From 3814958e1a8cebdfb273ed90c19d9bef8fa6e9df Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Fri, 4 Oct 2019 17:22:52 +0200 Subject: [PATCH 01/16] Don't add a class option to menu entries generated for ppc64le For ppc64le a grub config file with menuentry commands is still generated even when BLS support is enabled. That's because BLS support was added to Petitboot 1.8.0 and any previous version won't be able to parse BLS files. To make the BLS snippets the source of truth, these are used to generate the menuentry commands in the grub config file. And to keep it consistent across all ppc64le machines regardless of the firmware used, the grub config file is also generated for machines with OF that use grub2 and would have BLS support. The BLS snippets created by the kernel package have fields that are used to specify the generated menuentry command users and class options. These fields are not present in BLS snippets created by OSTree though, so the script generating the menuentry commands will add options with an empty argument which will lead to grub failing to parse them. We could check if the field is defined before attempting to add those, but since the grub2 blscfg module also supports setting these to variables, it could lead to an empty argument even if was defined in the BLS snippet if the variable doesn't exist. So to make more robust, just don't add a class to the menuentry commands generated by the script. It's better to not have a class for the menuentry than grub2 failing to parse the command and not populating the boot menu. Resolves: rhbz#1758225 Signed-off-by: Javier Martinez Canillas --- ...s-option-to-menu-entries-generated-f.patch | 78 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 6 +- 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch diff --git a/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch new file mode 100644 index 00000000..d1366182 --- /dev/null +++ b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch @@ -0,0 +1,78 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Fri, 4 Oct 2019 16:43:05 +0200 +Subject: [PATCH] Don't add a class option to menu entries generated for + ppc64le + +For ppc64le a grub config file with menuentry commands is still generated +even when BLS support is enabled. That's because BLS support was added to +Petitboot 1.8.0 and any previous version won't be able to parse BLS files. + +To make the BLS snippets the source of truth, these are used to generate +the menuentry commands in the grub config file. + +And to keep it consistent across all ppc64le machines regardless of the +firmware used, the grub config file is also generated for machines with +OF that use grub2 and would have BLS support. + +The BLS snippets created by the kernel package have fields that are used +to specify the generated menuentry command users and class options. These +fields are not present in BLS snippets created by OSTree though, so the +script generating the menuentry commands will add options with an empty +argument which will lead to grub failing to parse them. + +We could check if the field is defined before attempting to add those, but +since the grub2 blscfg module also supports setting these to variables, it +could lead to an empty argument even if was defined in the BLS snippet if +the variable doesn't exist. + +So to make more robust, just don't add a class to the menuentry commands +generated by the script. It's better to not have a class for the menuentry +than grub2 failing to parse the command and not populating the boot menu. + +Resolves: rhbz#1758225 + +Signed-off-by: Javier Martinez Canillas +--- + util/grub.d/10_linux_bls.in | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/util/grub.d/10_linux_bls.in b/util/grub.d/10_linux_bls.in +index 1b7536435f1..68fbedf2129 100644 +--- a/util/grub.d/10_linux_bls.in ++++ b/util/grub.d/10_linux_bls.in +@@ -127,9 +127,7 @@ read_config() + initrd="" + options="" + linux="" +- grub_users="" + grub_arg="" +- grub_class="" + + while read -r line + do +@@ -148,15 +146,9 @@ read_config() + "options") + options=${value} + ;; +- "grub_users") +- grub_users=${value} +- ;; + "grub_arg") + grub_arg=${value} + ;; +- "grub_class") +- grub_class=${value} +- ;; + esac + done < ${config_file} + } +@@ -180,7 +172,7 @@ populate_menu() + for bls in "${files[@]}" ; do + read_config "${blsdir}/${bls}.conf" + +- menu="${menu}menuentry '${title}' --class ${grub_class} ${grub_arg} --id=${bls} {\n" ++ menu="${menu}menuentry '${title}' ${grub_arg} --id=${bls} {\n" + menu="${menu}\t linux ${linux} ${options}\n" + if [ -n "${initrd}" ] ; then + menu="${menu}\t initrd ${boot_prefix}${initrd}\n" diff --git a/grub.patches b/grub.patches index b0680ca8..27c95393 100644 --- a/grub.patches +++ b/grub.patches @@ -185,3 +185,4 @@ Patch0184: 0184-arm-Move-trampolines-into-code-section.patch Patch0185: 0185-arm-Align-section-alignment-with-manual-relocation-o.patch Patch0186: 0186-grub-core-loader-efi-fdt.c-Do-not-copy-random-memory.patch Patch0187: 0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch +Patch0188: 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch diff --git a/grub2.spec b/grub2.spec index 9d9ee484..613326cd 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 97%{?dist} +Release: 98%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Fri Oct 04 2019 Javier Martinez Canillas - 2.02-98 +- Don't add a class option to menu entries generated for ppc64le + Resolves: rhbz#1758225 + * Wed Aug 07 2019 Javier Martinez Canillas - 2.02-97 - Include regexp module in EFI builds From aa81bb84d308c042c4e47384949b6d44c9fcaa55 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 9 Oct 2019 11:11:56 +0200 Subject: [PATCH 02/16] 99-grub-mkconfig: Disable BLS usage for Xen DomU guests GRUB is used to boot Xen Dom0 hosts so BLS is supported there, but PV and PVH Xen DomU guests are booted with pygrub that doesn't have BLS support. This means that only HVM Xen DomU guests can support BLS and others need a traditional GRUB configuration file that contains menuentry commands. So to make the GRUB config compatible with all Xen DomU guests, don't use the BLS snippets and instead call grub2-mkconfig to regenerate the config on each kernel install and removal. Even when HVM Xen DomU guests can support BLS, just disable for all DomU so the configuration is consistent across all Xen DomU guests variants. And also because even when an installation is made with HVM, this can be later changed to a DomU variant that uses pygrub and doesn't support BLS. Resolves: rhbz#1703700 Signed-off-by: Javier Martinez Canillas Tested-by: Steven Haigh --- 99-grub-mkconfig.install | 16 ++++++++++++++-- grub2.spec | 6 +++++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index e3708993..5c5024c8 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -4,10 +4,22 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then exit 0 fi +# A "control_d" string in /proc/xen/capabilities indicates that is a Xen Dom0 host. +[[ -e /sys/hypervisor/type ]] && read HV_TYPE < /sys/hypervisor/type +[[ -e /proc/xen/capabilities ]] && grep -q "control_d" /proc/xen/capabilities && XEN_DOM0=true + +if [[ $HV_TYPE = "xen" && $XEN_DOM0 != "true" ]]; then + if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then + sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub + fi +fi + ARCH=$(uname -m) -# Is only needed for ppc64* since we can't assume a BLS capable bootloader there -if [[ $ARCH != "ppc64" && $ARCH != "ppc64le" ]]; then +# A traditional grub configuration file needs to be generated only for ppc64le and +# Xen DomU guests since we can't assume that bootloaders will be BLS capable there. +if [[ $ARCH != "ppc64" && $ARCH != "ppc64le" ]] || + [[ $HV_TYPE = "xen" && $XEN_DOM0 = "true" ]]; then exit 0 fi diff --git a/grub2.spec b/grub2.spec index 613326cd..4a0098f5 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 98%{?dist} +Release: 99%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Wed Oct 09 2019 Javier Martinez Canillas - 2.02-99 +- 99-grub-mkconfig: Disable BLS usage for Xen DomU guests + Resolves: rhbz#1703700 + * Fri Oct 04 2019 Javier Martinez Canillas - 2.02-98 - Don't add a class option to menu entries generated for ppc64le Resolves: rhbz#1758225 From 35ccd46253281108493907fe2853c84035396957 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 10 Oct 2019 07:55:31 +0200 Subject: [PATCH 03/16] 99-grub-mkconfig: Fix script condition to exit and remove ppc64 BE check The ppc64 big endian support ended in F29 and only ppc64le is supported so there's no need to check for this architecture. Also the script wasn't properly tested and the check for Xen DomU machines isn't correct. Fix the test condition to exit the script. Related: rhbz#1703700 Signed-off-by: Javier Martinez Canillas --- 99-grub-mkconfig.install | 7 +++++-- grub2.spec | 6 +++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 5c5024c8..d29de214 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -9,17 +9,20 @@ fi [[ -e /proc/xen/capabilities ]] && grep -q "control_d" /proc/xen/capabilities && XEN_DOM0=true if [[ $HV_TYPE = "xen" && $XEN_DOM0 != "true" ]]; then + RUN_MKCONFIG=true if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub fi fi ARCH=$(uname -m) +if [[ $ARCH = "ppc64le" ]]; then + RUN_MKCONFIG=true +fi # A traditional grub configuration file needs to be generated only for ppc64le and # Xen DomU guests since we can't assume that bootloaders will be BLS capable there. -if [[ $ARCH != "ppc64" && $ARCH != "ppc64le" ]] || - [[ $HV_TYPE = "xen" && $XEN_DOM0 = "true" ]]; then +if [[ $RUN_MKCONFIG != "true" ]]; then exit 0 fi diff --git a/grub2.spec b/grub2.spec index 4a0098f5..27dd9ddf 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 99%{?dist} +Release: 100%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Thu Oct 10 2019 Javier Martinez Canillas - 2.02-100 +- 99-grub-mkconfig: Fix script condition to exit and remove ppc64 BE check + Related: rhbz#1703700 + * Wed Oct 09 2019 Javier Martinez Canillas - 2.02-99 - 99-grub-mkconfig: Disable BLS usage for Xen DomU guests Resolves: rhbz#1703700 From 68d521ff85a14747ad37b092dc1b3d91d50d15cc Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 16 Oct 2019 11:53:04 +0200 Subject: [PATCH 04/16] 99-grub-mkconfig: Also disable BLS usage for Xen Dom0 hosts A previous patch disabled BLS usage for Xen Dom0 guests but it turns out that Xen Dom0 hosts also need to regenerate a GRUB config file since the menuentries used aren't the generated by 10_linux but by 20_linux_xen. Resolves: rhbz#1761799 Signed-off-by: Javier Martinez Canillas Tested-by: Steven Haigh --- 99-grub-mkconfig.install | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index d29de214..339b3c77 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -4,24 +4,29 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then exit 0 fi -# A "control_d" string in /proc/xen/capabilities indicates that is a Xen Dom0 host. -[[ -e /sys/hypervisor/type ]] && read HV_TYPE < /sys/hypervisor/type -[[ -e /proc/xen/capabilities ]] && grep -q "control_d" /proc/xen/capabilities && XEN_DOM0=true - -if [[ $HV_TYPE = "xen" && $XEN_DOM0 != "true" ]]; then +# PV and PVH Xen DomU guests boot with pygrub that doesn't have BLS support, +# also Xen Dom0 use the menuentries from 20_linux_xen and not the ones from +# 10_linux. So BLS support needs to be disabled for both Xen Dom0 and DomU. +if [[ -e /sys/hypervisor/type ]] && grep -q "^xen$" /sys/hypervisor/type; then RUN_MKCONFIG=true + DISABLE_BLS=true +fi + +ARCH=$(uname -m) +# Older ppc64le OPAL firmware don't have BLS support so grub2-mkconfig has to +# be run to generate a GRUB config file that contains menuentry commands. +if [[ $ARCH = "ppc64le" ]]; then + RUN_MKCONFIG=true +fi + +if [[ $DISABLE_BLS = "true" ]]; then if grep -q '^GRUB_ENABLE_BLSCFG="*true"*\s*$' /etc/default/grub; then sed -i 's/^GRUB_ENABLE_BLSCFG=.