUB_AS_LIST_P (&e), GRUB_AS_LIST (entry)); ++ if (entry->next == entries) ++ { ++ entries = entry; ++ entry->prev = NULL; ++ } ++ else if (last != NULL) ++ last->next = entry; ++ ++ return GRUB_ERR_NONE; ++ } ++ last = e; ++ } ++ ++ if (last != NULL) ++ { ++ grub_dprintf ("blsuki", "Add entry with id \"%s\"\n", entry->filename); ++ last->next = entry; ++ entry->prev = &last; ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ ++/* ++ * This function parses each line of a BLS config file to obtain the key value ++ * pairs that will be used to setup the GRUB menu entries. The key value pair ++ * will be stored in a list in the entry parameter. ++ */ ++static grub_err_t ++bls_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) ++{ ++ grub_err_t err = GRUB_ERR_NONE; ++ ++ for (;;) ++ { ++ char *line, *key, *val; ++ ++ line = grub_file_getline (f); ++ if (line == NULL) ++ break; ++ ++ key = grub_strtok_r (line, " \t", &val); ++ if (key == NULL) ++ { ++ grub_free (line); ++ break; ++ } ++ if (*key == '#') ++ { ++ grub_free (line); ++ continue; ++ } ++ ++ while (*val == ' ' || *val == '\t') ++ val++; ++ ++ if (*val == '\0') ++ { ++ grub_free (line); ++ break; ++ } ++ ++ err = blsuki_add_keyval (entry, key, val); ++ grub_free (line); ++ if (err != GRUB_ERR_NONE) ++ break; ++ } ++ ++ return err; ++} ++ ++/* ++ * If a file hasn't already been opened, this function opens a BLS config file ++ * and initializes entry data before parsing keyvals and adding the entry to ++ * the list of BLS entries. ++ */ ++static int ++blsuki_read_entry (const char *filename, ++ const struct grub_dirhook_info *dirhook_info __attribute__ ((__unused__)), ++ void *data) ++{ ++ grub_size_t path_len = 0, filename_len; ++ grub_err_t err; ++ char *p = NULL; ++ grub_file_t f = NULL; ++ grub_blsuki_entry_t *entry; ++ struct read_entry_info *info = (struct read_entry_info *) data; ++ ++ grub_dprintf ("blsuki", "filename: \"%s\"\n", filename); ++ ++ filename_len = grub_strlen (filename); ++ ++ if (info->file != NULL) ++ f = info->file; ++ else ++ { ++ if (filename_len < BLS_EXT_LEN || ++ grub_strcmp (filename + filename_len - BLS_EXT_LEN, ".conf") != 0) ++ return 0; ++ ++ p = grub_xasprintf ("(%s)%s/%s", info->devid, info->dirname, filename); ++ ++ f = grub_file_open (p, GRUB_FILE_TYPE_CONFIG); ++ grub_free (p); ++ if (f == NULL) ++ goto finish; ++ } ++ ++ entry = grub_zalloc (sizeof (*entry)); ++ if (entry == NULL) ++ goto finish; ++ ++ /* ++ * If a file is opened before this function, the filename may have a path. ++ * Since the filename is used for the ID of the GRUB menu entry, we can ++ * remove the path. ++ */ ++ if (info->file != NULL) ++ { ++ char *slash; ++ ++ slash = grub_strrchr (filename, '/'); ++ if (slash != NULL) ++ path_len = slash - filename + 1; ++ } ++ filename_len -= path_len; ++ ++ entry->filename = grub_strndup (filename + path_len, filename_len); ++ if (entry->filename == NULL) ++ { ++ grub_free (entry); ++ goto finish; ++ } ++ ++ err = bls_parse_keyvals (f, entry); ++ ++ if (err == GRUB_ERR_NONE) ++ blsuki_add_entry (entry); ++ else ++ grub_free (entry); ++ ++ finish: ++ if (f != NULL) ++ grub_file_close (f); ++ ++ return 0; ++} ++ ++/* ++ * This function returns a list of values that had the same key in the BLS ++ * config file. The number of entries in this list is returned by the len ++ * parameter. ++ */ ++static char ** ++blsuki_make_list (grub_blsuki_entry_t *entry, const char *key, int *len) ++{ ++ int last = -1; ++ char *val; ++ int nlist = 0; ++ char **list; ++ ++ list = grub_zalloc (sizeof (char *)); ++ if (list == NULL) ++ return NULL; ++ ++ while (1) ++ { ++ char **new; ++ ++ /* ++ * Since the same key might appear more than once, the 'last' variable ++ * starts at -1 and increments to indicate the last index in the list ++ * we obtained from blsuki_get_val(). ++ */ ++ val = blsuki_get_val (entry, key, &last); ++ if (val == NULL) ++ break; ++ ++ new = grub_realloc (list, (nlist + 2) * sizeof (char *)); ++ if (new == NULL) ++ break; ++ ++ list = new; ++ list[nlist++] = val; ++ list[nlist] = NULL; ++ } ++ ++ if (nlist == 0) ++ { ++ grub_free (list); ++ return NULL; ++ } ++ ++ if (len != NULL) ++ *len = nlist; ++ ++ return list; ++} ++ ++/* ++ * This function appends a field to the end of a buffer. If the field given is ++ * an enviornmental variable, it gets the value stored for that variable and ++ * appends that to the buffer instead. ++ */ ++static char * ++blsuki_field_append (bool is_env_var, char *buffer, const char *start, const char *end) ++{ ++ char *tmp; ++ const char *field; ++ grub_size_t size = 0; ++ ++ tmp = grub_strndup (start, end - start + 1); ++ if (tmp == NULL) ++ return NULL; ++ ++ field = tmp; ++ ++ if (is_env_var == true) ++ { ++ field = grub_env_get (tmp); ++ if (field == NULL) ++ return buffer; ++ } ++ ++ if (grub_add (grub_strlen (field), 1, &size)) ++ return NULL; ++ ++ if (buffer == NULL) ++ buffer = grub_zalloc (size); ++ else ++ { ++ if (grub_add (size, grub_strlen (buffer), &size)) ++ return NULL; ++ ++ buffer = grub_realloc (buffer, size); ++ } ++ ++ if (buffer == NULL) ++ return NULL; ++ ++ tmp = buffer + grub_strlen (buffer); ++ tmp = grub_stpcpy (tmp, field); ++ ++ if (is_env_var == true) ++ tmp = grub_stpcpy (tmp, " "); ++ ++ return buffer; ++} ++ ++/* ++ * This function takes a value string, checks for environmental variables, and ++ * returns the value string with all environmental variables replaced with the ++ * value stored in the variable. ++ */ ++static char * ++blsuki_expand_val (const char *value) ++{ ++ char *buffer = NULL; ++ const char *start = value; ++ const char *end = value; ++ bool is_env_var = false; ++ ++ if (value == NULL) ++ return NULL; ++ ++ while (*value != '\0') ++ { ++ if (*value == '$') ++ { ++ if (start != end) ++ { ++ buffer = blsuki_field_append (is_env_var, buffer, start, end); ++ if (buffer == NULL) ++ return NULL; ++ } ++ ++ is_env_var = true; ++ start = value + 1; ++ } ++ else if (is_env_var == true) ++ { ++ if (grub_isalnum (*value) == 0 && *value != '_') ++ { ++ buffer = blsuki_field_append (is_env_var, buffer, start, end); ++ is_env_var = false; ++ start = value; ++ if (*start == ' ') ++ start++; ++ } ++ } ++ ++ end = value; ++ value++; ++ } ++ ++ if (start != end) ++ { ++ buffer = blsuki_field_append (is_env_var, buffer, start, end); ++ if (buffer == NULL) ++ return NULL; ++ } ++ ++ return buffer; ++} ++ ++/* ++ * This function returns a string with the command to load a linux kernel with ++ * kernel command-line options based on what was specified in the BLS config ++ * file. ++ */ ++static char * ++bls_get_linux (grub_blsuki_entry_t *entry) ++{ ++ char *linux_path; ++ char *linux_cmd = NULL; ++ char *options = NULL; ++ char *tmp; ++ grub_size_t size; ++ ++ linux_path = blsuki_get_val (entry, "linux", NULL); ++ options = blsuki_expand_val (blsuki_get_val (entry, "options", NULL)); ++ ++ if (grub_add (sizeof ("linux "), grub_strlen (linux_path), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); ++ goto finish; ++ } ++ ++ if (options != NULL) ++ { ++ if (grub_add (size, grub_strlen (options), &size) || ++ grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); ++ goto finish; ++ } ++ } ++ ++ linux_cmd = grub_malloc (size); ++ if (linux_cmd == NULL) ++ goto finish; ++ ++ tmp = linux_cmd; ++ tmp = grub_stpcpy (tmp, "linux "); ++ tmp = grub_stpcpy (tmp, linux_path); ++ if (options != NULL) ++ { ++ tmp = grub_stpcpy (tmp, " "); ++ tmp = grub_stpcpy (tmp, options); ++ } ++ ++ tmp = grub_stpcpy (tmp, "\n"); ++ ++ finish: ++ grub_free (options); ++ return linux_cmd; ++} ++ ++/* ++ * This function returns a string with the command to load all initrds for a ++ * linux kernel image based on the list provided by the BLS config file. ++ */ ++static char * ++bls_get_initrd (grub_blsuki_entry_t *entry) ++{ ++ char **initrd_list; ++ char *initrd_cmd = NULL; ++ char *tmp; ++ grub_size_t size; ++ int i; ++ ++ initrd_list = blsuki_make_list (entry, "initrd", NULL); ++ if (initrd_list != NULL) ++ { ++ size = sizeof ("initrd"); ++ ++ for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) ++ { ++ if (grub_add (size, 1, &size) || ++ grub_add (size, grub_strlen (initrd_list[i]), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); ++ goto finish; ++ } ++ } ++ ++ if (grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); ++ goto finish; ++ } ++ ++ initrd_cmd = grub_malloc (size); ++ if (initrd_cmd == NULL) ++ goto finish; ++ ++ tmp = grub_stpcpy (initrd_cmd, "initrd"); ++ for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) ++ { ++ grub_dprintf ("blsuki", "adding initrd %s\n", initrd_list[i]); ++ tmp = grub_stpcpy (tmp, " "); ++ tmp = grub_stpcpy (tmp, initrd_list[i]); ++ } ++ tmp = grub_stpcpy (tmp, "\n"); ++ } ++ ++ finish: ++ grub_free (initrd_list); ++ return initrd_cmd; ++} ++ ++/* ++ * This function returns a string with the command to load a device tree blob ++ * from the BLS config file. ++ */ ++static char * ++bls_get_devicetree (grub_blsuki_entry_t *entry) ++{ ++ char *dt_path; ++ char *dt_cmd = NULL; ++ char *tmp; ++ grub_size_t size; ++ ++ dt_path = blsuki_expand_val (blsuki_get_val (entry, "devicetree", NULL)); ++ if (dt_path != NULL) ++ { ++ if (grub_add (sizeof ("devicetree "), grub_strlen (dt_path), &size) || ++ grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating device tree buffer size"); ++ return NULL; ++ } ++ ++ dt_cmd = grub_malloc (size); ++ if (dt_cmd == NULL) ++ return NULL; ++ ++ tmp = dt_cmd; ++ tmp = grub_stpcpy (dt_cmd, "devicetree "); ++ tmp = grub_stpcpy (tmp, dt_path); ++ tmp = grub_stpcpy (tmp, "\n"); ++ } ++ ++ return dt_cmd; ++} ++ ++/* ++ * This function puts together all of the commands generated from the contents ++ * of the BLS config file and creates a new entry in the GRUB boot menu. ++ */ ++static void ++bls_create_entry (grub_blsuki_entry_t *entry) ++{ ++ int argc = 0; ++ const char **argv = NULL; ++ char *title = NULL; ++ char *linux_path = NULL; ++ char *linux_cmd = NULL; ++ char *initrd_cmd = NULL; ++ char *dt_cmd = NULL; ++ char *id = entry->filename; ++ grub_size_t id_len; ++ char *hotkey = NULL; ++ char *users = NULL; ++ char **classes = NULL; ++ char **args = NULL; ++ char *src = NULL; ++ int i; ++ grub_size_t size; ++ bool blsuki_save_default; ++ ++ linux_path = blsuki_get_val (entry, "linux", NULL); ++ if (linux_path == NULL) ++ { ++ grub_dprintf ("blsuki", "Skipping file %s with no 'linux' key.\n", entry->filename); ++ goto finish; ++ } ++ ++ id_len = grub_strlen (id); ++ if (id_len >= BLS_EXT_LEN && grub_strcmp (id + id_len - BLS_EXT_LEN, ".conf") == 0) ++ id[id_len - BLS_EXT_LEN] = '\0'; ++ ++ title = blsuki_get_val (entry, "title", NULL); ++ hotkey = blsuki_get_val (entry, "grub_hotkey", NULL); ++ users = blsuki_expand_val (blsuki_get_val (entry, "grub_users", NULL)); ++ classes = blsuki_make_list (entry, "grub_class", NULL); ++ args = blsuki_make_list (entry, "grub_arg", &argc); ++ ++ argc++; ++ if (grub_mul (argc + 1, sizeof (char *), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected creating argv list")); ++ goto finish; ++ } ++ ++ argv = grub_malloc (size); ++ if (argv == NULL) ++ goto finish; ++ ++ argv[0] = (title != NULL) ? title : linux_path; ++ for (i = 1; i < argc; i++) ++ argv[i] = args[i - 1]; ++ argv[argc] = NULL; ++ ++ linux_cmd = bls_get_linux (entry); ++ if (linux_cmd == NULL) ++ goto finish; ++ ++ initrd_cmd = bls_get_initrd (entry); ++ if (grub_errno != GRUB_ERR_NONE) ++ goto finish; ++ ++ dt_cmd = bls_get_devicetree (entry); ++ if (grub_errno != GRUB_ERR_NONE) ++ goto finish; ++ ++ blsuki_save_default = grub_env_get_bool ("blsuki_save_default", false); ++ src = grub_xasprintf ("%s%s%s%s", ++ blsuki_save_default ? "savedefault\n" : "", ++ linux_cmd, initrd_cmd ? initrd_cmd : "", ++ dt_cmd ? dt_cmd : ""); ++ ++ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry); ++ ++ finish: ++ grub_free (linux_cmd); ++ grub_free (dt_cmd); ++ grub_free (initrd_cmd); ++ grub_free (classes); ++ grub_free (args); ++ grub_free (argv); ++ grub_free (src); ++} ++ ++/* ++ * This function fills a find_entry_info struct passed in by the info parameter. ++ * If the dirname or devid parameters are set to NULL, the dirname and devid ++ * fields in the info parameter will be set to default values. If info already ++ * has a value in the dev fields, we can compare it to the value passed in by ++ * the devid parameter or the default devid to see if we need to open a new ++ * device. ++ */ ++static grub_err_t ++blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid) ++{ ++ grub_device_t dev; ++ grub_fs_t fs; ++ ++ if (info == NULL) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, "info parameter is not set"); ++ ++ if (devid == NULL) ++ { ++ devid = grub_env_get ("root"); ++ if (devid == NULL) ++ return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); ++ } ++ ++ /* Check that we aren't closing and opening the same device. */ ++ if (info->dev != NULL && grub_strcmp (info->devid, devid) != 0) ++ { ++ grub_device_close (info->dev); ++ info->dev = NULL; ++ } ++ /* If we are using the same device, then we can skip this step and only set the directory. */ ++ if (info->dev == NULL) ++ { ++ grub_dprintf ("blsuki", "opening %s\n", devid); ++ dev = grub_device_open (devid); ++ if (dev == NULL) ++ return grub_errno; ++ ++ grub_dprintf ("blsuki", "probing fs\n"); ++ fs = grub_fs_probe (dev); ++ if (fs == NULL) ++ { ++ grub_device_close (dev); ++ return grub_errno; ++ } ++ ++ info->devid = devid; ++ info->dev = dev; ++ info->fs = fs; ++ } ++ ++ info->dirname = dirname; ++ ++ return GRUB_ERR_NONE; ++} ++ ++/* ++ * This function searches for BLS config files based on the data in the info ++ * parameter. If the fallback option is enabled, the default location will be ++ * checked for BLS config files if the first attempt fails. ++ */ ++static void ++blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) ++{ ++ struct read_entry_info read_entry_info; ++ grub_fs_t dir_fs = NULL; ++ grub_device_t dir_dev = NULL; ++ bool fallback = false; ++ int r; ++ ++ do ++ { ++ read_entry_info.file = NULL; ++ read_entry_info.dirname = info->dirname; ++ ++ grub_dprintf ("blsuki", "scanning dir: %s\n", info->dirname); ++ dir_dev = info->dev; ++ dir_fs = info->fs; ++ read_entry_info.devid = info->devid; ++ ++ r = dir_fs->fs_dir (dir_dev, read_entry_info.dirname, blsuki_read_entry, ++ &read_entry_info); ++ if (r != 0) ++ { ++ grub_dprintf ("blsuki", "blsuki_read_entry returned error\n"); ++ grub_errno = GRUB_ERR_NONE; ++ } ++ ++ /* ++ * If we aren't able to find BLS entries in the directory given by info->dirname, ++ * we can fallback to the default location "/boot/loader/entries/" and see if we ++ * can find the files there. ++ */ ++ if (entries == NULL && fallback == false && enable_fallback == true) ++ { ++ blsuki_set_find_entry_info (info, GRUB_BLS_CONFIG_PATH, NULL); ++ grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", ++ read_entry_info.dirname, info->dirname); ++ fallback = true; ++ } ++ else ++ fallback = false; ++ } ++ while (fallback == true); ++} ++ ++static grub_err_t ++blsuki_load_entries (char *path, bool enable_fallback) ++{ ++ grub_size_t len; ++ static grub_err_t r; ++ const char *devid = NULL; ++ char *dir = NULL; ++ struct find_entry_info info = { ++ .dev = NULL, ++ .fs = NULL, ++ .dirname = NULL, ++ }; ++ struct read_entry_info rei = { ++ .devid = NULL, ++ .dirname = NULL, ++ }; ++ ++ if (path != NULL) ++ { ++ len = grub_strlen (path); ++ if (len >= BLS_EXT_LEN && grub_strcmp (path + len - BLS_EXT_LEN, ".conf") == 0) ++ { ++ rei.file = grub_file_open (path, GRUB_FILE_TYPE_CONFIG); ++ if (rei.file == NULL) ++ return grub_errno; ++ ++ /* blsuki_read_entry() closes the file. */ ++ return blsuki_read_entry (path, NULL, &rei); ++ } ++ else if (path[0] == '(') ++ { ++ devid = path + 1; ++ ++ dir = grub_strchr (path, ')'); ++ if (dir == NULL) ++ return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("invalid file name `%s'"), path); ++ ++ *dir = '\0'; ++ ++ /* Check if there is more than the devid in the