*/GRUB_ENABLE_BLSCFG=false/' /etc/default/grub fi fi -ARCH=$(uname -m) -if [[ $ARCH = "ppc64le" ]]; then - RUN_MKCONFIG=true -fi - -# A traditional grub configuration file needs to be generated only for ppc64le and -# Xen DomU guests since we can't assume that bootloaders will be BLS capable there. +# A traditional grub configuration file needs to be generated only in the case when +# the bootloaders are not capable of populating a menu entry from the BLS fragments. if [[ $RUN_MKCONFIG != "true" ]]; then exit 0 fi From ce4c8db35472c9589cbb83f55346c4117362b656 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 16 Oct 2019 12:34:21 +0200 Subject: [PATCH 05/16] A couple of BLS fixes 99-grub-mkconfig: Also disable BLS usage for Xen Dom0 hosts Resolves: rhbz#1761799 blscfg: Fix typo for gfxpayload variable name Resolves: rhbz#1706489 Signed-off-by: Javier Martinez Canillas --- ...ix-typo-for-gfxpayload-variable-name.patch | 28 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 8 +++++- 3 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch diff --git a/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch new file mode 100644 index 00000000..5599fa1e --- /dev/null +++ b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch @@ -0,0 +1,28 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 16 Oct 2019 12:16:32 +0200 +Subject: [PATCH] blscfg: Fix typo for gfxpayload variable name + +There was a silly typo when setting the environment variable gfxpayload so +graphics mode wouldn't be preserved on some machines leading to text mode. + +Resolves: rhbz#1706489 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 26dbe873fe4..8c6dd91be10 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -822,7 +822,7 @@ static void create_entry (struct bls_entry *entry) + } + + src = grub_xasprintf ("load_video\n" +- "set gfx_payload=keep\n" ++ "set gfxpayload=keep\n" + "insmod gzio\n" + "linux %s%s%s%s\n" + "%s", diff --git a/grub.patches b/grub.patches index 27c95393..c5a3b8dc 100644 --- a/grub.patches +++ b/grub.patches @@ -186,3 +186,4 @@ Patch0185: 0185-arm-Align-section-alignment-with-manual-relocation-o.patch Patch0186: 0186-grub-core-loader-efi-fdt.c-Do-not-copy-random-memory.patch Patch0187: 0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch Patch0188: 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch +Patch0189: 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch diff --git a/grub2.spec b/grub2.spec index 27dd9ddf..ca2b4d28 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 100%{?dist} +Release: 101%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,12 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Wed Oct 16 2019 Javier Martinez Canillas - 2.02-101 +- 99-grub-mkconfig: Also disable BLS usage for Xen Dom0 hosts + Resolves: rhbz#1761799 +- blscfg: Fix typo for gfxpayload variable name + Resolves: rhbz#1706489 + * Thu Oct 10 2019 Javier Martinez Canillas - 2.02-100 - 99-grub-mkconfig: Fix script condition to exit and remove ppc64 BE check Related: rhbz#1703700 From 172b494fc64ec40020e79d432fd74e1a1759f13a Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 26 Nov 2019 10:28:55 +0100 Subject: [PATCH 06/16] grub-set-bootflag: Write new env to tmpfile and then rename Resolves: CVE-2019-14865 Resolves: rhbz#1776580 Signed-off-by: Javier Martinez Canillas --- ...g-Update-comment-about-running-as-ro.patch | 27 ++++ ...g-Write-new-env-to-tmpfile-and-then-.patch | 152 ++++++++++++++++++ grub.patches | 2 + grub2.spec | 7 +- 4 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch create mode 100644 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch diff --git a/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch new file mode 100644 index 00000000..cd4ef775 --- /dev/null +++ b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 13 Nov 2019 12:15:43 +0100 +Subject: [PATCH] grub-set-bootflag: Update comment about running as root + through pkexec + +We have stopped using pkexec for grub-set-bootflag, instead it is now +installed suid root, update the comment accordingly. + +Signed-off-by: Hans de Goede +--- + util/grub-set-bootflag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 6a79ee67444..65d74ce010f 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -18,7 +18,7 @@ + */ + + /* +- * NOTE this gets run by users as root (through pkexec), so this does not ++ * NOTE this gets run by users as root (its suid root), so this does not + * use any grub library / util functions to allow for easy auditing. + * The grub headers are only included to get certain defines. + */ diff --git a/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch new file mode 100644 index 00000000..122bf686 --- /dev/null +++ b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch @@ -0,0 +1,152 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 13 Nov 2019 13:02:01 +0100 +Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename + +Make the grubenv writing code in grub-set-bootflag more robust by +writing the modified grubenv to a tmpfile first and then renaming the +tmpfile over the old grubenv (following symlinks). + +Signed-off-by: Hans de Goede +--- + util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 78 insertions(+), 9 deletions(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 65d74ce010f..d1c5e28862b 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -28,7 +28,9 @@ + #include + #include /* For GRUB_ENVBLK_DEFCFG define */ + #include ++#include + #include ++#include + #include + #include + +@@ -54,8 +56,10 @@ int main(int argc, char *argv[]) + { + /* NOTE buf must be at least the longest bootflag length + 4 bytes */ + char env[GRUBENV_SIZE + 1], buf[64], *s; ++ /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */ ++ char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1]; + const char *bootflag; +- int i, len, ret; ++ int i, fd, len, ret; + FILE *f; + + if (argc != 2) +@@ -77,7 +81,32 @@ int main(int argc, char *argv[]) + bootflag = bootflags[i]; + len = strlen (bootflag); + +- f = fopen (GRUBENV, "r"); ++ /* ++ * Really become root. setuid avoids an user killing us, possibly leaking ++ * the tmpfile. setgid avoids the new grubenv's gid being that of the user. ++ */ ++ ret = setuid(0); ++ if (ret) ++ { ++ perror ("Error setuid(0) failed"); ++ return 1; ++ } ++ ++ ret = setgid(0); ++ if (ret) ++ { ++ perror ("Error setgid(0) failed"); ++ return 1; ++ } ++ ++ /* Canonicalize GRUBENV filename, resolving symlinks, etc. */ ++ if (!realpath(GRUBENV, env_filename)) ++ { ++ perror ("Error canonicalizing " GRUBENV " filename"); ++ return 1; ++ } ++ ++ f = fopen (env_filename, "r"); + if (!f) + { + perror ("Error opening " GRUBENV " for reading"); +@@ -132,30 +161,70 @@ int main(int argc, char *argv[]) + snprintf(buf, sizeof(buf), "%s=1\n", bootflag); + memcpy(s, buf, len + 3); + +- /* "r+", don't truncate so that the diskspace stays reserved */ +- f = fopen (GRUBENV, "r+"); ++ ++ /* ++ * Create a tempfile for writing the new env. Use the canonicalized filename ++ * for the template so that the tmpfile is in the same dir / on same fs. ++ */ ++ snprintf(tmp_filename, sizeof(tmp_filename), "%sXXXXXX", env_filename); ++ fd = mkstemp(tmp_filename); ++ if (fd == -1) ++ { ++ perror ("Creating tmpfile failed"); ++ return 1; ++ } ++ ++ f = fdopen (fd, "w"); + if (!f) + { +- perror ("Error opening " GRUBENV " for writing"); ++ perror ("Error fdopen of tmpfile failed"); ++ unlink(tmp_filename); + return 1; + } + + ret = fwrite (env, 1, GRUBENV_SIZE, f); + if (ret != GRUBENV_SIZE) + { +- perror ("Error writing to " GRUBENV); ++ perror ("Error writing tmpfile"); ++ unlink(tmp_filename); + return 1; + } + + ret = fflush (f); + if (ret) + { +- perror ("Error flushing " GRUBENV); ++ perror ("Error flushing tmpfile"); ++ unlink(tmp_filename); + return 1; + } + +- fsync (fileno (f)); +- fclose (f); ++ ret = fsync (fileno (f)); ++ if (ret) ++ { ++ perror ("Error syncing tmpfile"); ++ unlink(tmp_filename); ++ return 1; ++ } ++ ++ ret = fclose (f); ++ if (ret) ++ { ++ perror ("Error closing tmpfile"); ++ unlink(tmp_filename); ++ return 1; ++ } ++ ++ /* ++ * And finally rename the tmpfile with the new env over the old env, the ++ * linux kernel guarantees that this is atomic (from a syscall pov). ++ */ ++ ret = rename(tmp_filename, env_filename); ++ if (ret) ++ { ++ perror ("Error renaming tmpfile to " GRUBENV " failed"); ++ unlink(tmp_filename); ++ return 1; ++ } + + return 0; + } diff --git a/grub.patches b/grub.patches index c5a3b8dc..1b8f6e94 100644 --- a/grub.patches +++ b/grub.patches @@ -187,3 +187,5 @@ Patch0186: 0186-grub-core-loader-efi-fdt.c-Do-not-copy-random-memory.patch Patch0187: 0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch Patch0188: 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch Patch0189: 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch +Patch0190: 0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch +Patch0191: 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch diff --git a/grub2.spec b/grub2.spec index ca2b4d28..da1834ec 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 101%{?dist} +Release: 102%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,11 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Tue Nov 26 2019 Javier Martinez Canillas - 2.02-102 +- grub-set-bootflag: Write new env to tmpfile and then rename (hdegoede) + Resolves: CVE-2019-14865 + Resolves: rhbz#1776580 + * Wed Oct 16 2019 Javier Martinez Canillas - 2.02-101 - 99-grub-mkconfig: Also disable BLS usage for Xen Dom0 hosts Resolves: rhbz#1761799 From e06b103d4c3ce6b7ff6f1c7d8e85cc57c3226f05 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 27 Nov 2019 14:47:11 +0100 Subject: [PATCH 07/16] Fix a grub hidden-menu regression and a bug in blscfg variable expansion Signed-off-by: Javier Martinez Canillas --- ...ce-char-when-appending-fields-for-va.patch | 51 +++++++++++++ ...indeterminate-getting-set-on-boot_su.patch | 75 +++++++++++++++++++ grub.patches | 2 + grub2.spec | 6 +- 4 files changed, 133 insertions(+), 1 deletion(-) create mode 100644 0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch create mode 100644 0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch diff --git a/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch b/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch new file mode 100644 index 00000000..b1149bb7 --- /dev/null +++ b/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch @@ -0,0 +1,51 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 26 Nov 2019 09:51:41 +0100 +Subject: [PATCH] blscfg: add a space char when appending fields for variable + expansion + +The GRUB variables are expanded and replaced by their values before adding +menu entries, but they didn't include space characters after the values so +the result was not correct. + +For the common case this wasn't a problem but it is if there are variables +that are part of the values of other variables. + +Resolves: rhbz#1669252 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 8c6dd91be10..f1dc1f8e808 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -602,17 +602,16 @@ static char *field_append(bool is_var, char *buffer, char *start, char *end) + return buffer; + } + +- if (!buffer) { +- buffer = grub_strdup(field); +- if (!buffer) +- return NULL; +- } else { +- buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field)); +- if (!buffer) +- return NULL; ++ if (!buffer) ++ buffer = grub_zalloc (grub_strlen(field) + 1); ++ else ++ buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field) + 1); + +- grub_stpcpy (buffer + grub_strlen(buffer), field); +- } ++ if (!buffer) ++ return NULL; ++ ++ grub_stpcpy (buffer + grub_strlen(buffer), field); ++ grub_stpcpy (buffer + grub_strlen(buffer), " "); + + return buffer; + } diff --git a/0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch new file mode 100644 index 00000000..54b73e6c --- /dev/null +++ b/0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch @@ -0,0 +1,75 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 26 Nov 2019 09:51:41 +0100 +Subject: [PATCH] grub.d: Fix boot_indeterminate getting set on boot_success=0 + boot + +The "grub.d: Split out boot success reset from menu auto hide script" +not only moved the code to clear boot_success and boot_indeterminate +but for some reason also mixed in some broken changes to the +boot_indeterminate handling. + +The boot_indeterminate var is meant to suppress the boot menu after +a reboot from either a selinux-relabel or offline-updates. These +2 special boot scenarios do not set boot_success since there is no +successfull interaction with the user. Instead they increment +boot_indeterminate, and if it is 1 and only when it is 1, so the +first reboot after a "special" boot we suppress the menu. + +To ensure that we do show the menu if we somehow get stuck in a +"special" boot loop where we do special-boots without them +incrementing boot_indeterminate, the code before the +"grub.d: Split out boot success reset from menu auto hide script" +commit would increment boot_indeterminate once when it is 1, so that +even if the "special" boot reboot-loop immediately we would show the +menu on the next boot. + +That commit broke this however, because it not only moves the code, +it also changes it from only "incrementing" boot_indeterminate once to +always incrementing it, except when boot_success == 1 (and we reset it). + +This broken behavior causes the following problem: + +1. Boot a broken kernel, system hangs, power-cycle +2. boot_success now != 1, so we increment boot_indeterminate from 0 + (unset!) to 1. User either simply tries again, or makes some changes + but the end-result still is a system hang, power-cycle +3. Now boot_indeterminate==1 so we do not show the menu even though the + previous boot failed -> BAD + +This commit fixes this by restoring the behavior of setting +boot_indeterminate to 2 when it was 1 before. + +Fixes: "grub.d: Split out boot success reset from menu auto hide script" +Signed-off-by: Hans de Goede +--- + util/grub.d/10_reset_boot_success.in | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/util/grub.d/10_reset_boot_success.in b/util/grub.d/10_reset_boot_success.in +index 6c88d933dde..737e1ae5b68 100644 +--- a/util/grub.d/10_reset_boot_success.in ++++ b/util/grub.d/10_reset_boot_success.in +@@ -6,18 +6,18 @@ + # + # The boot_success var needs to be set to 1 from userspace to mark a boot successful. + cat << EOF +-insmod increment + # Hiding the menu is ok if last boot was ok or if this is a first boot attempt to boot the entry + if [ "\${boot_success}" = "1" -o "\${boot_indeterminate}" = "1" ]; then + set menu_hide_ok=1 + else + set menu_hide_ok=0 + fi +-# Reset boot_indeterminate after a successful boot, increment otherwise ++# Reset boot_indeterminate after a successful boot + if [ "\${boot_success}" = "1" ] ; then + set boot_indeterminate=0 +-else +- increment boot_indeterminate ++# Avoid boot_indeterminate causing the menu to be hidden more then once ++elif [ "\${boot_indeterminate}" = "1" ]; then ++ set boot_indeterminate=2 + fi + # Reset boot_success for current boot + set boot_success=0 diff --git a/grub.patches b/grub.patches index 1b8f6e94..1766e772 100644 --- a/grub.patches +++ b/grub.patches @@ -189,3 +189,5 @@ Patch0188: 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch Patch0189: 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch Patch0190: 0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch Patch0191: 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch +Patch0192: 0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch +Patch0193: 0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch diff --git a/grub2.spec b/grub2.spec index da1834ec..c4e7f3e2 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 102%{?dist} +Release: 103%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Wed Nov 27 2019 Javier Martinez Canillas - 2.02-103 +- blscfg: add a space char when appending fields for variable expansion +- grub.d: Fix boot_indeterminate getting set on boot_success=0 boot + * Tue Nov 26 2019 Javier Martinez Canillas - 2.02-102 - grub-set-bootflag: Write new env to tmpfile and then rename (hdegoede) Resolves: CVE-2019-14865 From 2f9c93646402883d12c622031d2adb695503e37c Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 5 Dec 2019 10:49:08 +0100 Subject: [PATCH 08/16] Drop patch fixing a corner case in BLS variable expansion There is a bug reported about a system failing to boot with the latest pkg and the only relevant change was this patch. Drop it just to be sure since it is fixing a corner case in variable expansion so is not worth the risk. Related: rhbz#1779611 Signed-off-by: Javier Martinez Canillas --- ...ce-char-when-appending-fields-for-va.patch | 51 ------------------- ...indeterminate-getting-set-on-boot_su.patch | 0 grub.patches | 3 +- grub2.spec | 6 ++- 4 files changed, 6 insertions(+), 54 deletions(-) delete mode 100644 0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch rename 0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch => 0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch (100%) diff --git a/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch b/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch deleted file mode 100644 index b1149bb7..00000000 --- a/0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas -Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH] blscfg: add a space char when appending fields for variable - expansion - -The GRUB variables are expanded and replaced by their values before adding -menu entries, but they didn't include space characters after the values so -the result was not correct. - -For the common case this wasn't a problem but it is if there are variables -that are part of the values of other variables. - -Resolves: rhbz#1669252 - -Signed-off-by: Javier Martinez Canillas ---- - grub-core/commands/blscfg.c | 19 +++++++++---------- - 1 file changed, 9 insertions(+), 10 deletions(-) - -diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c -index 8c6dd91be10..f1dc1f8e808 100644 ---- a/grub-core/commands/blscfg.c -+++ b/grub-core/commands/blscfg.c -@@ -602,17 +602,16 @@ static char *field_append(bool is_var, char *buffer, char *start, char *end) - return buffer; - } - -- if (!buffer) { -- buffer = grub_strdup(field); -- if (!buffer) -- return NULL; -- } else { -- buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field)); -- if (!buffer) -- return NULL; -+ if (!buffer) -+ buffer = grub_zalloc (grub_strlen(field) + 1); -+ else -+ buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field) + 1); - -- grub_stpcpy (buffer + grub_strlen(buffer), field); -- } -+ if (!buffer) -+ return NULL; -+ -+ grub_stpcpy (buffer + grub_strlen(buffer), field); -+ grub_stpcpy (buffer + grub_strlen(buffer), " "); - - return buffer; - } diff --git a/0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch similarity index 100% rename from 0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch rename to 0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch diff --git a/grub.patches b/grub.patches index 1766e772..12bdd6ca 100644 --- a/grub.patches +++ b/grub.patches @@ -189,5 +189,4 @@ Patch0188: 0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch Patch0189: 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch Patch0190: 0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch Patch0191: 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch -Patch0192: 0192-blscfg-add-a-space-char-when-appending-fields-for-va.patch -Patch0193: 0193-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch +Patch0192: 0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch diff --git a/grub2.spec b/grub2.spec index c4e7f3e2..1773b97f 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 103%{?dist} +Release: 104%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Thu Dec 05 2019 Javier Martinez Canillas - 2.02-104 +- Drop patch fixing a corner case in BLS variable expansion + Related: rhbz#1779611 + * Wed Nov 27 2019 Javier Martinez Canillas - 2.02-103 - blscfg: add a space char when appending fields for variable expansion - grub.d: Fix boot_indeterminate getting set on boot_success=0 boot From c9aee967d689485674db1c7722fdb66cb38a56d1 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 13 Jan 2020 17:57:28 +0100 Subject: [PATCH 09/16] Make blscfg to support the GRUB_{SAVEDEFAULT,CMDLINE_LINUX_DEFAULT} options These two options were not supported on a BLS configuration. Resolves: rhbz#1704926 Signed-off-by: Javier Martinez Canillas --- ...-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch | 45 +++++++++++++++++ 0194-Fix-savedefault-with-blscfg.patch | 50 +++++++++++++++++++ grub.patches | 2 + grub2.spec | 7 ++- 4 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch create mode 100644 0194-Fix-savedefault-with-blscfg.patch diff --git a/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch new file mode 100644 index 00000000..d6e4756f --- /dev/null +++ b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 15 Oct 2019 09:08:25 +0200 +Subject: [PATCH] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set + kernelopts + +The GRUB documentation mentions that there are two variables to set the +linux kernel cmdline: GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT. + +The former is added to all the menuentry commands and the latter is not +added to the recovery mode menu entries. But the blscfg module doesn't +populate recovery entries from the BLS snippets, so the values set in the +GRUB_CMDLINE_LINUX_DEFAULT variable should also be included in kernelopts. + +This is needed because the GRUB_CMDLINE_LINUX_DEFAULT option is mentioned +in the GRUB documentation so users assume that the kernel cmdline options +can be changed by setting this option and running the grub2-mkconfig tool. + +Signed-off-by: Javier Martinez Canillas +--- + util/grub.d/10_linux.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 3919b8aff4e..9e015c2c134 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -118,7 +118,7 @@ if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]; then + populate_header_warn + + cat << EOF +-set default_kernelopts="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX}" ++set default_kernelopts="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" + + insmod blscfg + blscfg +@@ -134,7 +134,7 @@ EOF + fi + fi + +- ${grub_editenv} - set kernelopts="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX}" ++ ${grub_editenv} - set kernelopts="root=${LINUX_ROOT_DEVICE} ro ${GRUB_CMDLINE_LINUX} ${GRUB_CMDLINE_LINUX_DEFAULT}" + if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then + ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}" + fi diff --git a/0194-Fix-savedefault-with-blscfg.patch b/0194-Fix-savedefault-with-blscfg.patch new file mode 100644 index 00000000..ec0d52a5 --- /dev/null +++ b/0194-Fix-savedefault-with-blscfg.