path. */ ++ if (dir + 1 < path + len) ++ dir = dir + 1; ++ } ++ else if (path[0] == '/') ++ dir = path; ++ } ++ ++ if (dir == NULL) ++ dir = (char *) GRUB_BLS_CONFIG_PATH; ++ ++ r = blsuki_set_find_entry_info (&info, dir, devid); ++ if (r == GRUB_ERR_NONE) ++ blsuki_find_entry (&info, enable_fallback); ++ ++ if (info.dev != NULL) ++ grub_device_close (info.dev); ++ ++ return r; ++} ++ ++static bool ++blsuki_is_default_entry (const char *def_entry, grub_blsuki_entry_t *entry, int idx) ++{ ++ const char *title; ++ const char *def_entry_end; ++ long def_idx; ++ ++ if (def_entry == NULL || *def_entry == '\0') ++ return false; ++ ++ if (grub_strcmp (def_entry, entry->filename) == 0) ++ return true; ++ ++ title = blsuki_get_val (entry, "title", NULL); ++ ++ if (title != NULL && grub_strcmp (def_entry, title) == 0) ++ return true; ++ ++ def_idx = grub_strtol (def_entry, &def_entry_end, 0); ++ if (*def_entry_end != '\0' || def_idx < 0 || def_idx > GRUB_INT_MAX) ++ return false; ++ ++ if ((int) def_idx == idx) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * This function creates a GRUB boot menu entry for each BLS entry in the ++ * entries list. ++ */ ++static grub_err_t ++blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) ++{ ++ const char *def_entry = NULL; ++ grub_blsuki_entry_t *entry = NULL; ++ int idx = 0; ++ ++ def_entry = grub_env_get ("default"); ++ ++ FOR_BLSUKI_ENTRIES(entry) ++ { ++ if (entry->visible == true) ++ { ++ idx++; ++ continue; ++ } ++ if ((show_default == true && blsuki_is_default_entry (def_entry, entry, idx) == true) || ++ (show_non_default == true && blsuki_is_default_entry (def_entry, entry, idx) == false) || ++ (entry_id != NULL && grub_strcmp (entry_id, entry->filename) == 0)) ++ { ++ bls_create_entry (entry); ++ entry->visible = true; ++ } ++ ++ idx++; ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ ++static grub_err_t ++grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), ++ char **args __attribute__ ((unused))) ++{ ++ grub_err_t err; ++ struct grub_arg_list *state = ctxt->state; ++ char *path = NULL; ++ char *entry_id = NULL; ++ bool enable_fallback = false; ++ bool show_default = false; ++ bool show_non_default = false; ++ bool all = true; ++ entries = NULL; ++ ++ if (state[0].set) ++ path = state[0].arg; ++ if (state[1].set) ++ enable_fallback = true; ++ if (state[2].set) ++ { ++ show_default = true; ++ all = false; ++ } ++ if (state[3].set) ++ { ++ show_non_default = true; ++ all = false; ++ } ++ if (state[4].set) ++ { ++ entry_id = state[4].arg; ++ all = false; ++ } ++ if (all == true) ++ { ++ show_default = true; ++ show_non_default = true; ++ } ++ ++ err = blsuki_load_entries (path, enable_fallback); ++ if (err != GRUB_ERR_NONE) ++ return err; ++ ++ return blsuki_create_entries (show_default, show_non_default, entry_id); ++} ++ ++static grub_extcmd_t bls_cmd; ++ ++GRUB_MOD_INIT(blsuki) ++{ ++ bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, ++ N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), ++ N_("Import Boot Loader Specification snippets."), ++ bls_opt); ++} ++ ++GRUB_MOD_FINI(blsuki) ++{ ++ grub_unregister_extcmd (bls_cmd); ++} +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index 86bcda6954..a5d296769e 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -143,7 +143,7 @@ legacy_file (const char *filename) + args[0] = oldname; + grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy", + NULL, NULL, +- entrysrc, 0, NULL, NULL); ++ entrysrc, 0, NULL, NULL, NULL); + grub_free (args); + entrysrc[0] = 0; + grub_free (oldname); +@@ -205,7 +205,7 @@ legacy_file (const char *filename) + args[0] = entryname; + grub_normal_add_menu_entry (1, args, NULL, NULL, NULL, + NULL, NULL, entrysrc, 0, NULL, +- NULL); ++ NULL, NULL); + grub_free (args); + } + +diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c +index b175a1b43b..d6cf329203 100644 +--- a/grub-core/commands/menuentry.c ++++ b/grub-core/commands/menuentry.c +@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args, + char **classes, const char *id, + const char *users, const char *hotkey, + const char *prefix, const char *sourcecode, +- int submenu, int *index, struct bls_entry *bls) ++ int submenu, int *index, struct bls_entry *bls, grub_blsuki_entry_t *blsuki) + { + int menu_hotkey = 0; + char **menu_args = NULL; +@@ -196,6 +196,7 @@ grub_normal_add_menu_entry (int argc, const char **args, + (*last)->sourcecode = menu_sourcecode; + (*last)->submenu = submenu; + (*last)->bls = bls; ++ (*last)->blsuki = blsuki; + + menu->size++; + if (index) +@@ -297,7 +298,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) + ctxt->state[2].arg, 0, + ctxt->state[3].arg, + ctxt->extcmd->cmd->name[0] == 's', +- NULL, NULL); ++ NULL, NULL, NULL); + + src = args[argc - 1]; + args[argc - 1] = NULL; +@@ -315,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args) + users, + ctxt->state[2].arg, prefix, src + 1, + ctxt->extcmd->cmd->name[0] == 's', NULL, +- NULL); ++ NULL, NULL); + + src[len - 1] = ch; + args[argc - 1] = src; +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 6f7290a897..e038ed14b8 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -75,6 +75,10 @@ grub_normal_free_menu (grub_menu_t menu) + { + entry->bls->visible = 0; + } ++ if (entry->blsuki) ++ { ++ entry->blsuki->visible = 0; ++ } + + grub_free ((void *) entry->id); + grub_free ((void *) entry->users); +diff --git a/include/grub/menu.h b/include/grub/menu.h +index 0acdc2aa6b..43a3c5809b 100644 +--- a/include/grub/menu.h ++++ b/include/grub/menu.h +@@ -20,6 +20,7 @@ + #ifndef GRUB_MENU_HEADER + #define GRUB_MENU_HEADER 1 + ++ + struct bls_entry + { + struct bls_entry *next; +@@ -30,6 +31,18 @@ struct bls_entry + int visible; + }; + ++struct grub_blsuki_entry ++{ ++ struct grub_blsuki_entry *next; ++ struct grub_blsuki_entry **prev; ++ struct keyval **keyvals; ++ grub_size_t keyvals_size; ++ int nkeyvals; ++ char *filename; ++ bool visible; ++}; ++typedef struct grub_blsuki_entry grub_blsuki_entry_t; ++ + struct grub_menu_entry_class + { + char *name; +@@ -73,6 +86,7 @@ struct grub_menu_entry + + /* BLS used to populate the entry */ + struct bls_entry *bls; ++ grub_blsuki_entry_t *blsuki; + }; + typedef struct grub_menu_entry *grub_menu_entry_t; + +diff --git a/include/grub/normal.h b/include/grub/normal.h +index 8839ad85a1..6d2b59db88 100644 +--- a/include/grub/normal.h ++++ b/include/grub/normal.h +@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes, + const char *id, + const char *users, const char *hotkey, + const char *prefix, const char *sourcecode, +- int submenu, int *index, struct bls_entry *bls); ++ int submenu, int *index, struct bls_entry *bls, grub_blsuki_entry_t *blsuki); + + grub_err_t + grub_normal_set_password (const char *user, const char *password); diff --git a/0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch b/0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch new file mode 100644 index 00000000..f80fb5c9 --- /dev/null +++ b/0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 12 Aug 2025 03:45:34 +0000 +Subject: [PATCH] util/misc.c: Change offset type for + grub_util_write_image_at() + +Adding filevercmp support to grub-core/commands/blsuki.c from gnulib will cause +issues with the type of the offset parameter for grub_util_write_image_at() for +emu builds. To fix this issue, we can change the type from off_t to grub_off_t. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + include/grub/util/misc.h | 2 +- + util/misc.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/grub/util/misc.h b/include/grub/util/misc.h +index e9e0a6724a..bfce065583 100644 +--- a/include/grub/util/misc.h ++++ b/include/grub/util/misc.h +@@ -36,7 +36,7 @@ char *grub_util_read_image (const char *path); + void grub_util_load_image (const char *path, char *buf); + void grub_util_write_image (const char *img, size_t size, FILE *out, + const char *name); +-void grub_util_write_image_at (const void *img, size_t size, off_t offset, ++void grub_util_write_image_at (const void *img, size_t size, grub_off_t offset, + FILE *out, const char *name); + + char *make_system_path_relative_to_its_root (const char *path); +diff --git a/util/misc.c b/util/misc.c +index 0f928e5b49..6e16a68d9a 100644 +--- a/util/misc.c ++++ b/util/misc.c +@@ -101,7 +101,7 @@ grub_util_read_image (const char *path) + } + + void +-grub_util_write_image_at (const void *img, size_t size, off_t offset, FILE *out, ++grub_util_write_image_at (const void *img, size_t size, grub_off_t offset, FILE *out, + const char *name) + { + grub_util_info ("writing 0x%" GRUB_HOST_PRIxLONG_LONG " bytes at offset 0x%" diff --git a/0004-blsuki-Check-for-mounted-boot-in-emu.patch b/0004-blsuki-Check-for-mounted-boot-in-emu.patch new file mode 100644 index 00000000..3f207333 --- /dev/null +++ b/0004-blsuki-Check-for-mounted-boot-in-emu.patch @@ -0,0 +1,342 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Tue, 12 Aug 2025 03:45:35 +0000 +Subject: [PATCH] blsuki: Check for mounted /boot in emu + +Irritatingly, BLS defines paths relative to the mountpoint of the +filesystem which contains its snippets, not / or any other fixed +location. So grub-emu needs to know whether /boot is a separate +filesystem from / and conditionally prepend a path. + +Signed-off-by: Robbie Harwood +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/Makefile.core.def | 3 ++ + grub-core/commands/blsuki.c | 83 +++++++++++++++++++++++++++++++++++++---- + grub-core/osdep/linux/getroot.c | 8 ++++ + grub-core/osdep/unix/getroot.c | 4 +- + include/grub/emu/misc.h | 2 +- + 5 files changed, 91 insertions(+), 9 deletions(-) + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 5e0e757344..885dd436de 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -376,6 +376,9 @@ kernel = { + emu = kern/emu/cache_s.S; + emu = kern/emu/hostdisk.c; + emu = osdep/unix/hostdisk.c; ++ emu = osdep/relpath.c; ++ emu = osdep/getroot.c; ++ emu = osdep/unix/getroot.c; + emu = osdep/exec.c; + extra_dist = osdep/unix/exec.c; + emu = osdep/devmapper/hostdisk.c; +diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c +index 9440adb100..ed93a150b1 100644 +--- a/grub-core/commands/blsuki.c ++++ b/grub-core/commands/blsuki.c +@@ -32,6 +32,13 @@ + #include + #include + ++#ifdef GRUB_MACHINE_EMU ++#include ++#define GRUB_BOOT_DEVICE "/boot" ++#else ++#define GRUB_BOOT_DEVICE "" ++#endif ++ + GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_BLS_CONFIG_PATH "/loader/entries/" +@@ -79,6 +86,34 @@ static grub_blsuki_entry_t *entries; + + #define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) + ++/* ++ * BLS appears to make paths relative to the filesystem that snippets are ++ * on, not /. Attempt to cope. ++ */ ++static char *blsuki_update_boot_device (char *tmp) ++{ ++#ifdef GRUB_MACHINE_EMU ++ static int separate_boot = -1; ++ char *ret; ++ ++ if (separate_boot != -1) ++ goto probed; ++ ++ separate_boot = 0; ++ ++ ret = grub_make_system_path_relative_to_its_root (GRUB_BOOT_DEVICE); ++ ++ if (ret != NULL && ret[0] == '\0') ++ separate_boot = 1; ++ ++ probed: ++ if (separate_boot == 0) ++ return tmp; ++#endif ++ ++ return grub_stpcpy (tmp, GRUB_BOOT_DEVICE); ++} ++ + /* + * This function will add a new keyval pair to a list of keyvals stored in the + * entry parameter. +@@ -526,7 +561,7 @@ bls_get_linux (grub_blsuki_entry_t *entry) + linux_path = blsuki_get_val (entry, "linux", NULL); + options = blsuki_expand_val (blsuki_get_val (entry, "options", NULL)); + +- if (grub_add (sizeof ("linux "), grub_strlen (linux_path), &size)) ++ if (grub_add (sizeof ("linux " GRUB_BOOT_DEVICE), grub_strlen (linux_path), &size)) + { + grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while calculating linux buffer size"); + goto finish; +@@ -548,6 +583,7 @@ bls_get_linux (grub_blsuki_entry_t *entry) + + tmp = linux_cmd; + tmp = grub_stpcpy (tmp, "linux "); ++ tmp = blsuki_update_boot_device (tmp); + tmp = grub_stpcpy (tmp, linux_path); + if (options != NULL) + { +@@ -582,7 +618,7 @@ bls_get_initrd (grub_blsuki_entry_t *entry) + + for (i = 0; initrd_list != NULL && initrd_list[i] != NULL; i++) + { +- if (grub_add (size, 1, &size) || ++ if (grub_add (size, sizeof (" " GRUB_BOOT_DEVICE) - 1, &size) || + grub_add (size, grub_strlen (initrd_list[i]), &size)) + { + grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating initrd buffer size"); +@@ -605,6 +641,7 @@ bls_get_initrd (grub_blsuki_entry_t *entry) + { + grub_dprintf ("blsuki", "adding initrd %s\n", initrd_list[i]); + tmp = grub_stpcpy (tmp, " "); ++ tmp = blsuki_update_boot_device (tmp); + tmp = grub_stpcpy (tmp, initrd_list[i]); + } + tmp = grub_stpcpy (tmp, "\n"); +@@ -630,7 +667,7 @@ bls_get_devicetree (grub_blsuki_entry_t *entry) + dt_path = blsuki_expand_val (blsuki_get_val (entry, "devicetree", NULL)); + if (dt_path != NULL) + { +- if (grub_add (sizeof ("devicetree "), grub_strlen (dt_path), &size) || ++ if (grub_add (sizeof ("devicetree " GRUB_BOOT_DEVICE), grub_strlen (dt_path), &size) || + grub_add (size, 1, &size)) + { + grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected calculating device tree buffer size"); +@@ -643,6 +680,7 @@ bls_get_devicetree (grub_blsuki_entry_t *entry) + + tmp = dt_cmd; + tmp = grub_stpcpy (dt_cmd, "devicetree "); ++ tmp = blsuki_update_boot_device (tmp); + tmp = grub_stpcpy (tmp, dt_path); + tmp = grub_stpcpy (tmp, "\n"); + } +@@ -757,7 +795,11 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c + + if (devid == NULL) + { ++#ifdef GRUB_MACHINE_EMU ++ devid = "host"; ++#else + devid = grub_env_get ("root"); ++#endif + if (devid == NULL) + return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); + } +@@ -799,10 +841,13 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c + * parameter. If the fallback option is enabled, the default location will be + * checked for BLS config files if the first attempt fails. + */ +-static void ++static grub_err_t + blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + { + struct read_entry_info read_entry_info; ++ char *default_dir = NULL; ++ char *tmp; ++ grub_size_t default_size; + grub_fs_t dir_fs = NULL; + grub_device_t dir_dev = NULL; + bool fallback = false; +@@ -833,7 +878,15 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + */ + if (entries == NULL && fallback == false && enable_fallback == true) + { +- blsuki_set_find_entry_info (info, GRUB_BLS_CONFIG_PATH, NULL); ++ default_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 1; ++ default_dir = grub_malloc (default_size); ++ if (default_dir == NULL) ++ return grub_errno; ++ ++ tmp = blsuki_update_boot_device (default_dir); ++ tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); ++ ++ blsuki_set_find_entry_info (info, default_dir, NULL); + grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", + read_entry_info.dirname, info->dirname); + fallback = true; +@@ -842,6 +895,9 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + fallback = false; + } + while (fallback == true); ++ ++ grub_free (default_dir); ++ return GRUB_ERR_NONE; + } + + static grub_err_t +@@ -851,6 +907,9 @@ blsuki_load_entries (char *path, bool enable_fallback) + static grub_err_t r; + const char *devid = NULL; + char *dir = NULL; ++ char *default_dir = NULL; ++ char *tmp; ++ grub_size_t dir_size; + struct find_entry_info info = { + .dev = NULL, + .fs = NULL, +@@ -892,15 +951,25 @@ blsuki_load_entries (char *path, bool enable_fallback) + } + + if (dir == NULL) +- dir = (char *) GRUB_BLS_CONFIG_PATH; ++ { ++ dir_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 2; ++ default_dir = grub_malloc (dir_size); ++ if (default_dir == NULL) ++ return grub_errno; ++ ++ tmp = blsuki_update_boot_device (default_dir); ++ tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); ++ dir = default_dir; ++ } + + r = blsuki_set_find_entry_info (&info, dir, devid); + if (r == GRUB_ERR_NONE) +- blsuki_find_entry (&info, enable_fallback); ++ r = blsuki_find_entry (&info, enable_fallback); + + if (info.dev != NULL) + grub_device_close (info.dev); + ++ grub_free (default_dir); + return r; + } + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index 4bf386b590..8bf281c1d8 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -139,6 +139,7 @@ struct mountinfo_entry + char fstype[ESCAPED_PATH_MAX + 1], device[ESCAPED_PATH_MAX + 1]; + }; + ++#ifdef GRUB_UTIL + static char ** + grub_util_raid_getmembers (const char *name, int bootable) + { +@@ -199,6 +200,7 @@ grub_util_raid_getmembers (const char *name, int bootable) + + return devicelist; + } ++#endif + + /* Statting something on a btrfs filesystem always returns a virtual device + major/minor pair rather than the real underlying device, because btrfs +@@ -700,6 +702,7 @@ out: + return ret; + } + ++#ifdef GRUB_UTIL + static char * + get_mdadm_uuid (const char *os_dev) + { +@@ -757,6 +760,7 @@ out: + + return name; + } ++#endif + + static int + grub_util_is_imsm_or_ddf (const char *os_dev) +@@ -1096,6 +1100,7 @@ grub_util_part_to_disk (const char *os_dev, struct stat *st, + return path; + } + ++#ifdef GRUB_UTIL + static char * + grub_util_get_raid_grub_dev (const char *os_dev) + { +@@ -1198,6 +1203,7 @@ grub_util_get_raid_grub_dev (const char *os_dev) + } + return grub_dev; + } ++#endif + + enum grub_dev_abstraction_types + grub_util_get_dev_abstraction_os (const char *os_dev) +@@ -1214,6 +1220,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) + return GRUB_DEV_ABSTRACTION_NONE; + } + ++#ifdef GRUB_UTIL + int + grub_util_pull_device_os (const char *os_dev, + enum grub_dev_abstraction_types ab) +@@ -1270,6 +1277,7 @@ grub_util_get_grub_dev_os (const char *os_dev) + + return grub_dev; + } ++#endif + + static void *mp = NULL; + static void +diff --git a/grub-core/osdep/unix/getroot.c b/grub-core/osdep/unix/getroot.c +index ee11b02fb6..62581ba601 100644 +--- a/grub-core/osdep/unix/getroot.c ++++ b/grub-core/osdep/unix/getroot.c +@@ -16,8 +16,8 @@ + * along with GRUB. If not, see . + */ + +-#include + #include ++#include + + #include + #include +@@ -567,6 +567,7 @@ grub_guess_root_devices (const char *dir_in) + + #endif + ++#ifdef GRUB_UTIL + void + grub_util_pull_lvm_by_command (const char *os_dev) + { +@@ -663,6 +664,7 @@ out: + free (buf); + free (vgid); + } ++#endif + + /* ZFS has similar problems to those of btrfs (see above). */ + void +diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h +index f3a712a8b2..59b8038c60 100644 +--- a/include/grub/emu/misc.h ++++ b/include/grub/emu/misc.h +@@ -39,7 +39,7 @@ void grub_fini_all (void); + void grub_find_zpool_from_dir (const char *dir, + char **poolname, char **poolfs); + +-char *grub_make_system_path_relative_to_its_root (const char *path) ++char *EXPORT_FUNC (grub_make_system_path_relative_to_its_root) (const char *path) + WARN_UNUSED_RESULT; + int + grub_util_device_is_mapped (const char *dev); diff --git a/0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch b/0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch new file mode 100644 index 00000000..fe91d9e4 --- /dev/null +++ b/0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch @@ -0,0 +1,822 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 12 Aug 2025 03:45:36 +0000 +Subject: [PATCH] blsuki: Add uki command to load Unified Kernel Image entries + +A Unified Kernel Image (UKI) is a single UEFI PE file that combines +a UEFI boot stub, a Linux kernel image, an initrd, and further resources. +The uki command will locate where the UKI file is and create a GRUB menu +entry to load it. + +The Unified Kernel Image Specification: https://uapi-group.org/specifications/specs/unified_kernel_image/ + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 36 +++- + grub-core/commands/blsuki.c | 476 ++++++++++++++++++++++++++++++++++++++++---- + include/grub/menu.h | 2 + + 3 files changed, 474 insertions(+), 40 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 336f8e87ed..531e847f32 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3344,7 +3344,8 @@ chain-loaded system, @pxref{drivemap}. + @subsection blsuki_save_default + + If this variable is set, menu entries generated from BLS config files +-(@pxref{blscfg}) will be set as the default boot entry when selected. ++(@pxref{blscfg}) or UKI files (@pxref{uki}) will be set as the default boot ++entry when selected. + + @node check_appended_signatures + @subsection check_appended_signatures +@@ -4434,6 +4435,7 @@ you forget a command, you can run the command @command{help} + * true:: Do nothing, successfully + * trust:: Add public key to list of trusted keys + * trust_certificate:: Add an x509 certificate to the list of trusted certificates ++* uki:: Load Unified Kernel Image menu entries + * unset:: Unset an environment variable + @comment * vbeinfo:: List available video modes + * verify_appended:: Verify appended digital signature +@@ -6062,6 +6064,38 @@ Unset the environment variable @var{envvar}. + @end deffn + + ++@node uki ++@subsection uki ++ ++@deffn Command uki [@option{-p|--path} dir] [@option{-f|--enable-fallback}] [@option{-d|--show-default}] [@option{-n|--show-non-default}] [@option{-e|--entry} file] ++Load Unified Kernel Image (UKI) files into the GRUB menu. Boot entries ++generated from @command{uki} won't interfere with entries from @file{grub.cfg} appearing in the ++GRUB menu. Also, entries generated from @command{uki} exists only in memory and don't ++update @file{grub.cfg}. ++ ++By default, the UKI files are stored in the @file{/EFI/Linux} directory in the EFI ++system partition. If UKI files are stored elsewhere, the @option{--path} option can be ++used to check a different directory instead of the default location. If no UKI ++files are found while using the @option{--path} option, the @option{--enable-fallback} option can ++be used to check for files in the default location. ++ ++The @option{--show-default} option allows the default boot entry to be added to the ++GRUB menu from the UKI files. ++ ++The @option{--show-non-default} option allows non-default boot entries to be added to ++the GRUB menu from the UKI files. ++ ++The @option{--entry} option allows specific boot entries to be added to the GRUB menu ++from the UKI files. ++ ++The @option{--entry}, @option{--show-default}, and @option{--show-non-default} options ++are used to filter which UKI files are added to the GRUB menu. If none are ++used, all files in the default location or the location specified by @option{--path} ++will be added to the GRUB menu. ++ ++For more information on UKI, see: @uref{https://uapi-group.org/specifications/specs/unified_kernel_image/, The Unified Kernel Image Specification} ++@end deffn ++ + @ignore + @node vbeinfo + @subsection vbeinfo +diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c +index ed93a150b1..cb00f936a7 100644 +--- a/grub-core/commands/blsuki.c ++++ b/grub-core/commands/blsuki.c +@@ -32,6 +32,12 @@ + #include + #include + ++#ifdef GRUB_MACHINE_EFI ++#include ++#include ++#include ++#endif ++ + #ifdef GRUB_MACHINE_EMU + #include + #define GRUB_BOOT_DEVICE "/boot" +@@ -42,14 +48,28 @@ + GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_BLS_CONFIG_PATH "/loader/entries/" ++#define GRUB_UKI_CONFIG_PATH "/EFI/Linux" + + #define BLS_EXT_LEN (sizeof (".conf") - 1) ++#define UKI_EXT_LEN (sizeof (".efi") - 1) + + /* + * It is highly unlikely to ever receive a large amount of keyval pairs. A + * limit of 10000 is more than enough. + */ + #define BLSUKI_KEYVALS_MAX 10000 ++/* ++ * The only sections we read are ".cmdline" and ".osrel". The ".cmdline" ++ * section has a size limit of 4096 and it would be very unlikely for the size ++ * of the ".osrel" section to be 5 times larger than 4096. ++ */ ++#define UKI_SECTION_SIZE_MAX (5 * 4096) ++ ++enum blsuki_cmd_type ++ { ++ BLSUKI_BLS_CMD, ++ BLSUKI_UKI_CMD, ++ }; + + static const struct grub_arg_option bls_opt[] = + { +@@ -61,6 +81,18 @@ static const struct grub_arg_option bls_opt[] = + {0, 0, 0, 0, 0, 0} + }; + ++#ifdef GRUB_MACHINE_EFI ++static const struct grub_arg_option uki_opt[] = ++ { ++ {"path", 'p', 0, N_("Specify path to find UKI entries."), N_("DIR"), ARG_TYPE_PATHNAME}, ++ {"enable-fallback", 'f', 0, "Fallback to the default BLS path if --path fails to find UKI entries.", 0, ARG_TYPE_NONE}, ++ {"show-default", 'd', 0, N_("Allow the default UKI entry to be added to the GRUB menu."), 0, ARG_TYPE_NONE}, ++ {"show-non-default", 'n', 0, N_("Allow the non-default UKI entries to be added to the GRUB menu."), 0, ARG_TYPE_NONE}, ++ {"entry", 'e', 0, N_("Allow specificUKII entries to be added to the GRUB menu."), N_("FILE"), ARG_TYPE_FILE}, ++ {0, 0, 0, 0, 0, 0} ++ }; ++#endif ++ + struct keyval + { + const char *key; +@@ -71,6 +103,7 @@ struct read_entry_info + { + const char *devid; + const char *dirname; ++ enum blsuki_cmd_type cmd_type; + grub_file_t file; + }; + +@@ -82,7 +115,7 @@ struct find_entry_info + grub_fs_t fs; + }; + +-static grub_blsuki_entry_t *entries; ++static grub_blsuki_entry_t *entries = NULL; + + #define FOR_BLSUKI_ENTRIES(var) FOR_LIST_ELEMENTS (var, entries) + +@@ -181,7 +214,7 @@ blsuki_add_keyval (grub_blsuki_entry_t *entry, char *key, char *val) + * Find the value of the key named by keyname. If there are allowed to be + * more than one, pass a pointer set to -1 to the last parameter the first + * time, and pass the same pointer through each time after, and it'll return +- * them in sorted order as defined in the BLS fragment file. ++ * them in sorted order. + */ + static char * + blsuki_get_val (grub_blsuki_entry_t *entry, const char *keyname, int *last) +@@ -310,20 +343,212 @@ bls_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) + return err; + } + ++#ifdef GRUB_MACHINE_EFI ++/* ++ * This function searches for the .cmdline, .osrel, and .linux sections of a ++ * UKI. We only need to store the data for the .cmdline and .osrel sections, ++ * but we also need to verify that the .linux section exists. ++ */ ++static grub_err_t ++uki_parse_keyvals (grub_file_t f, grub_blsuki_entry_t *entry) ++{ ++ struct grub_msdos_image_header *dos = NULL; ++ struct grub_pe_image_header *pe = NULL; ++ grub_off_t section_offset = 0; ++ struct grub_pe32_section_table *section = NULL; ++ struct grub_pe32_coff_header *coff_header = NULL; ++ char *val = NULL; ++ char *key = NULL; ++ const char *target[] = {".cmdline", ".osrel", ".linux", NULL}; ++ bool has_linux = false; ++ grub_err_t err = GRUB_ERR_NONE; ++ ++ dos = grub_zalloc (sizeof (*dos)); ++ if (dos == NULL) ++ return grub_errno; ++ if (grub_file_read (f, dos, sizeof (*dos)) < (grub_ssize_t) sizeof (*dos)) ++ { ++ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read UKI image header"); ++ goto finish; ++ } ++ if (dos->msdos_magic != GRUB_DOS_MAGIC) ++ { ++ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, "plain image kernel is not supported"); ++ goto finish; ++ } ++ ++ grub_dprintf ("blsuki", "PE/COFF header @ %08x\n", dos->pe_image_header_offset); ++ pe = grub_zalloc (sizeof (*pe)); ++ if (pe == NULL) ++ { ++ err = grub_errno; ++ goto finish; ++ } ++ if (grub_file_seek (f, dos->pe_image_header_offset) == (grub_off_t) -1 || ++ grub_file_read (f, pe, sizeof (*pe)) != sizeof (*pe)) ++ { ++ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read COFF image header"); ++ goto finish; ++ } ++ if (pe->optional_header.magic != GRUB_PE32_NATIVE_MAGIC) ++ { ++ err = grub_error (GRUB_ERR_BAD_FILE_TYPE, "non-native image not supported"); ++ goto finish; ++ } ++ ++ coff_header = &(pe->coff_header); ++ section_offset = dos->pe_image_header_offset + sizeof (*pe); ++ ++ for (int i = 0; i < coff_header->num_sections; i++) ++ { ++ section = grub_zalloc (sizeof (*section)); ++ if (section == NULL) ++ { ++ err = grub_errno; ++ goto finish; ++ } ++ ++ if (grub_file_seek (f, section_offset) == (grub_off_t) -1 || ++ grub_file_read (f, section, sizeof (*section)) != sizeof (*section)) ++ { ++ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read section header"); ++ goto finish; ++ } ++ ++ key = grub_strndup (section->name, 8); ++ if (key == NULL) ++ { ++ err = grub_errno; ++ goto finish; ++ } ++ ++ for (int j = 0; target[j] != NULL; j++) ++ { ++ if (grub_strcmp (key, target[j]) == 0) ++ { ++ /* ++ * We don't need to read the contents of the .linux PE section, but we ++ * should verify that the section exists. ++ */ ++ if (grub_strcmp (key, ".linux") == 0) ++ { ++ has_linux = true; ++ break; ++ } ++ ++ if (section->raw_data_size > UKI_SECTION_SIZE_MAX) ++ { ++ err = grub_error (GRUB_ERR_BAD_NUMBER, "UKI section size is larger than expected"); ++ goto finish; ++ } ++ ++ val = grub_zalloc (section->raw_data_size); ++ if (val == NULL) ++ { ++ err = grub_errno; ++ goto finish; ++ } ++ ++ if (grub_file_seek (f, section->raw_data_offset) == (grub_off_t) -1 || ++ grub_file_read (f, val, section->raw_data_size) != (grub_ssize_t) section->raw_data_size) ++ { ++ err = grub_error (GRUB_ERR_FILE_READ_ERROR, "failed to read section"); ++ goto finish; ++ } ++ ++ err = blsuki_add_keyval (entry, key, val); ++ if (err != GRUB_ERR_NONE) ++ goto finish; ++ ++ break; ++ } ++ } ++ ++ section_offset += sizeof (*section); ++ grub_free (section); ++ grub_free (val); ++ grub_free (key); ++ section = NULL; ++ val = NULL; ++ key = NULL; ++ } ++ ++ if (has_linux == false) ++ err = grub_error (GRUB_ERR_NO_KERNEL, "UKI is missing the '.linux' section"); ++ ++ finish: ++ grub_free (dos); ++ grub_free (pe); ++ grub_free (section); ++ grub_free (val); ++ grub_free (key); ++ return err; ++} ++ ++/* ++ * This function obtains the keyval pairs when the .osrel data is input into ++ * the osrel_ptr parameter and returns the keyval pair. Since we are using ++ * grub_strtok_r(), the osrel_ptr will be updated to the following line of ++ * osrel. This function returns NULL when it reaches the end of osrel. ++ */ ++static char * ++uki_read_osrel (char **osrel_ptr, char **val_ret) ++{ ++ char *key, *val; ++ grub_size_t val_size; ++ ++ for (;;) ++ { ++ key = grub_strtok_r (NULL, "\n\r", osrel_ptr); ++ if (key == NULL) ++ return NULL; ++ ++ /* Remove leading white space */ ++ while (*key == ' ' || *key == '\t') ++ key++; ++ ++ /* Skip commented lines */ ++ if (*key == '#') ++ continue; ++ ++ /* Split key/value */ ++ key = grub_strtok_r (key, "=", &val); ++ if (key == NULL || *val == '\0') ++ continue; ++ ++ /* Remove quotes from value */ ++ val_size = grub_strlen (val); ++ if ((*val == '\"' && val[val_size - 1] == '\"') || ++ (*val == '\'' && val[val_size - 1] == '\'')) ++ { ++ val[val_size - 1] = '\0'; ++ val++; ++ } ++ ++ *val_ret = val; ++ break; ++ } ++ ++ return key; ++} ++#endif ++ + /* + * If a file hasn't already been opened, this function opens a BLS config file +- * and initializes entry data before parsing keyvals and adding the entry to +- * the list of BLS entries. ++ * or UKI and initializes entry data before parsing keyvals and adding the entry ++ * to the list of BLS or UKI entries. + */ + static int + blsuki_read_entry (const char *filename, + const struct grub_dirhook_info *dirhook_info __attribute__ ((__unused__)), + void *data) + { +- grub_size_t path_len = 0, filename_len; +- grub_err_t err; ++ grub_size_t path_len = 0, ext_len = 0, filename_len; ++ grub_err_t err = GRUB_ERR_NONE; + char *p = NULL; ++ const char *ext = NULL; + grub_file_t f = NULL; ++ enum grub_file_type file_type = 0; + grub_blsuki_entry_t *entry; + struct read_entry_info *info = (struct read_entry_info *) data; + +@@ -331,17 +556,31 @@ blsuki_read_entry (const char *filename, + + filename_len = grub_strlen (filename); + ++ if (info->cmd_type == BLSUKI_BLS_CMD) ++ { ++ ext = ".conf"; ++ ext_len = BLS_EXT_LEN; ++ file_type = GRUB_FILE_TYPE_CONFIG; ++ } ++#ifdef GRUB_MACHINE_EFI ++ else if (info->cmd_type == BLSUKI_UKI_CMD) ++ { ++ ext = ".efi"; ++ ext_len = UKI_EXT_LEN; ++ file_type = GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE; ++ } ++#endif ++ + if (info->file != NULL) + f = info->file; + else + { +- if (filename_len < BLS_EXT_LEN || +- grub_strcmp (filename + filename_len - BLS_EXT_LEN, ".conf") != 0) ++ if (filename_len < ext_len || ++ grub_strcmp (filename + filename_len - ext_len, ext) != 0) + return 0; + + p = grub_xasprintf ("(%s)%s/%s", info->devid, info->dirname, filename); +- +- f = grub_file_open (p, GRUB_FILE_TYPE_CONFIG); ++ f = grub_file_open (p, file_type); + grub_free (p); + if (f == NULL) + goto finish; +@@ -373,7 +612,26 @@ blsuki_read_entry (const char *filename, + goto finish; + } + +- err = bls_parse_keyvals (f, entry); ++ entry->dirname = grub_strdup (info->dirname); ++ if (entry->dirname == NULL) ++ { ++ grub_free (entry); ++ goto finish; ++ } ++ ++ entry->devid = grub_strdup (info->devid); ++ if (entry->devid == NULL) ++ { ++ grub_free (entry); ++ goto finish; ++ } ++ ++ if (info->cmd_type == BLSUKI_BLS_CMD) ++ err = bls_parse_keyvals (f, entry); ++#ifdef GRUB_MACHINE_EFI ++ else if (info->cmd_type == BLSUKI_UKI_CMD) ++ err = uki_parse_keyvals (f, entry); ++#endif + + if (err == GRUB_ERR_NONE) + blsuki_add_entry (entry); +@@ -389,7 +647,7 @@ blsuki_read_entry (const char *filename, + + /* + * This function returns a list of values that had the same key in the BLS +- * config file. The number of entries in this list is returned by the len ++ * config file or UKI. The number of entries in this list is returned by the len + * parameter. + */ + static char ** +@@ -764,7 +1022,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) + linux_cmd, initrd_cmd ? initrd_cmd : "", + dt_cmd ? dt_cmd : ""); + +- grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry); ++ grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, NULL, NULL, entry); + + finish: + grub_free (linux_cmd); +@@ -776,6 +1034,70 @@ bls_create_entry (grub_blsuki_entry_t *entry) + grub_free (src); + } + ++#ifdef GRUB_MACHINE_EFI ++/* ++ * This function puts together the section data received from the UKI and ++ * generates a new entry in the GRUB boot menu. ++ */ ++static void ++uki_create_entry (grub_blsuki_entry_t *entry) ++{ ++ const char **argv = NULL; ++ char *id = entry->filename; ++ char *title = NULL; ++ char *options = NULL; ++ char *osrel, *osrel_line; ++ char *key = NULL; ++ char *value = NULL; ++ char *src = NULL; ++ bool blsuki_save_default; ++ ++ /* ++ * Although .osrel is listed as optional in the UKI specification, the .osrel ++ * section is needed to generate the GRUB menu entry title. ++ */ ++ osrel = blsuki_get_val (entry, ".osrel", NULL); ++ if (osrel == NULL) ++ { ++ grub_dprintf ("blsuki", "Skipping file %s with no '.osrel' key.