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Fritz Elfert +Date: Sun, 12 Jan 2020 22:07:52 +0100 +Subject: [PATCH] Fix savedefault with blscfg + +The GRUB_SAVEDEFAULT option was ignored on a BLS configuration. Fix it by +making the menu entries populated from the BLS files to call savedefault +if a save_default environment variable has been set to "true". + +This variable is set by grub2-mkconfig to the value in GRUB_SAVEDEFAULT. +--- + grub-core/commands/blscfg.c | 5 ++++- + util/grub.d/10_linux.in | 4 ++++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 8c6dd91be10..f2c1fd0733d 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -821,11 +821,14 @@ static void create_entry (struct bls_entry *entry) + tmp = grub_stpcpy (tmp, "\n"); + } + +- src = grub_xasprintf ("load_video\n" ++ const char *sdval = grub_env_get("save_default"); ++ bool savedefault = ((NULL != sdval) && (grub_strcmp(sdval, "true") == 0)); ++ src = grub_xasprintf ("%sload_video\n" + "set gfxpayload=keep\n" + "insmod gzio\n" + "linux %s%s%s%s\n" + "%s", ++ savedefault ? "savedefault\n" : "", + GRUB_BOOT_DEVICE, clinux, options ? " " : "", options ? options : "", + initrd ? initrd : ""); + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 9e015c2c134..d5319300e04 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -138,6 +138,10 @@ EOF + if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then + ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}" + fi ++ ++ if [ -n "${GRUB_SAVEDEFAULT}" ]; then ++ ${grub_editenv} - set save_default="${GRUB_SAVEDEFAULT}" ++ fi + fi + + exit 0 diff --git a/grub.patches b/grub.patches index 12bdd6ca..5c2527aa 100644 --- a/grub.patches +++ b/grub.patches @@ -190,3 +190,5 @@ Patch0189: 0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch Patch0190: 0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch Patch0191: 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch Patch0192: 0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch +Patch0193: 0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch +Patch0194: 0194-Fix-savedefault-with-blscfg.patch diff --git a/grub2.spec b/grub2.spec index 1773b97f..2e2917ae 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 104%{?dist} +Release: 105%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,11 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Mon Jan 13 2020 Javier Martinez Canillas - 2.02-105 +- 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set kernelopts +- Make the blscfg module honour the GRUB_SAVEDEFAULT option + Resolves: rhbz#1704926 + * Thu Dec 05 2019 Javier Martinez Canillas - 2.02-104 - Drop patch fixing a corner case in BLS variable expansion Related: rhbz#1779611 From 749be472a65d1a7516662ae4633d2f5a4d9ee4c5 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 17 Mar 2020 12:37:40 +0100 Subject: [PATCH 10/16] Fix menu entries having an unneeded initrd command and other BLS fixes Resolves: rhbz#1806022 Signed-off-by: Javier Martinez Canillas --- ...ce-char-when-appending-fields-for-va.patch | 76 +++++++++++++++++++ ...rt-for-sorting-the-plus-higher-than-.patch | 59 ++++++++++++++ ...e-the-root-variable-to-search-for-BL.patch | 47 ++++++++++++ ...LL-instead-of-a-zero-length-array-in.patch | 38 ++++++++++ grub.patches | 4 + grub2.spec | 6 +- 6 files changed, 229 insertions(+), 1 deletion(-) create mode 100644 0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch create mode 100644 0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch create mode 100644 0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch create mode 100644 0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch diff --git a/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch new file mode 100644 index 00000000..1dc9f6b7 --- /dev/null +++ b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch @@ -0,0 +1,76 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 26 Nov 2019 09:51:41 +0100 +Subject: [PATCH] blscfg: add a space char when appending fields for variable + expansion + +The GRUB variables are expanded and replaced by their values before adding +menu entries, but they didn't include space characters after the values so +the result was not correct. + +For the common case this wasn't a problem but it is if there are variables +that are part of the values of other variables. + +Resolves: rhbz#1669252 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 31 ++++++++++++++++++------------- + 1 file changed, 18 insertions(+), 13 deletions(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index f2c1fd0733d..1504be30e8e 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -593,26 +593,29 @@ static char **bls_make_list (struct bls_entry *entry, const char *key, int *num) + + static char *field_append(bool is_var, char *buffer, char *start, char *end) + { +- char *temp = grub_strndup(start, end - start + 1); +- const char *field = temp; ++ char *tmp = grub_strndup(start, end - start + 1); ++ const char *field = tmp; ++ int term = is_var ? 2 : 1; + + if (is_var) { +- field = grub_env_get (temp); ++ field = grub_env_get (tmp); + if (!field) + return buffer; + } + +- if (!buffer) { +- buffer = grub_strdup(field); +- if (!buffer) +- return NULL; +- } else { +- buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field)); +- if (!buffer) +- return NULL; ++ if (!buffer) ++ buffer = grub_zalloc (grub_strlen(field) + term); ++ else ++ buffer = grub_realloc (buffer, grub_strlen(buffer) + grub_strlen(field) + term); + +- grub_stpcpy (buffer + grub_strlen(buffer), field); +- } ++ if (!buffer) ++ return NULL; ++ ++ tmp = buffer + grub_strlen(buffer); ++ tmp = grub_stpcpy (tmp, field); ++ ++ if (is_var) ++ tmp = grub_stpcpy (tmp, " "); + + return buffer; + } +@@ -642,6 +645,8 @@ static char *expand_val(char *value) + buffer = field_append(is_var, buffer, start, end); + is_var = false; + start = value; ++ if (*start == ' ') ++ start++; + } + } + diff --git a/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch new file mode 100644 index 00000000..1d19216e --- /dev/null +++ b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch @@ -0,0 +1,59 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 4 Nov 2019 17:33:30 +0100 +Subject: [PATCH] blscfg: Add support for sorting the plus ('+') higher than + base version + +Handle plus separator. Concept is the same as tilde, except that if one of +the strings ends (base version), the other is considered as higher version. + +A plus character is used for example by the Linux kernel build system to +denote that is the base version plus some changes on top of it. + +Currently for example rpmvercmp("5.3.0", "5.3.0+") will return 0 even when +the two versions are not the same. + +Resolves: rhbz#1767395 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 1504be30e8e..286a5b88d12 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -163,8 +163,8 @@ static int vercmp(const char * a, const char * b) + + /* loop through each version segment of str1 and str2 and compare them */ + while (*one || *two) { +- while (*one && !grub_isalnum(*one) && *one != '~') one++; +- while (*two && !grub_isalnum(*two) && *two != '~') two++; ++ while (*one && !grub_isalnum(*one) && *one != '~' && *one != '+') one++; ++ while (*two && !grub_isalnum(*two) && *two != '~' && *two != '+') two++; + + /* handle the tilde separator, it sorts before everything else */ + if (*one == '~' || *two == '~') { +@@ -175,6 +175,21 @@ static int vercmp(const char * a, const char * b) + continue; + } + ++ /* ++ * Handle plus separator. Concept is the same as tilde, ++ * except that if one of the strings ends (base version), ++ * the other is considered as higher version. ++ */ ++ if (*one == '+' || *two == '+') { ++ if (!*one) return -1; ++ if (!*two) return 1; ++ if (*one != '+') goto_return (1); ++ if (*two != '+') goto_return (-1); ++ one++; ++ two++; ++ continue; ++ } ++ + /* If we ran to the end of either, we are finished with the loop */ + if (!(*one && *two)) break; + diff --git a/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch new file mode 100644 index 00000000..b1481b96 --- /dev/null +++ b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 14 Jan 2020 17:41:29 +0100 +Subject: [PATCH] blscfg: Always use the root variable to search for BLS + snippets + +The boot and root variables are set by grub2-mkconfig to tell GRUB what +are the devices and partitions used as the EFI System Partition (ESP) +and to store the /boot directory (or used as the /boot mount point). + +But the boot variable is not needed anymore, this was added because the +blscfg module used to search for the BLS snippets in the ESP, but was +later changed to always search for the BLS files in /boot even for EFI. + +When doing that change, the logic was made backwards and so the boot +variable is wrongly used for legacy BIOS. This only works because this +is set to the same value as the root variable. + +So the correct thing to do is to always use the root variable to search +the BLS snippets, since that is set to the partition that stores them. + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 286a5b88d12..aa4e624905e 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -968,14 +968,12 @@ bls_load_entries (const char *path) + if (!devid) { + #ifdef GRUB_MACHINE_EMU + devid = "host"; +-#elif defined(GRUB_MACHINE_EFI) ++#else + devid = grub_env_get ("root"); +-#else +- devid = grub_env_get ("boot"); + #endif + if (!devid) + return grub_error (GRUB_ERR_FILE_NOT_FOUND, +- N_("variable `%s' isn't set"), "boot"); ++ N_("variable `%s' isn't set"), "root"); + } + + grub_dprintf ("blscfg", "opening %s\n", devid); diff --git a/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch new file mode 100644 index 00000000..46ab032c --- /dev/null +++ b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 16 Mar 2020 13:51:45 +0100 +Subject: [PATCH] blscfg: return NULL instead of a zero-length array in + bls_make_list() + +The bls_make_list() function returns a list of all the values for a given +key and if there is none a NULL pointer should be returned. But currently +is returnin a zero-length array instead. + +This makes the callers to wrongly assume that there are values for a key +and populate wrong menu entries. For example menu entries are populated +with an initrd command even if there is no initrd fiel in the BLS file. + +Resolves: rhbz#1806022 + +Signed-off-by: Javier Martinez Canillas +--- + grub-core/commands/blscfg.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index aa4e624905e..df6947f58cd 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -600,6 +600,12 @@ static char **bls_make_list (struct bls_entry *entry, const char *key, int *num) + list[nlist] = NULL; + } + ++ if (!nlist) ++ { ++ grub_free (list); ++ return NULL; ++ } ++ + if (num) + *num = nlist; + diff --git a/grub.patches b/grub.patches index 5c2527aa..9fad7bea 100644 --- a/grub.patches +++ b/grub.patches @@ -192,3 +192,7 @@ Patch0191: 0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch Patch0192: 0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch Patch0193: 0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch Patch0194: 0194-Fix-savedefault-with-blscfg.patch +Patch0195: 0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch +Patch0196: 0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch +Patch0197: 0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch +Patch0198: 0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch diff --git a/grub2.spec b/grub2.spec index 2e2917ae..2edc0efa 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 105%{?dist} +Release: 106%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Tue Mar 17 2020 Javier Martinez Canillas - 2.02-106 +- Fix menu entries having an unneeded initrd command and other BLS fixes + Resolves: rhbz#1806022 + * Mon Jan 13 2020 Javier Martinez Canillas - 2.02-105 - 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set kernelopts - Make the blscfg module honour the GRUB_SAVEDEFAULT option From 0f180aa21fb9ea4f3956a0591693944f9f1860a5 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 2 Apr 2020 17:39:06 +0200 Subject: [PATCH 11/16] grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree systems Related: rhbz#1751272 Signed-off-by: Javier Martinez Canillas --- ...lscfg-Update-grub2-binary-in-ESP-for.patch | 37 +++++++++++++++++++ ...lscfg-Only-mark-GRUB-as-BLS-supporte.patch | 37 +++++++++++++++++++ grub.patches | 2 + grub2.spec | 6 ++- 4 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch create mode 100644 0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch diff --git a/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch new file mode 100644 index 00000000..5993a6ba --- /dev/null +++ b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Thu, 26 Mar 2020 15:08:30 +0100 +Subject: [PATCH] grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree + systems + +The grub2 EFI binary in the ESP isn't updated as a part of an OSTree update +transaction. So let's make the script to update this and also create a file +to indicate that the installed version has support for the blscfg module. + +Related: rhbz#1751272 + +Signed-off-by: Javier Martinez Canillas +--- + util/grub-switch-to-blscfg.in | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/util/grub-switch-to-blscfg.in b/util/grub-switch-to-blscfg.in +index 49b3985fadb..a05a8d98554 100644 +--- a/util/grub-switch-to-blscfg.in ++++ b/util/grub-switch-to-blscfg.in +@@ -266,6 +266,15 @@ copy_bls() { + fi + } + ++# The grub2 EFI binary is not copied to the ESP as a part of an ostree ++# transaction. Make sure a grub2 version with BLS support is installed. ++if test -f /run/ostree-booted && test -d /sys/firmware/efi/efivars/; then ++ grub_binary="$(find /usr/lib/ostree-boot/efi/EFI/${EFIDIR}/ -name grub*.efi)" ++ cp ${grub_binary} ${grubdir} || exit 1 ++ # Create a hidden file to indicate that grub2 now has BLS support. ++ touch /boot/grub2/.grub2-blscfg-supported ++fi ++ + GENERATE=0 + if grep '^GRUB_ENABLE_BLSCFG=.*' "${etcdefaultgrub}" \ + | grep -vq '^GRUB_ENABLE_BLSCFG="*true"*\s*$' ; then diff --git a/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch new file mode 100644 index 00000000..27ef6e0a --- /dev/null +++ b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Thu, 2 Apr 2020 11:07:24 +0200 +Subject: [PATCH] grub-switch-to-blscfg: Only mark GRUB as BLS supported if + blsdir isn't set + +If the user set the blsdir environemnt variable to a path that is not the +default where ostree writes the BLS snippets, the blscfg module won't be +able to parse them and can lead to not having any menu entries on boot. + +So to minimize the risk of things going wrong when dropping the 15_ostree +script used by ostree to create the menu entries, only mark the bootloader +as BLS supported if the blsdir variable has not been set. + +Signed-off-by: Javier Martinez Canillas +--- + util/grub-switch-to-blscfg.in | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/util/grub-switch-to-blscfg.in b/util/grub-switch-to-blscfg.in +index a05a8d98554..4bbed8e4fe9 100644 +--- a/util/grub-switch-to-blscfg.in ++++ b/util/grub-switch-to-blscfg.in +@@ -267,8 +267,11 @@ copy_bls() { + } + + # The grub2 EFI binary is not copied to the ESP as a part of an ostree +-# transaction. Make sure a grub2 version with BLS support is installed. +-if test -f /run/ostree-booted && test -d /sys/firmware/efi/efivars/; then ++# transaction. Make sure a grub2 version with BLS support is installed ++# but only do this if the blsdir is not set, to make sure that the BLS ++# parsing module will search for the BLS snippets in the default path. ++if test -f /run/ostree-booted && test -d /sys/firmware/efi/efivars && \ ++ ! ${grub_editenv} - list | grep -q blsdir; then + grub_binary="$(find /usr/lib/ostree-boot/efi/EFI/${EFIDIR}/ -name grub*.efi)" + cp ${grub_binary} ${grubdir} || exit 1 + # Create a hidden file to indicate that grub2 now has BLS support. diff --git a/grub.patches b/grub.patches index 9fad7bea..f5ee2178 100644 --- a/grub.patches +++ b/grub.patches @@ -196,3 +196,5 @@ Patch0195: 0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch Patch0196: 0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch Patch0197: 0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch Patch0198: 0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch +Patch0199: 0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch +Patch0200: 0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch diff --git a/grub2.spec b/grub2.spec index 2edc0efa..bb761cbf 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 106%{?dist} +Release: 107%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,10 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Thu Apr 02 2020 Javier Martinez Canillas - 2.02-107 +- grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree systems + Related: rhbz#1751272 + * Tue Mar 17 2020 Javier Martinez Canillas - 2.02-106 - Fix menu entries having an unneeded initrd command and other BLS fixes Resolves: rhbz#1806022 From 8f3ba95cfdf7446a31443b9e28ba877555a588b0 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 16 Apr 2020 22:07:58 +0200 Subject: [PATCH 12/16] Make the grub-switch-to-blscfg and 10_linux scripts more robust Signed-off-by: Javier Martinez Canillas --- ...lscfg-Use-install-to-copy-GRUB-binar.patch | 46 +++++++++++++++++++ ...le-BLS-configuration-if-new-kernel-p.patch | 39 ++++++++++++++++ grub.patches | 2 + grub2.spec | 5 +- 4 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch create mode 100644 0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch diff --git a/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch new file mode 100644 index 00000000..c131a7f6 --- /dev/null +++ b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Thu, 16 Apr 2020 18:53:03 +0200 +Subject: [PATCH] grub-switch-to-blscfg: Use install to copy GRUB binary, + modules and config + +By default the cp command truncates the destination before copying from the +source, so if interrupted it can lead to a file that's half written. + +This behavior can be modified using the --remove-destination option, but is +usually a better choice to use the install tool for this. So let's do that. + +Signed-off-by: Javier Martinez Canillas +--- + util/grub-switch-to-blscfg.in | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/util/grub-switch-to-blscfg.in b/util/grub-switch-to-blscfg.in +index 4bbed8e4fe9..3333a620c28 100644 +--- a/util/grub-switch-to-blscfg.in ++++ b/util/grub-switch-to-blscfg.in +@@ -273,7 +273,7 @@ copy_bls() { + if test -f /run/ostree-booted && test -d /sys/firmware/efi/efivars && \ + ! ${grub_editenv} - list | grep -q blsdir; then + grub_binary="$(find /usr/lib/ostree-boot/efi/EFI/${EFIDIR}/ -name grub*.efi)" +- cp ${grub_binary} ${grubdir} || exit 1 ++ install -m 700 ${grub_binary} ${grubdir} || exit 1 + # Create a hidden file to indicate that grub2 now has BLS support. + touch /boot/grub2/.grub2-blscfg-supported + fi +@@ -307,13 +307,13 @@ if [ "${GENERATE}" -eq 1 ] ; then + + if [ -n "${mod_dir}" ]; then + for mod in blscfg increment; do +- cp ${prefix}/lib/grub/${mod_dir}/${mod}.mod ${grubdir}/$mod_dir/ || exit 1 ++ install -m 700 ${prefix}/lib/grub/${mod_dir}/${mod}.mod ${grubdir}/$mod_dir/ || exit 1 + done + fi + + cp -af "${GRUB_CONFIG_FILE}" "${GRUB_CONFIG_FILE}${backupsuffix}" + if ! grub2-mkconfig -o "${GRUB_CONFIG_FILE}" ; then +- cp -af "${GRUB_CONFIG_FILE}${backupsuffix}" "${GRUB_CONFIG_FILE}" ++ install -m 700 "${GRUB_CONFIG_FILE}${backupsuffix}" "${GRUB_CONFIG_FILE}" + sed -i"${backupsuffix}" \ + -e 's,^GRUB_ENABLE_BLSCFG=.*,GRUB_ENABLE_BLSCFG=false,' \ + "${etcdefaultgrub}" diff --git a/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch new file mode 100644 index 00000000..985c5ba3 --- /dev/null +++ b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch @@ -0,0 +1,39 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Thu, 16 Apr 2020 21:11:04 +0200 +Subject: [PATCH] 10_linux.in: Enable BLS configuration if new-kernel-pkg isn't + present + +Currently if the the GRUB_ENABLE_BLSCFG option in /etc/default/grub hasn't +been set, the 10_linux script will generate a GRUB configuration that does +not include the blscfg command to populate the menu entries from BLS files. + +But on kernel install the /usr/lib/kernel/install.d/20-grub.install script +will only add menuentry commands to the GRUB config file if the old grubby +tool and new-kernel-pkg script are installed. + +So a configuration with the GRUB_ENABLE_BLSCFG option will lead to a setup +where new kernel entries are not added. Make a BLS config the default if +that option wasn't set and the new-kernel-pkg script is not present. + +Signed-off-by: Javier Martinez Canillas +--- + util/grub.d/10_linux.in | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index d5319300e04..b99eaa8f203 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -96,6 +96,11 @@ cat < /dev/null)" ]; then ++ GRUB_ENABLE_BLSCFG="true" ++fi ++ + if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]; then + if [ x$dirname = x/ ]; then + if [ -z "${prepare_root_cache}" ]; then diff --git a/grub.patches b/grub.patches index f5ee2178..9292d462 100644 --- a/grub.patches +++ b/grub.patches @@ -198,3 +198,5 @@ Patch0197: 0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch Patch0198: 0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch Patch0199: 0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch Patch0200: 0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch +Patch0201: 0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch +Patch0202: 0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch diff --git a/grub2.spec b/grub2.spec index bb761cbf..4b0c1f7d 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 107%{?dist} +Release: 108%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,9 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Thu Apr 16 2020 Javier Martinez Canillas - 2.02-108 +- Make the grub-switch-to-blscfg and 10_linux scripts more robust + * Thu Apr 02 2020 Javier Martinez Canillas - 2.02-107 - grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree systems Related: rhbz#1751272 From 5a7483337e3a14d0456050e8a25b20b9155a43e0 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 12 May 2020 18:26:52 +0200 Subject: [PATCH 13/16] Fix grub2-editenv segfault when attempting to shrink a variable Signed-off-by: Javier Martinez Canillas --- ...r-overrun-when-attempting-to-shrink-.patch | 60 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 +- 3 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch diff --git a/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch new file mode 100644 index 00000000..09d378f2 --- /dev/null +++ b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch @@ -0,0 +1,60 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 12 May 2020 01:00:51 +0200 +Subject: [PATCH] envblk: Fix buffer overrun when attempting to shrink a + variable value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If an existing variable is set with a value whose length is smaller than +the current value, a memory corruption can happen due copying padding '#' +characters outside of the environment block buffer. + +This is caused by a wrong calculation of the previous