\n", entry->filename); ++ goto finish; ++ } ++ ++ osrel_line = osrel; ++ while ((key = uki_read_osrel (&osrel_line, &value)) != NULL) ++ { ++ if (grub_strcmp ("PRETTY_NAME", key) == 0) ++ { ++ title = value; ++ break; ++ } ++ } ++ ++ options = blsuki_get_val (entry, ".cmdline", NULL); ++ ++ argv = grub_zalloc (2 * sizeof (char *)); ++ if (argv == NULL) ++ goto finish; ++ argv[0] = title; ++ ++ blsuki_save_default = grub_env_get_bool ("blsuki_save_default", false); ++ src = grub_xasprintf ("%schainloader (%s)%s/%s%s%s\n", ++ blsuki_save_default ? "savedefault\n" : "", ++ entry->devid, entry->dirname, ++ entry->filename, ++ (options != NULL) ? " " : "", ++ (options != NULL) ? options : ""); ++ ++ grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, NULL, NULL, entry); ++ ++ finish: ++ grub_free (argv); ++ grub_free (src); ++ grub_free (options); ++ grub_free (osrel); ++} ++#endif ++ + /* + * This function fills a find_entry_info struct passed in by the info parameter. + * If the dirname or devid parameters are set to NULL, the dirname and devid +@@ -785,7 +1107,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) + * device. + */ + static grub_err_t +-blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid) ++blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, const char *devid, enum blsuki_cmd_type cmd_type) + { + grub_device_t dev; + grub_fs_t fs; +@@ -795,10 +1117,23 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c + + if (devid == NULL) + { ++ if (cmd_type == BLSUKI_BLS_CMD) ++ { + #ifdef GRUB_MACHINE_EMU +- devid = "host"; ++ devid = "host"; + #else +- devid = grub_env_get ("root"); ++ devid = grub_env_get ("root"); ++#endif ++ } ++#ifdef GRUB_MACHINE_EFI ++ else if (cmd_type == BLSUKI_UKI_CMD) ++ { ++ grub_efi_loaded_image_t *image = grub_efi_get_loaded_image (grub_efi_image_handle); ++ ++ if (image == NULL) ++ return grub_error (GRUB_ERR_BAD_DEVICE, N_("unable to find boot device")); ++ devid = grub_efidisk_get_device_name (image->device_handle); ++ } + #endif + if (devid == NULL) + return grub_error (GRUB_ERR_FILE_NOT_FOUND, N_("variable '%s' isn't set"), "root"); +@@ -837,15 +1172,16 @@ blsuki_set_find_entry_info (struct find_entry_info *info, const char *dirname, c + } + + /* +- * This function searches for BLS config files based on the data in the info +- * parameter. If the fallback option is enabled, the default location will be +- * checked for BLS config files if the first attempt fails. ++ * This function searches for BLS config files and UKIs based on the data in the ++ * info parameter. If the fallback option is enabled, the default location will ++ * be checked for BLS config files or UKIs if the first attempt fails. + */ + static grub_err_t +-blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) ++blsuki_find_entry (struct find_entry_info *info, bool enable_fallback, enum blsuki_cmd_type cmd_type) + { + struct read_entry_info read_entry_info; + char *default_dir = NULL; ++ const char *cmd_dir = NULL; + char *tmp; + grub_size_t default_size; + grub_fs_t dir_fs = NULL; +@@ -862,6 +1198,7 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + dir_dev = info->dev; + dir_fs = info->fs; + read_entry_info.devid = info->devid; ++ read_entry_info.cmd_type = cmd_type; + + r = dir_fs->fs_dir (dir_dev, read_entry_info.dirname, blsuki_read_entry, + &read_entry_info); +@@ -874,19 +1211,27 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + /* + * If we aren't able to find BLS entries in the directory given by info->dirname, + * we can fallback to the default location "/boot/loader/entries/" and see if we +- * can find the files there. ++ * can find the files there. If we can't find UKI entries, fallback to ++ * "/EFI/Linux" on the EFI system partition. + */ + if (entries == NULL && fallback == false && enable_fallback == true) + { +- default_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 1; ++ if (cmd_type == BLSUKI_BLS_CMD) ++ cmd_dir = GRUB_BLS_CONFIG_PATH; ++#ifdef GRUB_MACHINE_EFI ++ else if (cmd_type == BLSUKI_UKI_CMD) ++ cmd_dir = GRUB_UKI_CONFIG_PATH; ++#endif ++ ++ default_size = sizeof (GRUB_BOOT_DEVICE) + grub_strlen (cmd_dir); + default_dir = grub_malloc (default_size); + if (default_dir == NULL) + return grub_errno; + + tmp = blsuki_update_boot_device (default_dir); +- tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); ++ tmp = grub_stpcpy (tmp, cmd_dir); + +- blsuki_set_find_entry_info (info, default_dir, NULL); ++ blsuki_set_find_entry_info (info, default_dir, NULL, cmd_type); + grub_dprintf ("blsuki", "Entries weren't found in %s, fallback to %s\n", + read_entry_info.dirname, info->dirname); + fallback = true; +@@ -901,15 +1246,17 @@ blsuki_find_entry (struct find_entry_info *info, bool enable_fallback) + } + + static grub_err_t +-blsuki_load_entries (char *path, bool enable_fallback) ++blsuki_load_entries (char *path, bool enable_fallback, enum blsuki_cmd_type cmd_type) + { +- grub_size_t len; ++ grub_size_t len, ext_len = 0; + static grub_err_t r; + const char *devid = NULL; + char *dir = NULL; + char *default_dir = NULL; + char *tmp; ++ const char *cmd_dir = NULL; + grub_size_t dir_size; ++ const char *ext = NULL; + struct find_entry_info info = { + .dev = NULL, + .fs = NULL, +@@ -918,12 +1265,26 @@ blsuki_load_entries (char *path, bool enable_fallback) + struct read_entry_info rei = { + .devid = NULL, + .dirname = NULL, ++ .cmd_type = cmd_type, + }; + + if (path != NULL) + { ++ if (cmd_type == BLSUKI_BLS_CMD) ++ { ++ ext = ".conf"; ++ ext_len = BLS_EXT_LEN; ++ } ++#ifdef GRUB_MACHINE_EFI ++ else if (cmd_type == BLSUKI_UKI_CMD) ++ { ++ ext = ".efi"; ++ ext_len = UKI_EXT_LEN; ++ } ++#endif ++ + len = grub_strlen (path); +- if (len >= BLS_EXT_LEN && grub_strcmp (path + len - BLS_EXT_LEN, ".conf") == 0) ++ if (len >= ext_len && grub_strcmp (path + len - ext_len, ext) == 0) + { + rei.file = grub_file_open (path, GRUB_FILE_TYPE_CONFIG); + if (rei.file == NULL) +@@ -952,19 +1313,26 @@ blsuki_load_entries (char *path, bool enable_fallback) + + if (dir == NULL) + { +- dir_size = sizeof (GRUB_BOOT_DEVICE) + sizeof (GRUB_BLS_CONFIG_PATH) - 2; ++ if (cmd_type == BLSUKI_BLS_CMD) ++ cmd_dir = GRUB_BLS_CONFIG_PATH; ++#ifdef GRUB_MACHINE_EFI ++ else if (cmd_type == BLSUKI_UKI_CMD) ++ cmd_dir = GRUB_UKI_CONFIG_PATH; ++#endif ++ ++ dir_size = sizeof (GRUB_BOOT_DEVICE) + grub_strlen (cmd_dir); + default_dir = grub_malloc (dir_size); + if (default_dir == NULL) + return grub_errno; + + tmp = blsuki_update_boot_device (default_dir); +- tmp = grub_stpcpy (tmp, GRUB_BLS_CONFIG_PATH); ++ tmp = grub_stpcpy (tmp, cmd_dir); + dir = default_dir; + } + +- r = blsuki_set_find_entry_info (&info, dir, devid); ++ r = blsuki_set_find_entry_info (&info, dir, devid, cmd_type); + if (r == GRUB_ERR_NONE) +- r = blsuki_find_entry (&info, enable_fallback); ++ r = blsuki_find_entry (&info, enable_fallback, cmd_type); + + if (info.dev != NULL) + grub_device_close (info.dev); +@@ -1002,11 +1370,11 @@ blsuki_is_default_entry (const char *def_entry, grub_blsuki_entry_t *entry, int + } + + /* +- * This function creates a GRUB boot menu entry for each BLS entry in the +- * entries list. ++ * This function creates a GRUB boot menu entry for each BLS or UKI entry in ++ * the entries list. + */ + static grub_err_t +-blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) ++blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id, enum blsuki_cmd_type cmd_type) + { + const char *def_entry = NULL; + grub_blsuki_entry_t *entry = NULL; +@@ -1025,7 +1393,12 @@ blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) + (show_non_default == true && blsuki_is_default_entry (def_entry, entry, idx) == false) || + (entry_id != NULL && grub_strcmp (entry_id, entry->filename) == 0)) + { +- bls_create_entry (entry); ++ if (cmd_type == BLSUKI_BLS_CMD) ++ bls_create_entry (entry); ++#ifdef GRUB_MACHINE_EFI ++ else if (cmd_type == BLSUKI_UKI_CMD) ++ uki_create_entry (entry); ++#endif + entry->visible = true; + } + +@@ -1036,8 +1409,7 @@ blsuki_create_entries (bool show_default, bool show_non_default, char *entry_id) + } + + static grub_err_t +-grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), +- char **args __attribute__ ((unused))) ++blsuki_cmd (grub_extcmd_context_t ctxt, enum blsuki_cmd_type cmd_type) + { + grub_err_t err; + struct grub_arg_list *state = ctxt->state; +@@ -1074,24 +1446,50 @@ grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), + show_non_default = true; + } + +- err = blsuki_load_entries (path, enable_fallback); ++ err = blsuki_load_entries (path, enable_fallback, cmd_type); + if (err != GRUB_ERR_NONE) + return err; + +- return blsuki_create_entries (show_default, show_non_default, entry_id); ++ return blsuki_create_entries (show_default, show_non_default, entry_id, cmd_type); ++} ++ ++static grub_err_t ++grub_cmd_blscfg (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), ++ char **args __attribute__ ((unused))) ++{ ++ return blsuki_cmd (ctxt, BLSUKI_BLS_CMD); + } + + static grub_extcmd_t bls_cmd; + ++#ifdef GRUB_MACHINE_EFI ++static grub_err_t ++grub_cmd_uki (grub_extcmd_context_t ctxt, int argc __attribute__ ((unused)), ++ char **args __attribute__ ((unused))) ++{ ++ return blsuki_cmd (ctxt, BLSUKI_UKI_CMD); ++} ++ ++static grub_extcmd_t uki_cmd; ++#endif ++ + GRUB_MOD_INIT(blsuki) + { + bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, + N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), + N_("Import Boot Loader Specification snippets."), + bls_opt); ++#ifdef GRUB_MACHINE_EFI ++ uki_cmd = grub_register_extcmd ("uki", grub_cmd_uki, 0, ++ N_("[-p|--path] DIR [-f|--enable-fallback] [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), ++ N_("Import Unified Kernel Images"), uki_opt); ++#endif + } + + GRUB_MOD_FINI(blsuki) + { + grub_unregister_extcmd (bls_cmd); ++#ifdef GRUB_MACHINE_EFI ++ grub_unregister_extcmd (uki_cmd); ++#endif + } +diff --git a/include/grub/menu.h b/include/grub/menu.h +index 43a3c5809b..0e4978dc3b 100644 +--- a/include/grub/menu.h ++++ b/include/grub/menu.h +@@ -39,6 +39,8 @@ struct grub_blsuki_entry + grub_size_t keyvals_size; + int nkeyvals; + char *filename; ++ char *dirname; ++ char *devid; + bool visible; + }; + typedef struct grub_blsuki_entry grub_blsuki_entry_t; diff --git a/0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch b/0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch new file mode 100644 index 00000000..d5932723 --- /dev/null +++ b/0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch @@ -0,0 +1,168 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Fri, 15 Nov 2024 15:34:29 +0800 +Subject: [PATCH] posix_wrap: Tweaks in preparation for libtasn1 + +Cc: Vladimir Serbinenko +Signed-off-by: Daniel Axtens +Signed-off-by: Gary Lin +Reviewed-by: Daniel Kiper +Tested-by: Stefan Berger +--- + grub-core/lib/posix_wrap/c-ctype.h | 114 +++++++++++++++++++++++++++++++++++++ + grub-core/lib/posix_wrap/string.h | 21 +++++++ + 2 files changed, 135 insertions(+) + create mode 100644 grub-core/lib/posix_wrap/c-ctype.h + +diff --git a/grub-core/lib/posix_wrap/c-ctype.h b/grub-core/lib/posix_wrap/c-ctype.h +new file mode 100644 +index 0000000000..5f8fc8ce3f +--- /dev/null ++++ b/grub-core/lib/posix_wrap/c-ctype.h +@@ -0,0 +1,114 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2024 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#ifndef GRUB_POSIX_C_CTYPE_H ++#define GRUB_POSIX_C_CTYPE_H 1 ++ ++#include ++ ++static inline bool ++c_isspace (int c) ++{ ++ return !!grub_isspace (c); ++} ++ ++static inline bool ++c_isdigit (int c) ++{ ++ return !!grub_isdigit (c); ++} ++ ++static inline bool ++c_islower (int c) ++{ ++ return !!grub_islower (c); ++} ++ ++static inline bool ++c_isascii (int c) ++{ ++ return !(c & ~0x7f); ++} ++ ++static inline bool ++c_isupper (int c) ++{ ++ return !!grub_isupper (c); ++} ++ ++static inline bool ++c_isxdigit (int c) ++{ ++ return !!grub_isxdigit (c); ++} ++ ++static inline bool ++c_isprint (int c) ++{ ++ return !!grub_isprint (c); ++} ++ ++static inline bool ++c_iscntrl (int c) ++{ ++ return !grub_isprint (c); ++} ++ ++static inline bool ++c_isgraph (int c) ++{ ++ return grub_isprint (c) && !grub_isspace (c); ++} ++ ++static inline bool ++c_isalnum (int c) ++{ ++ return grub_isalpha (c) || grub_isdigit (c); ++} ++ ++static inline bool ++c_ispunct (int c) ++{ ++ return grub_isprint (c) && !grub_isspace (c) && !c_isalnum (c); ++} ++ ++static inline bool ++c_isalpha (int c) ++{ ++ return !!grub_isalpha (c); ++} ++ ++static inline bool ++c_isblank (int c) ++{ ++ return c == ' ' || c == '\t'; ++} ++ ++static inline int ++c_tolower (int c) ++{ ++ return grub_tolower (c); ++} ++ ++static inline int ++c_toupper (int c) ++{ ++ return grub_toupper (c); ++} ++ ++#endif +diff --git a/grub-core/lib/posix_wrap/string.h b/grub-core/lib/posix_wrap/string.h +index 1adb450b5a..d3e400d500 100644 +--- a/grub-core/lib/posix_wrap/string.h ++++ b/grub-core/lib/posix_wrap/string.h +@@ -84,6 +84,27 @@ memchr (const void *s, int c, grub_size_t n) + return grub_memchr (s, c, n); + } + ++static inline char * ++strncat (char *dest, const char *src, grub_size_t n) ++{ ++ const char *end; ++ char *str = dest; ++ grub_size_t src_len; ++ ++ dest += grub_strlen (dest); ++ ++ end = grub_memchr (src, '\0', n); ++ if (end != NULL) ++ src_len = (grub_size_t) (end - src); ++ else ++ src_len = n; ++ ++ dest[src_len] = '\0'; ++ grub_memcpy (dest, src, src_len); ++ ++ return str; ++} ++ + #define memcmp grub_memcmp + #define memcpy grub_memcpy + #define memmove grub_memmove diff --git a/grub.macros b/grub.macros index dfc9707d..f6455473 100644 --- a/grub.macros +++ b/grub.macros @@ -518,7 +518,7 @@ install -m 644 %{1}.conf ${RPM_BUILD_ROOT}/etc/dnf/protected.d/ \ rm -f %{1}.conf \ %{nil} -%global grub_modules " all_video boot blscfg btrfs \\\ +%global grub_modules " all_video boot blscfg btrfs blsuki \\\ cat configfile cryptodisk \\\ echo ext2 f2fs fat font \\\ gcry_rijndael gcry_rsa gcry_serpent \\\ diff --git a/grub.patches b/grub.patches index 66e0b693..330fb13a 100644 --- a/grub.patches +++ b/grub.patches @@ -379,4 +379,11 @@ Patch0379: 0379-loader-efi-chainloader-Fix-double-free.patch Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch -Patch0383: 0383-Include-function-name-on-debug-print-function.patch \ No newline at end of file +Patch0383: 0383-Include-function-name-on-debug-print-function.patch +Patch0384: 0001-kern-misc-Implement-grub_strtok.patch +Patch0385: 0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch +Patch0386: 0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch +Patch0387: 0004-blsuki-Check-for-mounted-boot-in-emu.patch +Patch0388: 0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch +Patch0389: 0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch + diff --git a/grub2.spec b/grub2.spec index 4563828d..c63f940a 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 44%{?dist} +Release: 45%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,9 @@ fi %endif %changelog +* Wed Oct 15 2025 Leo Sandoval - 2.12-45 +- Include upstream blsuki related patches + * Mon Sep 15 2025 Leo Sandoval - 2.12-44 - Include function name on debug print function From f4663b0ddc6e7b05b81bff630061838b77e725bc Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 27 Oct 2025 11:37:40 -0600 Subject: [PATCH 40/45] Fix blsuki patch enumeration Signed-off-by: Leo Sandoval --- ...tch => 0384-kern-misc-Implement-grub_strtok.patch | 0 ...d-blscfg-command-to-parse-Boot-Loader-Speci.patch | 0 ....c-Change-offset-type-for-grub_util_write_i.patch | 0 ...> 0387-blsuki-Check-for-mounted-boot-in-emu.patch | 0 ...d-uki-command-to-load-Unified-Kernel-Image-.patch | 0 ...six_wrap-Tweaks-in-preparation-for-libtasn1.patch | 0 grub.patches | 12 ++++++------ 7 files changed, 6 insertions(+), 6 deletions(-) rename 0001-kern-misc-Implement-grub_strtok.patch => 0384-kern-misc-Implement-grub_strtok.patch (100%) rename 0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch => 0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch (100%) rename 0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch => 0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch (100%) rename 0004-blsuki-Check-for-mounted-boot-in-emu.patch => 0387-blsuki-Check-for-mounted-boot-in-emu.patch (100%) rename 0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch => 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch (100%) rename 0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch => 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch (100%) diff --git a/0001-kern-misc-Implement-grub_strtok.patch b/0384-kern-misc-Implement-grub_strtok.patch similarity index 100% rename from 0001-kern-misc-Implement-grub_strtok.patch rename to 0384-kern-misc-Implement-grub_strtok.patch diff --git a/0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch b/0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch similarity index 100% rename from 0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch rename to 0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch diff --git a/0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch b/0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch similarity index 100% rename from 0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch rename to 0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch diff --git a/0004-blsuki-Check-for-mounted-boot-in-emu.patch b/0387-blsuki-Check-for-mounted-boot-in-emu.patch similarity index 100% rename from 0004-blsuki-Check-for-mounted-boot-in-emu.patch rename to 0387-blsuki-Check-for-mounted-boot-in-emu.patch diff --git a/0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch b/0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch similarity index 100% rename from 0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch rename to 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch diff --git a/0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch b/0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch similarity index 100% rename from 0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch rename to 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch diff --git a/grub.patches b/grub.patches index 330fb13a..98c50a8b 100644 --- a/grub.patches +++ b/grub.patches @@ -380,10 +380,10 @@ Patch0380: 0380-loader-efi-chainloader-Fix-null-pointer-dereference.patch Patch0381: 0381-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch Patch0382: 0382-Set-correctly-the-memory-attributes-for-the-kernel-P.patch Patch0383: 0383-Include-function-name-on-debug-print-function.patch -Patch0384: 0001-kern-misc-Implement-grub_strtok.patch -Patch0385: 0002-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch -Patch0386: 0003-util-misc.c-Change-offset-type-for-grub_util_write_i.patch -Patch0387: 0004-blsuki-Check-for-mounted-boot-in-emu.patch -Patch0388: 0005-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch -Patch0389: 0006-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch +Patch0384: 0384-kern-misc-Implement-grub_strtok.patch +Patch0385: 0385-blsuki-Add-blscfg-command-to-parse-Boot-Loader-Speci.patch +Patch0386: 0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch +Patch0387: 0387-blsuki-Check-for-mounted-boot-in-emu.patch +Patch0388: 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch +Patch0389: 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch From 6467d85178d4ce4522a126aee3ba0e8ea27adf4c Mon Sep 17 00:00:00 2001 From: Tom spot Callaway Date: Tue, 4 Nov 2025 16:20:54 -0500 Subject: [PATCH 41/45] rebuild for new fuse3 --- grub2.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/grub2.spec b/grub2.spec index c63f940a..0730550e 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 45%{?dist} +Release: 46%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,9 @@ fi %endif %changelog +* Tue Nov 4 2025 Tom Callaway - 2.12-46 +- rebuild for new fuse3 + * Wed Oct 15 2025 Leo Sandoval - 2.12-45 - Include upstream blsuki related patches From a4ec822e7e93aa93bbcfda5719036b7467f3e2a6 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Thu, 13 Nov 2025 12:06:23 -0600 Subject: [PATCH 42/45] blsuki: do not register blscfg command Otherwise the blsuki.c blscfg cmd version replaces the one defined on blscfg.c and the latter is the version we want to use. Signed-off-by: Leo Sandoval --- ...lsuki-do-not-register-blscfg-command.patch | 43 +++++++++++++++++++ grub.patches | 2 +- grub2.spec | 5 ++- 3 files changed, 48 insertions(+), 2 deletions(-) create mode 100644 0390-blsuki-do-not-register-blscfg-command.patch diff --git a/0390-blsuki-do-not-register-blscfg-command.patch b/0390-blsuki-do-not-register-blscfg-command.patch new file mode 100644 index 00000000..3fd4fa59 --- /dev/null +++ b/0390-blsuki-do-not-register-blscfg-command.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Thu, 13 Nov 2025 11:57:52 -0600 +Subject: [PATCH] blsuki: do not register blscfg command + +The blscfg command is already defined on commands/blscfg.c so do not +register it on blsuki.c. Also, the 'uki' command is only intended for +EFI system so remove the other platforms from the module. + +Signed-off-by: Leo Sandoval +--- + grub-core/Makefile.core.def | 2 -- + grub-core/commands/blsuki.c | 4 ---- + 2 files changed, 6 deletions(-) + +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 885dd436de..a545ee430b 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -893,8 +893,6 @@ module = { + common = lib/gnulib/filevercmp.c; + enable = powerpc_ieee1275; + enable = efi; +- enable = i386_pc; +- enable = emu; + cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; + cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; + }; +diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c +index cb00f936a7..bcd0114d85 100644 +--- a/grub-core/commands/blsuki.c ++++ b/grub-core/commands/blsuki.c +@@ -1475,10 +1475,6 @@ static grub_extcmd_t uki_cmd; + + GRUB_MOD_INIT(blsuki) + { +- bls_cmd = grub_register_extcmd ("blscfg", grub_cmd_blscfg, 0, +- N_("[-p|--path] [-f|--enable-fallback] DIR [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), +- N_("Import Boot Loader Specification snippets."), +- bls_opt); + #ifdef GRUB_MACHINE_EFI + uki_cmd = grub_register_extcmd ("uki", grub_cmd_uki, 0, + N_("[-p|--path] DIR [-f|--enable-fallback] [-d|--show-default] [-n|--show-non-default] [-e|--entry] FILE"), diff --git a/grub.patches b/grub.patches index 98c50a8b..af74d2e3 100644 --- a/grub.patches +++ b/grub.patches @@ -386,4 +386,4 @@ Patch0386: 0386-util-misc.c-Change-offset-type-for-grub_util_write_i.patch Patch0387: 0387-blsuki-Check-for-mounted-boot-in-emu.patch Patch0388: 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch Patch0389: 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch - +Patch0390: 0390-blsuki-do-not-register-blscfg-command.patch diff --git a/grub2.spec b/grub2.spec index 0730550e..bde96ec1 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 46%{?dist} +Release: 47%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,9 @@ fi %endif %changelog +* Thu Nov 13 2025 Leo Sandoval - 2.12-47 +- blsuki: do not register blscfg command + * Tue Nov 4 2025 Tom Callaway - 2.12-46 - rebuild for new fuse3 From 70c5e629500a7364b805759ab649547f627e4ba8 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 27 Oct 2025 11:55:32 -0600 Subject: [PATCH 43/45] Add support for external environment block on Btrfs Signed-off-by: Leo Sandoval Tested-by: Neal Gompa --- 0391-misc-add-z-length-modifier-support.patch | 81 +++++++ 0392-tests-add-z-modifier-printf-tests.patch | 43 ++++ ...ub-editenv-add-fs_envblk-open-helper.patch | 219 ++++++++++++++++++ ...b-editenv-add-fs_envblk-write-helper.patch | 91 ++++++++ ...v-wire-set_variables-to-optional-fs_.patch | 118 ++++++++++ ...v-wire-unset_variables-to-optional-f.patch | 56 +++++ ...v-wire-list_variables-to-optional-fs.patch | 45 ++++ ...v-add-probe-call-for-external-envblk.patch | 176 ++++++++++++++ ...onment-block-to-reserved-header-area.patch | 93 ++++++++ ...e-grub.cfg-to-use-env_block-when-pre.patch | 82 +++++++ ...date-doc-link-for-bootloader-support.patch | 29 +++ ...Btrfs-env-block-and-special-env-vars.patch | 93 ++++++++ ...ile-read_hook-in-grub_fs_blocklist_r.patch | 73 ++++++ ...eader.in-Prefer-dev-instead-of-root-.patch | 44 ++++ ...he-external-environment-block-for-au.patch | 89 +++++++ ...e-automatic-hidden-menu-and-boot-cou.patch | 36 +++ grub.patches | 16 ++ grub2.spec | 5 +- 18 files changed, 1388 insertions(+), 1 deletion(-) create mode 100644 0391-misc-add-z-length-modifier-support.patch create mode 100644 0392-tests-add-z-modifier-printf-tests.patch create mode 100644 0393-util-grub-editenv-add-fs_envblk-open-helper.patch create mode 100644 0394-util-grub-editenv-add-fs_envblk-write-helper.patch create mode 100644 0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch create mode 100644 0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch create mode 100644 0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch create mode 100644 0398-util-grub-editenv-add-probe-call-for-external-envblk.patch create mode 100644 0399-btrfs-add-environment-block-to-reserved-header-area.patch create mode 100644 0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch create mode 100644 0401-btrfs-update-doc-link-for-bootloader-support.patch create mode 100644 0402-docs-add-Btrfs-env-block-and-special-env-vars.patch create mode 100644 0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch create mode 100644 0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch create mode 100644 0405-grub.d-Support-the-external-environment-block-for-au.patch create mode 100644 0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch diff --git a/0391-misc-add-z-length-modifier-support.patch b/0391-misc-add-z-length-modifier-support.patch new file mode 100644 index 00000000..2fdcd77c --- /dev/null +++ b/0391-misc-add-z-length-modifier-support.patch @@ -0,0 +1,81 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:32 +0800 +Subject: [PATCH] misc: add z length modifier support + +Add support for the 'z' length modifier in the printf code. This allows +printing of size_t and ssize_t values using %zu, %zd and related +formats. The parser maps 'z' to the correct integer width based on +sizeof (size_t). + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Daniel Kiper +--- + grub-core/kern/misc.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index c1c77c300c..2568a5489b 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -30,6 +30,7 @@ + #if DEBUG_WITH_TIMESTAMPS + #include + #endif ++#include + + union printf_arg + { +@@ -883,6 +884,9 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + COMPILE_TIME_ASSERT (sizeof (long) <= sizeof (long long)); + COMPILE_TIME_ASSERT (sizeof (long long) == sizeof (void *) + || sizeof (int) == sizeof (void *)); ++ COMPILE_TIME_ASSERT (sizeof (size_t) == sizeof (unsigned) ++ || sizeof (size_t) == sizeof (unsigned long) ++ || sizeof (size_t) == sizeof (unsigned long long)); + + fmt = fmt0; + while ((c = *fmt++) != 0) +@@ -917,11 +921,17 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + fmt++; + + c = *fmt++; ++ if (c == 'z') ++ { ++ c = *fmt++; ++ goto do_count; ++ } + if (c == 'l') + c = *fmt++; + if (c == 'l') + c = *fmt++; + ++ do_count: + switch (c) + { + case 'p': +@@ -1018,6 +1028,14 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + continue; + } + ++ if (c == 'z') ++ { ++ c = *fmt++; ++ if (sizeof (size_t) == sizeof (unsigned long)) ++ longfmt = 1; ++ else if (sizeof (size_t) == sizeof (unsigned long long)) ++ longfmt = 2; ++ } + if (c == 'l') + { + c = *fmt++; +@@ -1194,6 +1212,8 @@ grub_vsnprintf_real (char *str, grub_size_t max_len, const char *fmt0, + } + + c = *fmt++; ++ if (c == 'z') ++ c = *fmt++; + if (c == 'l') + c = *fmt++; + if (c == 'l') diff --git a/0392-tests-add-z-modifier-printf-tests.patch b/0392-tests-add-z-modifier-printf-tests.patch new file mode 100644 index 00000000..ce86dc4a --- /dev/null +++ b/0392-tests-add-z-modifier-printf-tests.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:33 +0800 +Subject: [PATCH] tests: add z modifier printf tests + +Add unit tests for %zd, %zu and %zx to verify size_t and ssize_t +formatting matches system snprintf. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Daniel Kiper +--- + tests/printf_unit_test.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tests/printf_unit_test.c b/tests/printf_unit_test.c +index 098c29fd9c..f2de187b03 100644 +--- a/tests/printf_unit_test.c ++++ b/tests/printf_unit_test.