free space position +after moving backward the characters that followed the old variable value. + +That position is calculated to fill the remaining of the buffer with the +padding '#' characters. But since isn't calculated correctly, it can lead +to copies outside of the buffer. + +The issue can be reproduced by creating a variable with a large value and +then try to set a new value that is much smaller: + +$ grub2-editenv --version +grub2-editenv (GRUB) 2.04 + +$ grub2-editenv env create + +$ grub2-editenv env set a="$(for i in {1..500}; do var="b$var"; done; echo $var)" + +$ wc -c env +1024 grubenv + +$ grub2-editenv env set a="$(for i in {1..50}; do var="b$var"; done; echo $var)" +malloc(): corrupted top size +Aborted (core dumped) + +$ wc -c env +0 grubenv + +Reported-by: Renaud Métrich +Signed-off-by: Javier Martinez Canillas +Patch-cc: Daniel Kiper +--- + grub-core/lib/envblk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/lib/envblk.c b/grub-core/lib/envblk.c +index f89d86d4e8d..874506da169 100644 +--- a/grub-core/lib/envblk.c ++++ b/grub-core/lib/envblk.c +@@ -143,7 +143,7 @@ grub_envblk_set (grub_envblk_t envblk, const char *name, const char *value) + /* Move the following characters backward, and fill the new + space with harmless characters. */ + grub_memmove (p + vl, p + len, pend - (p + len)); +- grub_memset (space + len - vl, '#', len - vl); ++ grub_memset (space - (len - vl), '#', len - vl); + } + else + /* Move the following characters forward. */ diff --git a/grub.patches b/grub.patches index 9292d462..02c0a522 100644 --- a/grub.patches +++ b/grub.patches @@ -200,3 +200,4 @@ Patch0199: 0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch Patch0200: 0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch Patch0201: 0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch Patch0202: 0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch +Patch0203: 0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch diff --git a/grub2.spec b/grub2.spec index 4b0c1f7d..3ce46c71 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 108%{?dist} +Release: 109%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,9 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Tue May 12 2020 Javier Martinez Canillas - 2.02-109 +- Fix grub2-editenv segfault when attempting to shrink a variable + * Thu Apr 16 2020 Javier Martinez Canillas - 2.02-108 - Make the grub-switch-to-blscfg and 10_linux scripts more robust From 3b94406a9e7e5715a6af5d12fa268e435e862218 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 29 Jul 2020 13:39:24 -0400 Subject: [PATCH 14/16] "Minor" bug fixes CVE-2020-10713 CVE-2020-14308 CVE-2020-14309 CVE-2020-14310 CVE-2020-14311 CVE-2020-15705 CVE-2020-15706 CVE-2020-15707 Signed-off-by: Peter Jones --- ...t-break-FDT-extra-allocation-space-o.patch | 9 +- ...s-option-to-menu-entries-generated-f.patch | 9 +- ...ix-typo-for-gfxpayload-variable-name.patch | 7 +- ...g-Update-comment-about-running-as-ro.patch | 9 +- ...g-Write-new-env-to-tmpfile-and-then-.patch | 10 +- ...indeterminate-getting-set-on-boot_su.patch | 9 +- ...-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch | 9 +- 0194-Fix-savedefault-with-blscfg.patch | 7 +- ...ce-char-when-appending-fields-for-va.patch | 9 +- ...rt-for-sorting-the-plus-higher-than-.patch | 9 +- ...e-the-root-variable-to-search-for-BL.patch | 9 +- ...LL-instead-of-a-zero-length-array-in.patch | 7 +- ...lscfg-Update-grub2-binary-in-ESP-for.patch | 9 +- ...lscfg-Only-mark-GRUB-as-BLS-supporte.patch | 9 +- ...lscfg-Use-install-to-copy-GRUB-binar.patch | 9 +- ...le-BLS-configuration-if-new-kernel-p.patch | 9 +- ...r-overrun-when-attempting-to-shrink-.patch | 9 +- ...etree-command-when-Secure-Boot-is-en.patch | 75 + ...lexer-fatal-errors-actually-be-fatal.patch | 70 + ...e-arithmetic-primitives-that-check-f.patch | 127 ++ ...-we-always-have-an-overflow-checking.patch | 243 ++ 0208-calloc-Use-calloc-at-most-places.patch | 1957 +++++++++++++++++ ...low-checking-primitives-where-we-do-.patch | 1323 +++++++++++ ...on-t-leak-memory-on-realloc-failures.patch | 69 + ...-not-load-more-than-one-NAME-section.patch | 38 + ...fxmenu-Fix-double-free-in-load_image.patch | 36 + ...ree-in-grub_xnu_devprop_add_property.patch | 57 + ...sure-we-don-t-dereference-past-array.patch | 52 + 0215-term-Fix-overflow-on-user-inputs.patch | 66 + 0216-udf-Fix-memory-leak.patch | 56 + ...emory-leak-if-grub_create_loader_cmd.patch | 47 + 0218-tftp-Do-not-use-priority-queue.patch | 281 +++ ...in-address-for-mbi-allocation-to-0x1.patch | 48 + ...t-grub_relocator_alloc_chunk_addr-in.patch | 150 ++ ...t-grub_relocator_alloc_chunk_align-m.patch | 338 +++ ...used-fields-from-grub_script_functio.patch | 34 + ...se-after-free-when-redefining-a-func.patch | 108 + ...ub_relocator_alloc_chunk_align-top-m.patch | 46 + 0225-hfsplus-fix-two-more-overflows.patch | 57 + ...-potential-data-dependent-alloc-over.patch | 112 + 0227-emu-make-grub_free-NULL-safe.patch | 34 + ...formed-device-path-arithmetic-errors.patch | 252 +++ ...-caused-by-efi-fix-some-malformed-de.patch | 88 + ...x-use-after-free-in-halt-reboot-path.patch | 165 ++ ...p-fix-some-allocation-error-checking.patch | 40 + ...p-fix-some-allocation-error-checking.patch | 42 + ...g.c-fix-some-potential-allocation-ov.patch | 131 ++ ...integer-overflows-in-grub_cmd_initrd.patch | 51 + ...id-overflow-on-initrd-size-calculati.patch | 29 + ...rnel-validation-without-shim-protoco.patch | 101 + ...er-overflows-in-initrd-size-handling.patch | 169 ++ grub.patches | 34 + grub2.spec | 13 +- 53 files changed, 6638 insertions(+), 49 deletions(-) create mode 100644 0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch create mode 100644 0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch create mode 100644 0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch create mode 100644 0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch create mode 100644 0208-calloc-Use-calloc-at-most-places.patch create mode 100644 0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch create mode 100644 0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch create mode 100644 0211-font-Do-not-load-more-than-one-NAME-section.patch create mode 100644 0212-gfxmenu-Fix-double-free-in-load_image.patch create mode 100644 0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch create mode 100644 0214-lzma-Make-sure-we-don-t-dereference-past-array.patch create mode 100644 0215-term-Fix-overflow-on-user-inputs.patch create mode 100644 0216-udf-Fix-memory-leak.patch create mode 100644 0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch create mode 100644 0218-tftp-Do-not-use-priority-queue.patch create mode 100644 0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch create mode 100644 0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch create mode 100644 0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch create mode 100644 0222-script-Remove-unused-fields-from-grub_script_functio.patch create mode 100644 0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch create mode 100644 0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch create mode 100644 0225-hfsplus-fix-two-more-overflows.patch create mode 100644 0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch create mode 100644 0227-emu-make-grub_free-NULL-safe.patch create mode 100644 0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch create mode 100644 0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch create mode 100644 0230-efi-Fix-use-after-free-in-halt-reboot-path.patch create mode 100644 0231-efi-dhcp-fix-some-allocation-error-checking.patch create mode 100644 0232-efi-http-fix-some-allocation-error-checking.patch create mode 100644 0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch create mode 100644 0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch create mode 100644 0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch create mode 100644 0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch create mode 100644 0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch diff --git a/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch b/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch index 164de665..8f15f876 100644 --- a/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch +++ b/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 8ae9db92efe2ad02218a27d0a84261d26124af60 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 20 Jun 2019 16:21:48 +0100 -Subject: [PATCH] linux, efi, arm*, fdt: break FDT extra allocation space out - into a #define +Subject: [PATCH 187/237] linux, efi, arm*, fdt: break FDT extra allocation + space out into a #define A certain amount of dynamic space is required for the handover from GRUB/Linux-EFI-stub. This entails things like initrd addresses, @@ -46,3 +46,6 @@ index e34644631e1..2041341fd68 100644 #define FDT_MAGIC 0xD00DFEED typedef struct { +-- +2.26.2 + diff --git a/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch index d1366182..a3eb0991 100644 --- a/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch +++ b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 55ab66328a6c0142cf0944494101b704709b2df5 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Fri, 4 Oct 2019 16:43:05 +0200 -Subject: [PATCH] Don't add a class option to menu entries generated for - ppc64le +Subject: [PATCH 188/237] Don't add a class option to menu entries generated + for ppc64le For ppc64le a grub config file with menuentry commands is still generated even when BLS support is enabled. That's because BLS support was added to @@ -76,3 +76,6 @@ index 1b7536435f1..68fbedf2129 100644 menu="${menu}\t linux ${linux} ${options}\n" if [ -n "${initrd}" ] ; then menu="${menu}\t initrd ${boot_prefix}${initrd}\n" +-- +2.26.2 + diff --git a/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch index 5599fa1e..24144d98 100644 --- a/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch +++ b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch @@ -1,7 +1,7 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From dce8f564823148a4512e7f15dc97ae5640ed9d5b Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 16 Oct 2019 12:16:32 +0200 -Subject: [PATCH] blscfg: Fix typo for gfxpayload variable name +Subject: [PATCH 189/237] blscfg: Fix typo for gfxpayload variable name There was a silly typo when setting the environment variable gfxpayload so graphics mode wouldn't be preserved on some machines leading to text mode. @@ -26,3 +26,6 @@ index 26dbe873fe4..8c6dd91be10 100644 "insmod gzio\n" "linux %s%s%s%s\n" "%s", +-- +2.26.2 + diff --git a/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch index cd4ef775..fc1cf459 100644 --- a/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch +++ b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 2cf1cfd4a16b924afdccdb887663fb506f4a1885 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 12:15:43 +0100 -Subject: [PATCH] grub-set-bootflag: Update comment about running as root - through pkexec +Subject: [PATCH 190/237] grub-set-bootflag: Update comment about running as + root through pkexec We have stopped using pkexec for grub-set-bootflag, instead it is now installed suid root, update the comment accordingly. @@ -25,3 +25,6 @@ index 6a79ee67444..65d74ce010f 100644 * use any grub library / util functions to allow for easy auditing. * The grub headers are only included to get certain defines. */ +-- +2.26.2 + diff --git a/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch index 122bf686..82b3155b 100644 --- a/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch +++ b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch @@ -1,7 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 2b3341589cb47f35332332abeed1e5edcab1e4b3 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 13:02:01 +0100 -Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename +Subject: [PATCH 191/237] grub-set-bootflag: Write new env to tmpfile and then + rename Make the grubenv writing code in grub-set-bootflag more robust by writing the modified grubenv to a tmpfile first and then renaming the @@ -9,7 +10,7 @@ tmpfile over the old grubenv (following symlinks). Signed-off-by: Hans de Goede --- - util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++----- + util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++----- 1 file changed, 78 insertions(+), 9 deletions(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c @@ -150,3 +151,6 @@ index 65d74ce010f..d1c5e28862b 100644 return 0; } +-- +2.26.2 + diff --git a/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch index 54b73e6c..c7d5412b 100644 --- a/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch +++ b/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 5235d8a87e7b11193cb76af9381e738199f67655 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH] grub.d: Fix boot_indeterminate getting set on boot_success=0 - boot +Subject: [PATCH 192/237] grub.d: Fix boot_indeterminate getting set on + boot_success=0 boot The "grub.d: Split out boot success reset from menu auto hide script" not only moved the code to clear boot_success and boot_indeterminate @@ -73,3 +73,6 @@ index 6c88d933dde..737e1ae5b68 100644 fi # Reset boot_success for current boot set boot_success=0 +-- +2.26.2 + diff --git a/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch index d6e4756f..ab1424b6 100644 --- a/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch +++ b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 217890e8fd2235e92e59f54a68a2c19dcc67cc8e Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 15 Oct 2019 09:08:25 +0200 -Subject: [PATCH] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set - kernelopts +Subject: [PATCH 193/237] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to + set kernelopts The GRUB documentation mentions that there are two variables to set the linux kernel cmdline: GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT. @@ -43,3 +43,6 @@ index 3919b8aff4e..9e015c2c134 100644 if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}" fi +-- +2.26.2 + diff --git a/0194-Fix-savedefault-with-blscfg.patch b/0194-Fix-savedefault-with-blscfg.patch index ec0d52a5..ddf48c24 100644 --- a/0194-Fix-savedefault-with-blscfg.patch +++ b/0194-Fix-savedefault-with-blscfg.patch @@ -1,7 +1,7 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From e1a1226abd8f579b411b715639ab8e0abedc0f0a Mon Sep 17 00:00:00 2001 From: Fritz Elfert Date: Sun, 12 Jan 2020 22:07:52 +0100 -Subject: [PATCH] Fix savedefault with blscfg +Subject: [PATCH 194/237] Fix savedefault with blscfg The GRUB_SAVEDEFAULT option was ignored on a BLS configuration. Fix it by making the menu entries populated from the BLS files to call savedefault @@ -48,3 +48,6 @@ index 9e015c2c134..d5319300e04 100644 fi exit 0 +-- +2.26.2 + diff --git a/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch index 1dc9f6b7..70d1f760 100644 --- a/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch +++ b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 983aeec4df983df6d02f71e9d26f36571382d0b6 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH] blscfg: add a space char when appending fields for variable - expansion +Subject: [PATCH 195/237] blscfg: add a space char when appending fields for + variable expansion The GRUB variables are expanded and replaced by their values before adding menu entries, but they didn't include space characters after the values so @@ -74,3 +74,6 @@ index f2c1fd0733d..1504be30e8e 100644 } } +-- +2.26.2 + diff --git a/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch index 1d19216e..c2c179e9 100644 --- a/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch +++ b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 42fedf2e00e13b7900f3e05c45bcdd87b58cc952 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 4 Nov 2019 17:33:30 +0100 -Subject: [PATCH] blscfg: Add support for sorting the plus ('+') higher than - base version +Subject: [PATCH 196/237] blscfg: Add support for sorting the plus ('+') higher + than base version Handle plus separator. Concept is the same as tilde, except that if one of the strings ends (base version), the other is considered as higher version. @@ -57,3 +57,6 @@ index 1504be30e8e..286a5b88d12 100644 /* If we ran to the end of either, we are finished with the loop */ if (!(*one && *two)) break; +-- +2.26.2 + diff --git a/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch index b1481b96..76371bb6 100644 --- a/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch +++ b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From b987476a6bd5462e6258f4e4c6e3c4553a2a5b6a Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 14 Jan 2020 17:41:29 +0100 -Subject: [PATCH] blscfg: Always use the root variable to search for BLS - snippets +Subject: [PATCH 197/237] blscfg: Always use the root variable to search for + BLS snippets The boot and root variables are set by grub2-mkconfig to tell GRUB what are the devices and partitions used as the EFI System Partition (ESP) @@ -45,3 +45,6 @@ index 286a5b88d12..aa4e624905e 100644 } grub_dprintf ("blscfg", "opening %s\n", devid); +-- +2.26.2 + diff --git a/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch index 46ab032c..43dff51e 100644 --- a/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch +++ b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch @@ -1,7 +1,7 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 5668ad4ae37b70975b5f6e3da1b909bd1d51f2d5 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 16 Mar 2020 13:51:45 +0100 -Subject: [PATCH] blscfg: return NULL instead of a zero-length array in +Subject: [PATCH 198/237] blscfg: return NULL instead of a zero-length array in bls_make_list() The bls_make_list() function returns a list of all the values for a given @@ -36,3 +36,6 @@ index aa4e624905e..df6947f58cd 100644 if (num) *num = nlist; +-- +2.26.2 + diff --git a/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch index 5993a6ba..e0784d87 100644 --- a/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch +++ b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From a0b42e6003987d194b9780ea91cb3c9245547521 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 26 Mar 2020 15:08:30 +0100 -Subject: [PATCH] grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree - systems +Subject: [PATCH 199/237] grub-switch-to-blscfg: Update grub2 binary in ESP for + OSTree systems The grub2 EFI binary in the ESP isn't updated as a part of an OSTree update transaction. So let's make the script to update this and also create a file @@ -35,3 +35,6 @@ index 49b3985fadb..a05a8d98554 100644 GENERATE=0 if grep '^GRUB_ENABLE_BLSCFG=.*' "${etcdefaultgrub}" \ | grep -vq '^GRUB_ENABLE_BLSCFG="*true"*\s*$' ; then +-- +2.26.2 + diff --git a/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch index 27ef6e0a..2edf0ee4 100644 --- a/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch +++ b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 5c365350a3b1558114a385dc6c85fe2094247fcc Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 2 Apr 2020 11:07:24 +0200 -Subject: [PATCH] grub-switch-to-blscfg: Only mark GRUB as BLS supported if - blsdir isn't set +Subject: [PATCH 200/237] grub-switch-to-blscfg: Only mark GRUB as BLS + supported if blsdir isn't set If the user set the blsdir environemnt variable to a path that is not the default where ostree writes the BLS snippets, the blscfg module won't be @@ -35,3 +35,6 @@ index a05a8d98554..4bbed8e4fe9 100644 grub_binary="$(find /usr/lib/ostree-boot/efi/EFI/${EFIDIR}/ -name grub*.efi)" cp ${grub_binary} ${grubdir} || exit 1 # Create a hidden file to indicate that grub2 now has BLS support. +-- +2.26.2 + diff --git a/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch index c131a7f6..e400e965 100644 --- a/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch +++ b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From f654b4baf92c2d95e84ea017831f06404fbcef61 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 16 Apr 2020 18:53:03 +0200 -Subject: [PATCH] grub-switch-to-blscfg: Use install to copy GRUB binary, - modules and config +Subject: [PATCH 201/237] grub-switch-to-blscfg: Use install to copy GRUB + binary, modules and config By default the cp command truncates the destination before copying from the source, so if interrupted it can lead to a file that's half written. @@ -44,3 +44,6 @@ index 4bbed8e4fe9..3333a620c28 100644 sed -i"${backupsuffix}" \ -e 's,^GRUB_ENABLE_BLSCFG=.*,GRUB_ENABLE_BLSCFG=false,' \ "${etcdefaultgrub}" +-- +2.26.2 + diff --git a/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch index 985c5ba3..dabaf52a 100644 --- a/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch +++ b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From 1beb2d222a7ace793287211ae3265a95bff09ad5 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 16 Apr 2020 21:11:04 +0200 -Subject: [PATCH] 10_linux.in: Enable BLS configuration if new-kernel-pkg isn't - present +Subject: [PATCH 202/237] 10_linux.in: Enable BLS configuration if + new-kernel-pkg isn't present Currently if the the GRUB_ENABLE_BLSCFG option in /etc/default/grub hasn't been set, the 10_linux script will generate a GRUB configuration that does @@ -37,3 +37,6 @@ index d5319300e04..b99eaa8f203 100644 if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]; then if [ x$dirname = x/ ]; then if [ -z "${prepare_root_cache}" ]; then +-- +2.26.2 + diff --git a/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch index 09d378f2..73df6c73 100644 --- a/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch +++ b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch @@ -1,8 +1,8 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From fbea00c276c195e27501a33d36f148aa55d6d390 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 12 May 2020 01:00:51 +0200 -Subject: [PATCH] envblk: Fix buffer overrun when attempting to shrink a - variable value +Subject: [PATCH 203/237] envblk: Fix buffer overrun when attempting to shrink + a variable value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -58,3 +58,6 @@ index f89d86d4e8d..874506da169 100644 } else /* Move the following characters forward. */ +-- +2.26.2 + diff --git a/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch b/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch new file mode 100644 index 00000000..b57c0c62 --- /dev/null +++ b/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch @@ -0,0 +1,75 @@ +From 0d34ea81fbc863b00148834bd0ec92537b9f4e06 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 24 Apr 2019 10:03:04 -0400 +Subject: [PATCH 204/237] Forbid the "devicetree" command when Secure Boot is + enabled. + +Signed-off-by: Peter Jones +--- + grub-core/loader/arm/linux.c | 12 ++++++++++++ + grub-core/loader/efi/fdt.c | 12 ++++++++++++ + 2 files changed, 24 insertions(+) + +diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c +index b4f609d2d01..5f5723b4b8f 100644 +--- a/grub-core/loader/arm/linux.c ++++ b/grub-core/loader/arm/linux.