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #define MSG "printf test failed: %s, %s", real, expected + +@@ -73,6 +74,15 @@ printf_test (void) + grub_snprintf (real, sizeof (real), "%%0%dd ", 1); + snprintf (expected, sizeof (expected), "%%0%dd ", 1); + grub_test_assert (strcmp (real, expected) == 0, MSG); ++ grub_snprintf (real, sizeof (real), "%zd %zd %zd", (ssize_t) -1, (ssize_t) (SIZE_MAX >> 1), (ssize_t) 42); ++ snprintf (expected, sizeof (expected), "%zd %zd %zd", (ssize_t) -1, (ssize_t) (SIZE_MAX >> 1), (ssize_t) 42); ++ grub_test_assert (strcmp (real, expected) == 0, MSG); ++ grub_snprintf (real, sizeof (real), "%zu %zu %zu", (size_t) 0, (size_t) SIZE_MAX, (size_t) 42); ++ snprintf (expected, sizeof (expected), "%zu %zu %zu", (size_t) 0, (size_t) SIZE_MAX, (size_t) 42); ++ grub_test_assert (strcmp (real, expected) == 0, MSG); ++ grub_snprintf (real, sizeof (real), "%zx %zx %zx", (ssize_t) (SIZE_MAX >> 1), (size_t) SIZE_MAX, (size_t) 0xdeadbeefU); ++ snprintf (expected, sizeof (expected), "%zx %zx %zx", (ssize_t) (SIZE_MAX >> 1), (size_t) SIZE_MAX, (size_t) 0xdeadbeefU); ++ grub_test_assert (strcmp (real, expected) == 0, MSG); + } + + GRUB_UNIT_TEST ("printf_unit_test", printf_test); diff --git a/0393-util-grub-editenv-add-fs_envblk-open-helper.patch b/0393-util-grub-editenv-add-fs_envblk-open-helper.patch new file mode 100644 index 00000000..893c4c71 --- /dev/null +++ b/0393-util-grub-editenv-add-fs_envblk-open-helper.patch @@ -0,0 +1,219 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:34 +0800 +Subject: [PATCH] util/grub-editenv: add fs_envblk open helper + +This patch adds the logic to locate and open an environment block that +is stored in a reserved area on the device. It introduces the function +fs_envblk_open() together with helper routines to read the block pointed +to by the env_block variable, and to create the block on disk when it +does not exist yet. When a block is created, the code records its +location inside the file based envblk by setting env_block in block list +syntax of offset plus size in sectors. + +The env_block variable acts as a link from the file envblk to the raw +disk region so that later runs of grub-editenv can follow it and access +the external block. The helper is exposed through a small ops table +attached to fs_envblk so that later patches can call +fs_envblk->ops->open() without touching core code again. At this stage +variables are still stored in the file envblk and no redirection has +been applied. + +In relation to this, the fs_envblk_spec table defines the file-system +specific layout of the reserved raw blocks used for environment storage. +It is prepared to facilitate integration in grub-editenv, with Btrfs to +be added in the future once its reserved area is defined. + +An fs_envblk_init() helper is added to prepare it for using the ops with +its associated data context if the feature is available. It is not used +yet, but will be used later when a filesystem and its device are probed +to initialize the fs_envblk handle and enable access to the feature. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +--- + util/grub-editenv.c | 170 ++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 170 insertions(+) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index 948eec8a11..a544452e78 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -123,6 +123,176 @@ block, use `rm %s'."), + NULL, help_filter, NULL + }; + ++struct fs_envblk_spec { ++ const char *fs_name; ++ off_t offset; ++ size_t size; ++}; ++typedef struct fs_envblk_spec fs_envblk_spec_t; ++ ++static grub_envblk_t fs_envblk_open (grub_envblk_t envblk); ++ ++struct fs_envblk_ops { ++ grub_envblk_t (*open) (grub_envblk_t); ++}; ++typedef struct fs_envblk_ops fs_envblk_ops_t; ++ ++struct fs_envblk { ++ fs_envblk_spec_t *spec; ++ fs_envblk_ops_t *ops; ++ const char *dev; ++}; ++typedef struct fs_envblk *fs_envblk_t; ++ ++static fs_envblk_ops_t fs_envblk_ops = { ++ .open = fs_envblk_open ++}; ++ ++/* ++ * fs_envblk_spec describes the file-system specific layout of reserved raw ++ * blocks used as environment blocks. ++ */ ++static fs_envblk_spec_t fs_envblk_spec[] = { ++ { NULL, 0, 0 } ++}; ++ ++static fs_envblk_t fs_envblk = NULL; ++ ++static void __attribute__ ((unused)) ++fs_envblk_init (const char *fs_name, const char *dev) ++{ ++ fs_envblk_spec_t *p; ++ ++ if (fs_name == NULL || dev == NULL) ++ return; ++ ++ for (p = fs_envblk_spec; p->fs_name != NULL; p++) ++ { ++ if (strcmp (fs_name, p->fs_name) == 0) ++ { ++ if (fs_envblk == NULL) ++ fs_envblk = xmalloc (sizeof (*fs_envblk)); ++ fs_envblk->spec = p; ++ fs_envblk->dev = xstrdup (dev); ++ fs_envblk->ops = &fs_envblk_ops; ++ break; ++ } ++ } ++} ++ ++static int ++read_env_block_var (const char *varname, const char *value, void *hook_data) ++{ ++ grub_envblk_t *p_envblk = (grub_envblk_t *) hook_data; ++ off_t off; ++ size_t sz; ++ char *p, *buf; ++ FILE *fp; ++ ++ if (p_envblk == NULL || fs_envblk == NULL) ++ return 1; ++ ++ if (strcmp (varname, "env_block") != 0) ++ return 0; ++ ++ off = strtol (value, &p, 10); ++ if (*p == '+') ++ sz = strtol (p + 1, &p, 10); ++ else ++ return 0; ++ ++ if (*p != '\0' || sz == 0) ++ return 0; ++ ++ off <<= GRUB_DISK_SECTOR_BITS; ++ sz <<= GRUB_DISK_SECTOR_BITS; ++ ++ fp = grub_util_fopen (fs_envblk->dev, "rb"); ++ if (fp == NULL) ++ grub_util_error (_("cannot open `%s': %s"), fs_envblk->dev, strerror (errno)); ++ ++ if (fseek (fp, off, SEEK_SET) < 0) ++ grub_util_error (_("cannot seek `%s': %s"), fs_envblk->dev, strerror (errno)); ++ ++ buf = xmalloc (sz); ++ if ((fread (buf, 1, sz, fp)) != sz) ++ grub_util_error (_("cannot read `%s': %s"), fs_envblk->dev, strerror (errno)); ++ ++ fclose (fp); ++ ++ *p_envblk = grub_envblk_open (buf, sz); ++ ++ return 1; ++} ++ ++static void ++create_env_on_block (void) ++{ ++ FILE *fp; ++ char *buf; ++ const char *device; ++ off_t offset; ++ size_t size; ++ ++ if (fs_envblk == NULL) ++ return; ++ ++ device = fs_envblk->dev; ++ offset = fs_envblk->spec->offset; ++ size = fs_envblk->spec->size; ++ ++ fp = grub_util_fopen (device, "r+b"); ++ if (fp == NULL) ++ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); ++ ++ buf = xmalloc (size); ++ memcpy (buf, GRUB_ENVBLK_SIGNATURE, sizeof (GRUB_ENVBLK_SIGNATURE) - 1); ++ memset (buf + sizeof (GRUB_ENVBLK_SIGNATURE) - 1, '#', size - sizeof (GRUB_ENVBLK_SIGNATURE) + 1); ++ ++ if (fseek (fp, offset, SEEK_SET) < 0) ++ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); ++ ++ if (fwrite (buf, 1, size, fp) != size) ++ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); ++ ++ grub_util_file_sync (fp); ++ free (buf); ++ fclose (fp); ++} ++ ++static grub_envblk_t ++fs_envblk_open (grub_envblk_t envblk) ++{ ++ grub_envblk_t envblk_on_block = NULL; ++ char *val; ++ off_t offset; ++ size_t size; ++ ++ if (envblk == NULL) ++ return NULL; ++ ++ offset = fs_envblk->spec->offset; ++ size = fs_envblk->spec->size; ++ ++ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); ++ ++ if (envblk_on_block != NULL && grub_envblk_size (envblk_on_block) == size) ++ return envblk_on_block; ++ ++ create_env_on_block (); ++ ++ offset = offset >> GRUB_DISK_SECTOR_BITS; ++ size = (size + GRUB_DISK_SECTOR_SIZE - 1) >> GRUB_DISK_SECTOR_BITS; ++ ++ val = xasprintf ("%lld+%zu", (long long) offset, size); ++ if (grub_envblk_set (envblk, "env_block", val) == 0) ++ grub_util_error ("%s", _("environment block too small")); ++ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); ++ free (val); ++ ++ return envblk_on_block; ++} ++ + static grub_envblk_t + open_envblk_file (const char *name) + { diff --git a/0394-util-grub-editenv-add-fs_envblk-write-helper.patch b/0394-util-grub-editenv-add-fs_envblk-write-helper.patch new file mode 100644 index 00000000..f94f747e --- /dev/null +++ b/0394-util-grub-editenv-add-fs_envblk-write-helper.patch @@ -0,0 +1,91 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:35 +0800 +Subject: [PATCH] util/grub-editenv: add fs_envblk write helper + +This patch adds the function fs_envblk_write to update the reserved +environment block on disk. The helper takes an in memory envblk buffer +and writes it back to the device at the location defined by the +fs_envblk specification. It performs size checks and uses file sync to +ensure that the updated data is flushed. + +The helper is also added into the fs_envblk ops table, together with the +open helper from the previous patch. With this change the basic input +and output path for an external environment block is complete. The +choice of which variables should be written externally will be handled +by later patches. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +Reviewed-by: Daniel Kiper +--- + util/grub-editenv.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index a544452e78..f4b69bb19f 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -131,9 +131,11 @@ struct fs_envblk_spec { + typedef struct fs_envblk_spec fs_envblk_spec_t; + + static grub_envblk_t fs_envblk_open (grub_envblk_t envblk); ++static void fs_envblk_write (grub_envblk_t envblk); + + struct fs_envblk_ops { + grub_envblk_t (*open) (grub_envblk_t); ++ void (*write) (grub_envblk_t); + }; + typedef struct fs_envblk_ops fs_envblk_ops_t; + +@@ -145,7 +147,8 @@ struct fs_envblk { + typedef struct fs_envblk *fs_envblk_t; + + static fs_envblk_ops_t fs_envblk_ops = { +- .open = fs_envblk_open ++ .open = fs_envblk_open, ++ .write = fs_envblk_write + }; + + /* +@@ -381,6 +384,39 @@ write_envblk (const char *name, grub_envblk_t envblk) + fclose (fp); + } + ++static void ++fs_envblk_write (grub_envblk_t envblk) ++{ ++ FILE *fp; ++ const char *device; ++ off_t offset; ++ size_t size; ++ ++ if (envblk == NULL) ++ return; ++ ++ device = fs_envblk->dev; ++ offset = fs_envblk->spec->offset; ++ size = fs_envblk->spec->size; ++ ++ if (grub_envblk_size (envblk) > size) ++ grub_util_error ("%s", _("environment block too small")); ++ ++ fp = grub_util_fopen (device, "r+b"); ++ ++ if (fp == NULL) ++ grub_util_error (_("cannot open `%s': %s"), device, strerror (errno)); ++ ++ if (fseek (fp, offset, SEEK_SET) < 0) ++ grub_util_error (_("cannot seek `%s': %s"), device, strerror (errno)); ++ ++ if (fwrite (grub_envblk_buffer (envblk), 1, grub_envblk_size (envblk), fp) != grub_envblk_size (envblk)) ++ grub_util_error (_("cannot write to `%s': %s"), device, strerror (errno)); ++ ++ grub_util_file_sync (fp); ++ fclose (fp); ++} ++ + static void + set_variables (const char *name, int argc, char *argv[]) + { diff --git a/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch b/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch new file mode 100644 index 00000000..bf9820a3 --- /dev/null +++ b/0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch @@ -0,0 +1,118 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:36 +0800 +Subject: [PATCH] util/grub-editenv: wire set_variables to optional fs_envblk + +This patch changes set_variables() so that it can use an external +environment block when one is present. The variable next_entry is +written into the external block, env_block is treated as read only, and +all other variables are written into the normal file based envblk. + +A cleanup step is added to handle cases where GRUB at runtime writes +variables into the external block because file based updates are not +safe on a copy on write filesystem such as Btrfs. For example, the +savedefault command can update saved_entry, and on Btrfs GRUB will place +that update in the external block instead of the file envblk. If an +older copy remains in the external block, it would override the newer +value from the file envblk when GRUB first loads the file and then +applies the external block on top of it. To avoid this, whenever a +variable is updated in the file envblk, any same named key in the +external block is deleted. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +Reviewed-by: Daniel Kiper +--- + util/grub-editenv.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 56 insertions(+), 2 deletions(-) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index f4b69bb19f..be844bf902 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -417,12 +417,35 @@ fs_envblk_write (grub_envblk_t envblk) + fclose (fp); + } + ++struct var_lookup_ctx { ++ const char *varname; ++ bool found; ++}; ++typedef struct var_lookup_ctx var_lookup_ctx_t; ++ ++static int ++var_lookup_iter (const char *varname, const char *value __attribute__ ((unused)), void *hook_data) ++{ ++ var_lookup_ctx_t *ctx = (var_lookup_ctx_t *) hook_data; ++ ++ if (grub_strcmp (ctx->varname, varname) == 0) ++ { ++ ctx->found = true; ++ return 1; ++ } ++ return 0; ++} ++ + static void + set_variables (const char *name, int argc, char *argv[]) + { + grub_envblk_t envblk; ++ grub_envblk_t envblk_on_block = NULL; + + envblk = open_envblk_file (name); ++ if (fs_envblk != NULL) ++ envblk_on_block = fs_envblk->ops->open (envblk); ++ + while (argc) + { + char *p; +@@ -433,15 +456,46 @@ set_variables (const char *name, int argc, char *argv[]) + + *(p++) = 0; + +- if (! grub_envblk_set (envblk, argv[0], p)) +- grub_util_error ("%s", _("environment block too small")); ++ if ((strcmp (argv[0], "next_entry") == 0) && envblk_on_block != NULL) ++ { ++ if (grub_envblk_set (envblk_on_block, argv[0], p) == 0) ++ grub_util_error ("%s", _("environment block too small")); ++ goto next; ++ } + ++ if (strcmp (argv[0], "env_block") == 0) ++ { ++ grub_util_warn (_("can't set env_block as it's read-only")); ++ goto next; ++ } ++ ++ if (grub_envblk_set (envblk, argv[0], p) == 0) ++ grub_util_error ("%s", _("environment block too small")); ++ ++ if (envblk_on_block != NULL) ++ { ++ var_lookup_ctx_t ctx = { ++ .varname = argv[0], ++ .found = false ++ }; ++ ++ grub_envblk_iterate (envblk_on_block, &ctx, var_lookup_iter); ++ if (ctx.found == true) ++ grub_envblk_delete (envblk_on_block, argv[0]); ++ } ++ next: + argc--; + argv++; + } + + write_envblk (name, envblk); + grub_envblk_close (envblk); ++ ++ if (envblk_on_block != NULL) ++ { ++ fs_envblk->ops->write (envblk_on_block); ++ grub_envblk_close (envblk_on_block); ++ } + } + + static void diff --git a/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch b/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch new file mode 100644 index 00000000..4b517b39 --- /dev/null +++ b/0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:37 +0800 +Subject: [PATCH] util/grub-editenv: wire unset_variables to optional fs_envblk + +This patch updates unset_variables() so that removals are also applied +to the external environment block when it is present. The code opens the +external block, deletes the same named keys there, and then writes the +external block back using fs_envblk_write(). The file based envblk is +still updated and written as before. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +Reviewed-by: Daniel Kiper +--- + util/grub-editenv.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index be844bf902..7ff1da9b40 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -502,18 +502,32 @@ static void + unset_variables (const char *name, int argc, char *argv[]) + { + grub_envblk_t envblk; ++ grub_envblk_t envblk_on_block = NULL; + + envblk = open_envblk_file (name); ++ ++ if (fs_envblk != NULL) ++ envblk_on_block = fs_envblk->ops->open (envblk); ++ + while (argc) + { + grub_envblk_delete (envblk, argv[0]); + ++ if (envblk_on_block != NULL) ++ grub_envblk_delete (envblk_on_block, argv[0]); ++ + argc--; + argv++; + } + + write_envblk (name, envblk); + grub_envblk_close (envblk); ++ ++ if (envblk_on_block != NULL) ++ { ++ fs_envblk->ops->write (envblk_on_block); ++ grub_envblk_close (envblk_on_block); ++ } + } + + struct get_int_value_params { diff --git a/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch b/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch new file mode 100644 index 00000000..5687886d --- /dev/null +++ b/0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:38 +0800 +Subject: [PATCH] util/grub-editenv: wire list_variables to optional fs_envblk + +This patch updates list_variables() so that it also prints entries from +the external environment block when one is present. The function first +lists all variables from the file based envblk, then iterates over the +external envblk and prints those as well. + +The output format remains the same as before. The change makes it +possible to inspect variables regardless of whether they are stored in +the file envblk or in the reserved block. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +Reviewed-by: Sudhakar Kuppusamy +Reviewed-by: Daniel Kiper +--- + util/grub-editenv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index 7ff1da9b40..170d8f139a 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -358,10 +358,17 @@ static void + list_variables (const char *name) + { + grub_envblk_t envblk; ++ grub_envblk_t envblk_on_block = NULL; + + envblk = open_envblk_file (name); ++ grub_envblk_iterate (envblk, &envblk_on_block, read_env_block_var); + grub_envblk_iterate (envblk, NULL, print_var); + grub_envblk_close (envblk); ++ if (envblk_on_block != NULL) ++ { ++ grub_envblk_iterate (envblk_on_block, NULL, print_var); ++ grub_envblk_close (envblk_on_block); ++ } + } + + static void diff --git a/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch b/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch new file mode 100644 index 00000000..9d583168 --- /dev/null +++ b/0398-util-grub-editenv-add-probe-call-for-external-envblk.patch @@ -0,0 +1,176 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:39 +0800 +Subject: [PATCH] util/grub-editenv: add probe call for external envblk + +This patch adds the probe_fs_envblk() function to identify the root +filesystem and invoke fs_envblk_init() with the probed filesystem type +and device. This checks if the feature is available and initializes the +handle, fs_envblk, to access the external environment block. It avoids +configurations with diskfilter or cryptodisk where filesystem blocks may +be remapped or encrypted. + +The probe is only invoked when grub-editenv is working on the default +environment file path. This restriction ensures that probing and +possible raw device access are not triggered for arbitrary user supplied +paths, but only for the standard grubenv file. In that case the code +checks if the filename equals DEFAULT_ENVBLK_PATH and then calls +probe_fs_envblk with fs_envblk_spec. The result is stored in the global +fs_envblk handle. At this stage the external environment block is only +detected and recorded, and the behavior of grub-editenv is unchanged. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Avnish Chouhan +--- + util/grub-editenv.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 113 insertions(+), 2 deletions(-) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index 170d8f139a..201dc7ccd4 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -23,8 +23,11 @@ + #include + #include + #include +-#include ++#include + #include ++#include ++#include ++#include + + #include + #include +@@ -161,7 +164,7 @@ static fs_envblk_spec_t fs_envblk_spec[] = { + + static fs_envblk_t fs_envblk = NULL; + +-static void __attribute__ ((unused)) ++static void + fs_envblk_init (const char *fs_name, const char *dev) + { + fs_envblk_spec_t *p; +@@ -582,6 +585,111 @@ incr_variables (const char *name, int argc, char *argv[]) + grub_envblk_close (envblk); + } + ++static bool ++is_abstraction (grub_device_t dev) ++{ ++ if (dev == NULL || dev->disk == NULL) ++ return false; ++ ++ if (dev->disk->dev->id == GRUB_DISK_DEVICE_DISKFILTER_ID || ++ dev->disk->dev->id == GRUB_DISK_DEVICE_CRYPTODISK_ID) ++ return true; ++ ++ return false; ++} ++ ++static void ++probe_fs_envblk (fs_envblk_spec_t *spec) ++{ ++ char **grub_devices = NULL; ++ char **curdev, **curdrive; ++ size_t ndev = 0; ++ char **grub_drives = NULL; ++ grub_device_t grub_dev = NULL; ++ grub_fs_t grub_fs = NULL; ++ bool have_abstraction = false; ++ ++ grub_util_biosdisk_init (DEFAULT_DEVICE_MAP); ++ grub_init_all (); ++ grub_gcry_init_all (); ++ ++ grub_lvm_fini (); ++ grub_mdraid09_fini (); ++ grub_mdraid1x_fini (); ++ grub_diskfilter_fini (); ++ grub_diskfilter_init (); ++ grub_mdraid09_init (); ++ grub_mdraid1x_init (); ++ grub_lvm_init (); ++ ++ grub_devices = grub_guess_root_devices (DEFAULT_DIRECTORY); ++ ++ if (grub_devices == NULL || grub_devices[0] == NULL) ++ { ++ grub_util_warn (_("cannot find a device for %s (is /dev mounted?)"), DEFAULT_DIRECTORY); ++ goto cleanup; ++ } ++ ++ for (curdev = grub_devices; *curdev != NULL; curdev++, ndev++) ++ grub_util_pull_device (*curdev); ++ ++ grub_drives = xcalloc ((ndev + 1), sizeof (grub_drives[0])); ++ ++ for (curdev = grub_devices, curdrive = grub_drives; *curdev != NULL; curdev++, ++ curdrive++) ++ { ++ *curdrive = grub_util_get_grub_dev (*curdev); ++ if (*curdrive == NULL) ++ { ++ grub_util_warn (_("cannot find a GRUB drive for %s. Check your device.map"), ++ *curdev); ++ goto cleanup; ++ } ++ } ++ *curdrive = NULL; ++ ++ grub_dev = grub_device_open (grub_drives[0]); ++ if (grub_dev == NULL) ++ { ++ grub_util_warn (_("cannot open device %s: %s"), grub_drives[0], grub_errmsg); ++ grub_errno = GRUB_ERR_NONE; ++ goto cleanup; ++ } ++ ++ grub_fs = grub_fs_probe (grub_dev); ++ if (grub_fs == NULL) ++ { ++ grub_util_warn (_("cannot probe fs for %s: %s"), grub_drives[0], grub_errmsg); ++ grub_errno = GRUB_ERR_NONE; ++ goto cleanup; ++ } ++ ++ have_abstraction = is_abstraction (grub_dev); ++ for (curdrive = grub_drives + 1; *curdrive != NULL && have_abstraction == false; curdrive++) ++ { ++ grub_device_t dev = grub_device_open (*curdrive); ++ ++ if (dev == NULL) ++ continue; ++ have_abstraction = is_abstraction (dev); ++ grub_device_close (dev); ++ } ++ ++ if (have_abstraction == false) ++ fs_envblk_init (grub_fs->name, grub_devices[0]); ++ ++ cleanup: ++ if (grub_devices != NULL) ++ for (curdev = grub_devices; *curdev != NULL; curdev++) ++ free (*curdev); ++ free (grub_devices); ++ free (grub_drives); ++ grub_device_close (grub_dev); ++ grub_gcry_fini_all (); ++ grub_fini_all (); ++ grub_util_biosdisk_fini (); ++} ++ + int + main (int argc, char *argv[]) + { +@@ -613,6 +721,9 @@ main (int argc, char *argv[]) + command = argv[curindex++]; + } + ++ if (strcmp (filename, DEFAULT_ENVBLK_PATH) == 0) ++ probe_fs_envblk (fs_envblk_spec); ++ + if (strcmp (command, "create") == 0) + grub_util_create_envblk_file (filename); + else if (strcmp (command, "list") == 0) diff --git a/0399-btrfs-add-environment-block-to-reserved-header-area.patch b/0399-btrfs-add-environment-block-to-reserved-header-area.patch new file mode 100644 index 00000000..dd877089 --- /dev/null +++ b/0399-btrfs-add-environment-block-to-reserved-header-area.patch @@ -0,0 +1,93 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:40 +0800 +Subject: [PATCH] btrfs: add environment block to reserved header area + +This patch reserves space for the GRUB environment block inside the +Btrfs header. The block is placed at an offset of GRUB_ENV_BTRFS_OFFSET +, 256 KiB from the start of the device, and occupies one sector. To +protect the space, overflow guard sectors are placed before and after +the reserved block. + +The Btrfs header already defines regions for bootloader use. By adding +this entry, GRUB gains a fixed and safe location to store the +environment block without conflicting with other structures in the +header. + +Add Btrfs and its reserved area information to the fs_envblk_spec table. +With the groundworks done in previous patches, the function is now +complete and working in grub-editenv. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +--- + grub-core/fs/btrfs.c | 10 +++++++++- + include/grub/fs.h | 2 ++ + util/grub-editenv.c | 9 ++++++++- + 3 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 3228e17886..261c413e9f 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2650,11 +2650,16 @@ struct embed_region { + * https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)#BOOTLOADER_SUPPORT + * The first 1 MiB on each device is unused with the exception of primary + * superblock that is on the offset 64 KiB and spans 4 KiB. ++ * ++ * Note: If this table is modified, also update ++ * util/grub-editenv.c::fs_envblk_spec, which describes the file-system ++ * specific layout of reserved raw blocks used as environment blocks so that ++ * both stay consistent. + */ + + static const struct { + struct embed_region available; +- struct embed_region used[6]; ++ struct embed_region used[9]; + } btrfs_head = { + .available = {0, GRUB_DISK_KiB_TO_SECTORS (1024)}, /* The first 1 MiB. */ + .used = { +@@ -2662,6 +2667,9 @@ static const struct { + {GRUB_DISK_KiB_TO_SECTORS (64) - 1, 1}, /* Overflow guard. */ + {GRUB_DISK_KiB_TO_SECTORS (64), GRUB_DISK_KiB_TO_SECTORS (4)}, /* 4 KiB superblock. */ + {GRUB_DISK_KiB_TO_SECTORS (68), 1}, /* Overflow guard. */ ++ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS) - 1, 1}, /* Overflow guard. */ ++ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS), 1}, /* Environment Block. */ ++ {(GRUB_ENV_BTRFS_OFFSET >> GRUB_DISK_SECTOR_BITS) + 1, 1}, /* Overflow guard. */ + {GRUB_DISK_KiB_TO_SECTORS (1024) - 1, 1}, /* Overflow guard. */ + {0, 0} /* Array terminator. */ + } +diff --git a/include/grub/fs.h b/include/grub/fs.h +index df4c93b16f..89e4d2b9bc 100644 +--- a/include/grub/fs.h ++++ b/include/grub/fs.h +@@ -132,4 +132,6 @@ grub_fs_unregister (grub_fs_t fs) + + grub_fs_t EXPORT_FUNC(grub_fs_probe) (grub_device_t device); + ++#define GRUB_ENV_BTRFS_OFFSET (256 * 1024) ++ + #endif /* ! GRUB_FS_HEADER */ +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index 201dc7ccd4..3c3f9d09f3 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -156,9 +156,16 @@ static fs_envblk_ops_t fs_envblk_ops = { + + /* + * fs_envblk_spec describes the file-system specific layout of reserved raw +- * blocks used as environment blocks. ++ * blocks used as environment blocks. At present only Btrfs is supported. Other ++ * file-systems may be added if they provide a similar facility and avoid the ++ * limitation of writing to COW. ++ * ++ * Note: If this table is modified, also update ++ * grub-core/fs/btrfs.c::btrfs_head, which defines the layout in the Btrfs ++ * header and exports GRUB_ENV_BTRFS_OFFSET, so that both stay consistent. + */ + static fs_envblk_spec_t fs_envblk_spec[] = { ++ { "btrfs", GRUB_ENV_BTRFS_OFFSET, GRUB_DISK_SECTOR_SIZE }, + { NULL, 0, 0 } + }; + diff --git a/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch b/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch new file mode 100644 index 00000000..a807bb91 --- /dev/null +++ b/0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch @@ -0,0 +1,82 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 17 Oct 2025 17:01:41 +0800 +Subject: [PATCH] 00_header.in: wire grub.cfg to use env_block when present + +This patch extends the generated grub.cfg so that it can use the +external environment block when the variable env_block is defined. +During boot, if env_block is set, grub.cfg builds a device path for it, +exports the variable, and then loads its contents in addition to the +normal grubenv file. + +When GRUB writes variables such as next_entry or saved_entry, the save +commands are changed to write into env_block if it is set, and to fall +back to the grubenv file otherwise. In this way the external environment +block is used automatically, and existing commands like savedefault or +save_env do not need to change. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Daniel Kiper +--- + util/grub.d/00_header.in | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in +index 3e1b77265d..a5d43929b8 100644 +--- a/util/grub.d/00_header.in ++++ b/util/grub.d/00_header.in +@@ -58,6 +58,13 @@ if [ -f \${config_directory}/grubenv ]; then + elif [ -s \$prefix/grubenv ]; then + load_env + fi ++ ++if [ "\${env_block}" ] ; then ++ set env_block="(\${root})\${env_block}" ++ export env_block ++ load_env -f "\${env_block}" ++fi ++ + EOF + if [ "x$GRUB_BUTTON_CMOS_ADDRESS" != "x" ]; then + cat < +Date: Fri, 17 Oct 2025 17:01:43 +0800 +Subject: [PATCH] btrfs: update doc link for bootloader support + +The old wiki link is obsolete and no longer updated, change it to the +current documentation. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Daniel Kiper +--- + grub-core/fs/btrfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 261c413e9f..2222c57abd 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2647,7 +2647,8 @@ struct embed_region { + }; + + /* +- * https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)#BOOTLOADER_SUPPORT ++ * https://btrfs.readthedocs.io/en/latest/btrfs-man5.html#man-btrfs5-bootloader-support ++ * or invoke "man 5 btrfs" and visit the "bootloader support" subsection. + * The first 1 MiB on each device is unused with the exception of primary + * superblock that is on the offset 64 KiB and spans 4 KiB. + * diff --git a/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch b/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch new file mode 100644 index 00000000..11cf789d --- /dev/null +++ b/0402-docs-add-Btrfs-env-block-and-special-env-vars.patch @@ -0,0 +1,93 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Mon, 27 Oct 2025 11:18:45 -0600 +Subject: [PATCH] docs: add Btrfs env block and special env vars + +Update grub.texi to describe the external environment block in the +reserved area of Btrfs header used for grub-reboot and savedefault, +and add a section documenting the saved_entry, next_entry, and +env_block variables. + +Signed-off-by: Michael Chang +Reviewed-by: Neal Gompa +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 55 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 531e847f32..d669972337 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3265,6 +3265,7 @@ GRUB. Others may be used freely in GRUB configuration files. + @menu + * Special environment variables:: + * Environment block:: ++* Special environment block variables:: + @end menu + + +@@ -3881,9 +3882,63 @@ For safety reasons, this storage is only available when installed on a plain + disk (no LVM or RAID), using a non-checksumming filesystem (no ZFS), and + using BIOS or EFI functions (no ATA, USB or IEEE1275). + ++On Btrfs filesystems, a reserved area in the filesystem header may be used to ++store the environment block. This static block avoids the problems of updating ++a normal file on a copy-on-write filesystem, where writing raw block is not ++stable and requires metadata update. The reserved area provides a fixed ++location that GRUB can update directly, allowing commands such as ++@command{grub-reboot} and @samp{GRUB_SAVEDEFAULT} to function correctly on ++Btrfs volumes. ++ + @command{grub2-mkconfig} uses this facility to implement + @samp{GRUB_SAVEDEFAULT} (@pxref{Simple configuration}). + ++@node Special environment block variables ++@section Special environment block variables ++ ++These special variables are usually written to the environment block ++(@pxref{Environment block}) to customize the behavior of @file{grub.cfg} ++generated by @command{grub-mkconfig}. ++ ++@menu ++* saved_entry:: ++* next_entry:: ++* env_block:: ++@end menu ++ ++@node saved_entry ++@subsection saved_entry ++ ++The @var{saved_entry} variable sets the default boot entry in @file{grub.cfg} ++created by @command{grub-mkconfig}. It can be set with ++@command{grub-set-default} to choose a default entry, or at runtime with the ++@code{savedefault} function in grub.cfg to save the current entry as the new ++default. This may require write access by GRUB. ++ ++@node next_entry ++@subsection next_entry ++ ++The @var{next_entry} variable sets the boot entry for the next boot only. After ++it is used, GRUB clears the value so it is not reused. This requires write ++access to the environment block (@pxref{Environment block}) at runtime. The ++@command{grub-reboot} command is usually used instead of changing this variable ++directly. ++ ++@node env_block ++@subsection env_block ++ ++If the filesystem is Btrfs and the disk is not an abstracted device such as ++LVM, RAID, or encryption, the reserved space in the Btrfs header can be used as ++the environment block (@pxref{Environment block}). This provides a fixed raw ++block that GRUB can reliably write to. The @var{env_block} records this ++location in GRUB blocklist syntax (@pxref{Block list syntax}) so that ++@command{grub-editenv} and @file{grub.cfg} know how to access and use the ++external raw block. ++ ++This variable is initialized when @file{grubenv} is first created by ++@command{grub-editenv} and is treated as read-only to avoid being overwritten ++with an unpredictable value. ++ + @node Modules + @chapter Modules + diff --git a/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch b/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch new file mode 100644 index 00000000..6aa5d83e --- /dev/null +++ b/0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch @@ -0,0 +1,73 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Thu, 29 Aug 2024 13:01:02 +0200 +Subject: [PATCH] kern/fs: Honour file->read_hook() in grub_fs_blocklist_read() + +Unlike files accessed via a normal file system, the file->read_hook() is +not honoured when using blocklist notation. + +This means that when trying to use a dedicated, 1 KiB, raw partition +for the environment block and hence does something like + + save_env --file=(hd0,gpt9)0+2 X Y Z + +this fails with "sparse file not allowed", which is rather unexpected, +as I've explicitly said exactly which blocks should be used. Adding +a little debugging reveals that grub_file_size(file) is 1024 as expected, +but total_length is 0, simply because the callback was never invoked, so +blocklists is an empty list. + +Fix that by honouring the ->read_hook() set by the caller, also when +a "file" is specified with blocklist notation. + +Signed-off-by: Rasmus Villemoes +Reviewed-by: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + grub-core/kern/fs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c +index f25bace620..9f6f4ef9da 100644 +--- a/grub-core/kern/fs.c ++++ b/grub-core/kern/fs.c +@@ -216,12 +216,15 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) + grub_disk_addr_t sector; + grub_off_t offset; + grub_ssize_t ret = 0; ++ grub_disk_t disk = file->device->disk; + + if (len > file->size - file->offset) + len = file->size - file->offset; + + sector = (file->offset >> GRUB_DISK_SECTOR_BITS); + offset = (file->offset & (GRUB_DISK_SECTOR_SIZE - 1)); ++ disk->read_hook = file->read_hook; ++ disk->read_hook_data = file->read_hook_data; + for (p = file->data; p->length && len > 0; p++) + { + if (sector < p->length) +@@ -233,9 +236,12 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) + >> GRUB_DISK_SECTOR_BITS) > p->length - sector) + size = ((p->length - sector) << GRUB_DISK_SECTOR_BITS) - offset; + +- if (grub_disk_read (file->device->disk, p->offset + sector, offset, ++ if (grub_disk_read (disk, p->offset + sector, offset, + size, buf) != GRUB_ERR_NONE) +- return -1; ++ { ++ ret = -1; ++ break; ++ } + + ret += size; + len -= size; +@@ -245,6 +251,8 @@ grub_fs_blocklist_read (grub_file_t file, char *buf, grub_size_t len) + else + sector -= p->length; + } ++ disk->read_hook = NULL; ++ disk->read_hook_data = NULL; + + return ret; + } diff --git a/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch b/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch new file mode 100644 index 00000000..efe9389e --- /dev/null +++ b/0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Neal Gompa +Date: Wed, 26 Nov 2025 08:20:26 -0500 +Subject: [PATCH] util/grub.d/00_header.in: Prefer $dev instead of $root for + $env_block + +In UEFI environments where GRUB loads a stub grub.cfg on the EFI +System Partition (ESP) that points to the real one on the operating +system volume, the $root value is set to the ESP instead of the +operating system volume. + +This is particularly problematic for setups where the operating +system boot data is on a Btrfs volume and the external environment +block in the Btrfs bootloader space is used for grubenv data. + +Using $dev in its place resolves this problem, since the stub +grub.cfg populates this variable. Use it if it exists, and +fall back to $root accordingly. + +This is unlikely to be upstreamable, as it depends on the method +Fedora Linux and derivatives use to load the GRUB configuration. + +Signed-off-by: Neal Gompa +--- + util/grub.d/00_header.in | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/util/grub.d/00_header.in b/util/grub.d/00_header.in +index a5d43929b8..01f1f4144e 100644 +--- a/util/grub.d/00_header.in ++++ b/util/grub.d/00_header.in +@@ -60,7 +60,11 @@ elif [ -s \$prefix/grubenv ]; then + fi + + if [ "\${env_block}" ] ; then +- set env_block="(\${root})\${env_block}" ++ if [ "\${dev}" ]; then ++ set env_block="(\${dev})\${env_block}" ++ else ++ set env_block="(\${root})\${env_block}" ++ fi + export env_block + load_env -f "\${env_block}" + fi diff --git a/0405-grub.d-Support-the-external-environment-block-for-au.patch b/0405-grub.d-Support-the-external-environment-block-for-au.patch new file mode 100644 index 00000000..c75926a0 --- /dev/null +++ b/0405-grub.d-Support-the-external-environment-block-for-au.patch @@ -0,0 +1,89 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Neal Gompa +Date: Wed, 26 Nov 2025 08:37:57 -0500 +Subject: [PATCH] grub.d: Support the external environment block for automatic + hidden menu + +This allows the automatic hidden menu (and boot counting) mechanism +to use an external environment block if it exists and is configured +to be used. + +This is particularly important for supporting this mechanism on +systems with the operating system boot data on a Btrfs volume. + +This is unlikely to be upstreamable, as it depends on Fedora's GRUB +hidden menu and boot counting patch sets. + +Signed-off-by: Neal Gompa +--- + util/grub.d/08_fallback_counting.in | 6 +++++- + util/grub.d/10_reset_boot_success.in | 6 +++++- + util/grub.d/12_menu_auto_hide.in | 6 +++++- + util/grub.d/14_menu_show_once.in | 6 +++++- + 4 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/util/grub.d/08_fallback_counting.in b/util/grub.d/08_fallback_counting.in +index 2e2c3ff7d3..272cdb6533 100644 +--- a/util/grub.d/08_fallback_counting.in ++++ b/util/grub.d/08_fallback_counting.in +@@ -19,6 +19,10 @@ if [ -n "\${boot_counter}" -a "\${boot_success}" = "0" ]; then + else + decrement boot_counter + fi +- save_env boot_counter ++ if [ "\${env_block}" ]; then ++ save_env -f "\${env_block}" boot_counter ++ else ++ save_env boot_counter ++ fi + fi + EOF +diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in +index e73f4137b3..ca04f9b699 100644 +--- a/util/grub.d/10_reset_boot_success.in ++++ b/util/grub.d/10_reset_boot_success.in +@@ -21,5 +21,9 @@ elif [ "\${boot_indeterminate}" = "1" ]; then + fi + # Reset boot_success for current boot + set boot_success=0 +-save_env boot_success boot_indeterminate ++if [ "\${env_block}" ]; then ++ save_env -f "\${env_block}" boot_success boot_indeterminate ++else ++ save_env boot_success boot_indeterminate ++fi + EOF +diff --git a/util/grub.d/12_menu_auto_hide.in b/util/grub.d/12_menu_auto_hide.in +index 6a7c0fa0d4..c2c207232e 100644 +--- a/util/grub.d/12_menu_auto_hide.in ++++ b/util/grub.d/12_menu_auto_hide.in +@@ -16,7 +16,11 @@ cat << EOF + if [ x\$feature_timeout_style = xy ] ; then + if [ "\${menu_show_once}" ]; then + unset menu_show_once +- save_env menu_show_once ++ if [ "\${env_block}" ]; then ++ save_env -f "\${env_block}" menu_show_once ++ else ++ save_env menu_show_once ++ fi + set timeout_style=menu + set timeout=60 + elif [ "\${menu_auto_hide}" -a "\${menu_hide_ok}" = "1" ]; then +diff --git a/util/grub.d/14_menu_show_once.in b/util/grub.d/14_menu_show_once.in +index 1cd7f36142..41b37b5ec7 100755 +--- a/util/grub.d/14_menu_show_once.in ++++ b/util/grub.d/14_menu_show_once.in +@@ -7,7 +7,11 @@ if [ x\$feature_timeout_style = xy ]; then + set timeout_style=menu + set timeout="\${menu_show_once_timeout}" + unset menu_show_once_timeout +- save_env menu_show_once_timeout ++ if [ "\${env_block}" ]; then ++ save_env -f "\${env_block}" menu_show_once_timeout ++ else ++ save_env menu_show_once_timeout ++ fi + fi + fi + EOF diff --git a/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch b/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch new file mode 100644 index 00000000..92b053bf --- /dev/null +++ b/0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch @@ -0,0 +1,36 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Neal Gompa +Date: Wed, 26 Nov 2025 08:48:10 -0500 +Subject: [PATCH] grub-editenv: Make automatic hidden menu and boot counting + use envblk when available + +This ensures the automatic hidden menu and boot counting settings +are set in the right place when an external environment block is used. + +This is unlikely to be upstreamable, as it depends on Fedora's GRUB +hidden menu and boot counting patch sets. + +Signed-off-by: Neal Gompa +--- + util/grub-editenv.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/util/grub-editenv.c b/util/grub-editenv.c +index 3c3f9d09f3..48611e4e17 100644 +--- a/util/grub-editenv.c ++++ b/util/grub-editenv.c +@@ -473,7 +473,13 @@ set_variables (const char *name, int argc, char *argv[]) + + *(p++) = 0; + +- if ((strcmp (argv[0], "next_entry") == 0) && envblk_on_block != NULL) ++ if (((strcmp (argv[0], "next_entry") == 0) || ++ (strcmp (argv[0], "boot_counter") == 0) || ++ (strcmp (argv[0], "boot_indeterminate") == 0) || ++ (strcmp (argv[0], "boot_success") == 0) || ++ (strcmp (argv[0], "menu_show_once") == 0) || ++ (strcmp (argv[0], "menu_show_once_timeout") == 0)) ++ && envblk_on_block != NULL) + { + if (grub_envblk_set (envblk_on_block, argv[0], p) == 0) + grub_util_error ("%s", _("environment block too small")); diff --git a/grub.patches b/grub.patches index af74d2e3..8598a2de 100644 --- a/grub.patches +++ b/grub.patches @@ -387,3 +387,19 @@ Patch0387: 0387-blsuki-Check-for-mounted-boot-in-emu.patch Patch0388: 0388-blsuki-Add-uki-command-to-load-Unified-Kernel-Image-.patch Patch0389: 0389-posix_wrap-Tweaks-in-preparation-for-libtasn1.patch Patch0390: 0390-blsuki-do-not-register-blscfg-command.patch +Patch0391: 0391-misc-add-z-length-modifier-support.patch +Patch0392: 0392-tests-add-z-modifier-printf-tests.patch +Patch0393: 0393-util-grub-editenv-add-fs_envblk-open-helper.patch +Patch0394: 0394-util-grub-editenv-add-fs_envblk-write-helper.patch +Patch0395: 0395-util-grub-editenv-wire-set_variables-to-optional-fs_.patch +Patch0396: 0396-util-grub-editenv-wire-unset_variables-to-optional-f.patch +Patch0397: 0397-util-grub-editenv-wire-list_variables-to-optional-fs.patch +Patch0398: 0398-util-grub-editenv-add-probe-call-for-external-envblk.patch +Patch0399: 0399-btrfs-add-environment-block-to-reserved-header-area.patch +Patch0400: 0400-00_header.in-wire-grub.cfg-to-use-env_block-when-pre.patch +Patch0401: 0401-btrfs-update-doc-link-for-bootloader-support.patch +Patch0402: 0402-docs-add-Btrfs-env-block-and-special-env-vars.patch +Patch0403: 0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch +Patch0404: 0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch +Patch0405: 0405-grub.d-Support-the-external-environment-block-for-au.patch +Patch0406: 0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch diff --git a/grub2.spec b/grub2.spec index bde96ec1..3faf555e 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 47%{?dist} +Release: 48%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,9 @@ fi %endif %changelog +* Fri Nov 21 2025 Leo Sandoval - 2.12-48 +- Add support for external environment block on Btrfs + * Thu Nov 13 2025 Leo Sandoval - 2.12-47 - blsuki: do not register blscfg command From 16cb5b303d06825e8b36b5ca5e195e811d047bd1 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Fri, 28 Nov 2025 11:37:28 -0600 Subject: [PATCH 44/45] Increase EFI max allocation to max usable address Resolves: #2263643 Signed-off-by: Nicolas Frayer Signed-off-by: Leo Sandoval --- ...max-allocation-to-max-usable-address.patch | 23 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 6 ++++- 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 0407-Increase-EFI-max-allocation-to-max-usable-address.patch diff --git a/0407-Increase-EFI-max-allocation-to-max-usable-address.patch b/0407-Increase-EFI-max-allocation-to-max-usable-address.patch new file mode 100644 index 00000000..a1297e44 --- /dev/null +++ b/0407-Increase-EFI-max-allocation-to-max-usable-address.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Fri, 28 Nov 2025 11:30:19 -0600 +Subject: [PATCH] Increase EFI max allocation to max usable address + +Signed-off-by: Leo Sandoval +--- + include/grub/x86_64/efi/memory.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/grub/x86_64/efi/memory.h b/include/grub/x86_64/efi/memory.h +index e81cfb3221..547e3f82f8 100644 +--- a/include/grub/x86_64/efi/memory.h ++++ b/include/grub/x86_64/efi/memory.h +@@ -3,7 +3,7 @@ + + #if defined (__code_model_large__) + #define GRUB_EFI_MAX_USABLE_ADDRESS __UINTPTR_MAX__ +-#define GRUB_EFI_MAX_ALLOCATION_ADDRESS 0x7fffffff ++#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS + #else + #define GRUB_EFI_MAX_USABLE_ADDRESS 0x7fffffff + #define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS diff --git a/grub.patches b/grub.patches index 8598a2de..67c06e16 100644 --- a/grub.patches +++ b/grub.patches @@ -403,3 +403,4 @@ Patch0403: 0403-kern-fs-Honour-file-read_hook-in-grub_fs_blocklist_r.patch Patch0404: 0404-util-grub.d-00_header.in-Prefer-dev-instead-of-root-.patch Patch0405: 0405-grub.d-Support-the-external-environment-block-for-au.patch Patch0406: 0406-grub-editenv-Make-automatic-hidden-menu-and-boot-cou.patch +Patch0407: 0407-Increase-EFI-max-allocation-to-max-usable-address.patch diff --git a/grub2.spec b/grub2.spec index 3faf555e..552df8d3 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 48%{?dist} +Release: 49%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -609,6 +609,10 @@ fi %endif %changelog +* Thu Nov 27 2025 Leo Sandoval - 2.12-49 +- Increase EFI max allocation to max usable address +- Resolves: #2263643 + * Fri Nov 21 2025 Leo Sandoval - 2.12-48 - Add support for external environment block on Btrfs From 85de859da1331046d29ffda9f1aac33d93da8457 Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Wed, 10 Dec 2025 12:02:40 +0100 Subject: [PATCH 45/45] Do not include EFI dir in common subpackage This fixes [1] which is part of [2]. We cannot ship /usr/lib/efi/* in -common subpackage as bootupd does not expect this directory for ppc64le arch. We are moving the creation and configuration of the directory into specific EFI macros only. [1] e02b6e88c71642ecc063ae7aefbd09b9be80d50e [2] https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1 Signed-off-by: Joel Capitao --- grub.macros | 4 +++- grub2.spec | 7 +++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/grub.macros b/grub.macros index f6455473..dd06d94c 100644 --- a/grub.macros +++ b/grub.macros @@ -708,6 +708,7 @@ find . '(' -iname gdb_grub \\\ ')' \\\ -exec cp {} $RPM_BUILD_ROOT/usr/lib/grub/%{grubaltefiarch}/ \\\; \ find $RPM_BUILD_ROOT -type f -iname "*.mod*" -exec chmod a-x {} '\;' \ +install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ %{expand:%%do_install_protected_file grub2-%{alt_package_arch}} \ @@ -726,6 +727,7 @@ fi \ find $RPM_BUILD_ROOT -iname "*.module" -exec chmod a-x {} '\;' \ ln -s ../boot/grub2/grub.cfg \\\ $RPM_BUILD_ROOT%{_sysconfdir}/grub2-efi.cfg \ +install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ install -m 700 %{2} $RPM_BUILD_ROOT%{grub_efi_dir}/%{2} \ install -m 700 %{3} $RPM_BUILD_ROOT%{grub_efi_dir}/%{3} \ %ifarch %{arm} \ @@ -830,7 +832,6 @@ cp docs/grub.info $RPM_BUILD_ROOT%{_infodir}/grub2.info \ cp docs/grub-dev.info \\\ $RPM_BUILD_ROOT%{_infodir}/grub2-dev.info \ install -d -m 0700 ${RPM_BUILD_ROOT}%{efi_esp_dir}/ \ -install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_efi_dir}/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/ \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/loader/entries \ install -d -m 0700 ${RPM_BUILD_ROOT}/boot/grub2/themes/system \ @@ -879,6 +880,7 @@ ln -s ../boot/grub2/grub.cfg \\\ %config(noreplace) %{_sysconfdir}/grub2.cfg \ %config(noreplace) %{_sysconfdir}/grub2-efi.cfg \ %ghost %attr(0700,root,root) %{efi_esp_dir}/%{2} \ +%dir %attr(0700,root,root) %{grub_efi_dir} \ %attr(0700,root,root) %{grub_efi_dir}/%{2} \ %ifarch %{arm} \ %attr(0700,root,root) %verify(not mtime) %{efi_esp_boot}/BOOTARM.EFI \ diff --git a/grub2.spec b/grub2.spec index 552df8d3..8f73768c 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 49%{?dist} +Release: 50%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -446,7 +446,6 @@ fi %dir /boot/grub2/themes/system %attr(0700,root,root) %dir /boot/grub2 %exclude /boot/grub2/* -%dir %attr(0700,root,root) %{grub_efi_dir} %exclude %{grub_efi_dir}/* %ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv %license COPYING @@ -609,6 +608,10 @@ fi %endif %changelog +* Wed Dec 10 2025 Joel Capitao - 2.12-50 +- Do not include EFI dir in common subpackage +- Resolves: rhbz#2420430 + * Thu Nov 27 2025 Leo Sandoval - 2.12-49 - Increase EFI max allocation to max usable address - Resolves: #2263643