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -467,6 +468,17 @@ grub_cmd_devicetree (grub_command_t cmd __attribute__ ((unused)), + if (argc != 1) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); + ++ if (grub_efi_secure_boot ()) ++ { ++#if 0 ++ /* This is an error, but grub2-mkconfig still generates a pile of ++ * insmod commands, so emitting it would be mostly just obnoxious. */ ++ grub_error (GRUB_ERR_ACCESS_DENIED, ++ "Secure Boot forbids loading devicetree from %s", filename); ++#endif ++ return 0; ++ } ++ + dtb = grub_file_open (argv[0]); + if (!dtb) + return grub_errno; +diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c +index cecd617dccc..2c14a11fa6b 100644 +--- a/grub-core/loader/efi/fdt.c ++++ b/grub-core/loader/efi/fdt.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -125,6 +126,17 @@ grub_cmd_devicetree (grub_command_t cmd __attribute__ ((unused)), + return GRUB_ERR_NONE; + } + ++ if (grub_efi_secure_boot ()) ++ { ++#if 0 ++ /* This is an error, but grub2-mkconfig still generates a pile of ++ * insmod commands, so emitting it would be mostly just obnoxious. */ ++ grub_error (GRUB_ERR_ACCESS_DENIED, ++ "Secure Boot forbids loading devicetree from %s", filename); ++#endif ++ return 0; ++ } ++ + dtb = grub_file_open (argv[0]); + if (!dtb) + goto out; +-- +2.26.2 + diff --git a/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch b/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch new file mode 100644 index 00000000..7449b0ad --- /dev/null +++ b/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch @@ -0,0 +1,70 @@ +From 1d19ae30454eae66bf9e7f3d0bc4028a43d258fd Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Wed, 15 Apr 2020 15:45:02 -0400 +Subject: [PATCH 205/237] yylex: Make lexer fatal errors actually be fatal + +When presented with a command that can't be tokenized to anything +smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg), +expecting that will stop further processing, as such: + + #define YY_DO_BEFORE_ACTION \ + yyg->yytext_ptr = yy_bp; \ + yyleng = (int) (yy_cp - yy_bp); \ + yyg->yy_hold_char = *yy_cp; \ + *yy_cp = '\0'; \ + if ( yyleng >= YYLMAX ) \ + YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \ + yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \ + yyg->yy_c_buf_p = yy_cp; + +The code flex generates expects that YY_FATAL_ERROR() will either return +for it or do some form of longjmp(), or handle the error in some way at +least, and so the strncpy() call isn't in an "else" clause, and thus if +YY_FATAL_ERROR() is *not* actually fatal, it does the call with the +questionable limit, and predictable results ensue. + +Unfortunately, our implementation of YY_FATAL_ERROR() is: + + #define YY_FATAL_ERROR(msg) \ + do { \ + grub_printf (_("fatal error: %s\n"), _(msg)); \ + } while (0) + +The same pattern exists in yyless(), and similar problems exist in users +of YY_INPUT(), several places in the main parsing loop, +yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack, +yy_scan_buffer(), etc. + +All of these callers expect YY_FATAL_ERROR() to actually be fatal, and +the things they do if it returns after calling it are wildly unsafe. + +Fixes: CVE-2020-10713 + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: 926df817dc8 +--- + grub-core/script/yylex.l | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/script/yylex.l b/grub-core/script/yylex.l +index 7b44c37b76f..b7203c82309 100644 +--- a/grub-core/script/yylex.l ++++ b/grub-core/script/yylex.l +@@ -37,11 +37,11 @@ + + /* + * As we don't have access to yyscanner, we cannot do much except to +- * print the fatal error. ++ * print the fatal error and exit. + */ + #define YY_FATAL_ERROR(msg) \ + do { \ +- grub_printf (_("fatal error: %s\n"), _(msg)); \ ++ grub_fatal (_("fatal error: %s\n"), _(msg));\ + } while (0) + + #define COPY(str, hint) \ +-- +2.26.2 + diff --git a/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch b/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch new file mode 100644 index 00000000..c69a90c7 --- /dev/null +++ b/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch @@ -0,0 +1,127 @@ +From ce53098c1579f0d484f212dafbf3f81f92aca42b Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 15 Jun 2020 10:58:42 -0400 +Subject: [PATCH 206/237] safemath: Add some arithmetic primitives that check + for overflow + +This adds a new header, include/grub/safemath.h, that includes easy to +use wrappers for __builtin_{add,sub,mul}_overflow() declared like: + + bool OP(a, b, res) + +where OP is grub_add, grub_sub or grub_mul. OP() returns true in the +case where the operation would overflow and res is not modified. +Otherwise, false is returned and the operation is executed. + +These arithmetic primitives require newer compiler versions. So, bump +these requirements in the INSTALL file too. + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: de1c315841a +--- + include/grub/compiler.h | 8 ++++++++ + include/grub/safemath.h | 37 +++++++++++++++++++++++++++++++++++++ + INSTALL | 22 ++-------------------- + 3 files changed, 47 insertions(+), 20 deletions(-) + create mode 100644 include/grub/safemath.h + +diff --git a/include/grub/compiler.h b/include/grub/compiler.h +index 9859ff4cc79..ebafec68957 100644 +--- a/include/grub/compiler.h ++++ b/include/grub/compiler.h +@@ -48,6 +48,14 @@ + # define WARN_UNUSED_RESULT + #endif + ++#if defined(__clang__) && defined(__clang_major__) && defined(__clang_minor__) ++# define CLANG_PREREQ(maj,min) \ ++ ((__clang_major__ > (maj)) || \ ++ (__clang_major__ == (maj) && __clang_minor__ >= (min))) ++#else ++# define CLANG_PREREQ(maj,min) 0 ++#endif ++ + #define UNUSED __attribute__((__unused__)) + + #endif /* ! GRUB_COMPILER_HEADER */ +diff --git a/include/grub/safemath.h b/include/grub/safemath.h +new file mode 100644 +index 00000000000..c17b89bba17 +--- /dev/null ++++ b/include/grub/safemath.h +@@ -0,0 +1,37 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ * ++ * Arithmetic operations that protect against overflow. ++ */ ++ ++#ifndef GRUB_SAFEMATH_H ++#define GRUB_SAFEMATH_H 1 ++ ++#include ++ ++/* These appear in gcc 5.1 and clang 3.8. */ ++#if GNUC_PREREQ(5, 1) || CLANG_PREREQ(3, 8) ++ ++#define grub_add(a, b, res) __builtin_add_overflow(a, b, res) ++#define grub_sub(a, b, res) __builtin_sub_overflow(a, b, res) ++#define grub_mul(a, b, res) __builtin_mul_overflow(a, b, res) ++ ++#else ++#error gcc 5.1 or newer or clang 3.8 or newer is required ++#endif ++ ++#endif /* GRUB_SAFEMATH_H */ +diff --git a/INSTALL b/INSTALL +index f3c20edc844..f8bd9116480 100644 +--- a/INSTALL ++++ b/INSTALL +@@ -11,27 +11,9 @@ GRUB depends on some software packages installed into your system. If + you don't have any of them, please obtain and install them before + configuring the GRUB. + +-* GCC 4.1.3 or later +- Note: older versions may work but support is limited +- +- Experimental support for clang 3.3 or later (results in much bigger binaries) ++* GCC 5.1.0 or later ++ Experimental support for clang 3.8.0 or later (results in much bigger binaries) + for i386, x86_64, arm (including thumb), arm64, mips(el), powerpc, sparc64 +- Note: clang 3.2 or later works for i386 and x86_64 targets but results in +- much bigger binaries. +- earlier versions not tested +- Note: clang 3.2 or later works for arm +- earlier versions not tested +- Note: clang on arm64 is not supported due to +- https://llvm.org/bugs/show_bug.cgi?id=26030 +- Note: clang 3.3 or later works for mips(el) +- earlier versions fail to generate .reginfo and hence gprel relocations +- fail. +- Note: clang 3.2 or later works for powerpc +- earlier versions not tested +- Note: clang 3.5 or later works for sparc64 +- earlier versions return "error: unable to interface with target machine" +- Note: clang has no support for ia64 and hence you can't compile GRUB +- for ia64 with clang + * GNU Make + * GNU Bison 2.3 or later + * GNU gettext 0.17 or later +-- +2.26.2 + diff --git a/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch b/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch new file mode 100644 index 00000000..9f667ecf --- /dev/null +++ b/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch @@ -0,0 +1,243 @@ +From edacadd3894bf78ba4070a23812de65883207098 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 15 Jun 2020 12:15:29 -0400 +Subject: [PATCH 207/237] calloc: Make sure we always have an overflow-checking + calloc() available + +This tries to make sure that everywhere in this source tree, we always have +an appropriate version of calloc() (i.e. grub_calloc(), xcalloc(), etc.) +available, and that they all safely check for overflow and return NULL when +it would occur. + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: 79e51ab7a9a +--- + grub-core/kern/emu/misc.c | 12 +++++++++ + grub-core/kern/emu/mm.c | 10 ++++++++ + grub-core/kern/mm.c | 40 ++++++++++++++++++++++++++++++ + grub-core/lib/libgcrypt_wrap/mem.c | 11 ++++++-- + grub-core/lib/posix_wrap/stdlib.h | 8 +++++- + include/grub/emu/misc.h | 1 + + include/grub/mm.h | 6 +++++ + 7 files changed, 85 insertions(+), 3 deletions(-) + +diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c +index 9367caf763c..0c68e8b3a46 100644 +--- a/grub-core/kern/emu/misc.c ++++ b/grub-core/kern/emu/misc.c +@@ -84,6 +84,18 @@ grub_util_error (const char *fmt, ...) + grub_exit (1); + } + ++void * ++xcalloc (grub_size_t nmemb, grub_size_t size) ++{ ++ void *p; ++ ++ p = calloc (nmemb, size); ++ if (!p) ++ grub_util_error ("%s", _("out of memory")); ++ ++ return p; ++} ++ + void * + xmalloc (grub_size_t size) + { +diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c +index f262e95e388..145b01d3719 100644 +--- a/grub-core/kern/emu/mm.c ++++ b/grub-core/kern/emu/mm.c +@@ -25,6 +25,16 @@ + #include + #include + ++void * ++grub_calloc (grub_size_t nmemb, grub_size_t size) ++{ ++ void *ret; ++ ret = calloc (nmemb, size); ++ if (!ret) ++ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); ++ return ret; ++} ++ + void * + grub_malloc (grub_size_t size) + { +diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c +index 002cbfa4f3d..80d0720d005 100644 +--- a/grub-core/kern/mm.c ++++ b/grub-core/kern/mm.c +@@ -67,8 +67,10 @@ + #include + #include + #include ++#include + + #ifdef MM_DEBUG ++# undef grub_calloc + # undef grub_malloc + # undef grub_zalloc + # undef grub_realloc +@@ -375,6 +377,30 @@ grub_memalign (grub_size_t align, grub_size_t size) + return 0; + } + ++/* ++ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on ++ * integer overflow. ++ */ ++void * ++grub_calloc (grub_size_t nmemb, grub_size_t size) ++{ ++ void *ret; ++ grub_size_t sz = 0; ++ ++ if (grub_mul (nmemb, size, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ ++ ret = grub_memalign (0, sz); ++ if (!ret) ++ return NULL; ++ ++ grub_memset (ret, 0, sz); ++ return ret; ++} ++ + /* Allocate SIZE bytes and return the pointer. */ + void * + grub_malloc (grub_size_t size) +@@ -561,6 +587,20 @@ grub_mm_dump (unsigned lineno) + grub_printf ("\n"); + } + ++void * ++grub_debug_calloc (const char *file, int line, grub_size_t nmemb, grub_size_t size) ++{ ++ void *ptr; ++ ++ if (grub_mm_debug) ++ grub_printf ("%s:%d: calloc (0x%" PRIxGRUB_SIZE ", 0x%" PRIxGRUB_SIZE ") = ", ++ file, line, size); ++ ptr = grub_calloc (nmemb, size); ++ if (grub_mm_debug) ++ grub_printf ("%p\n", ptr); ++ return ptr; ++} ++ + void * + grub_debug_malloc (const char *file, int line, grub_size_t size) + { +diff --git a/grub-core/lib/libgcrypt_wrap/mem.c b/grub-core/lib/libgcrypt_wrap/mem.c +index beeb661a3c8..74c6eafe525 100644 +--- a/grub-core/lib/libgcrypt_wrap/mem.c ++++ b/grub-core/lib/libgcrypt_wrap/mem.c +@@ -4,6 +4,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -36,7 +37,10 @@ void * + gcry_xcalloc (size_t n, size_t m) + { + void *ret; +- ret = grub_zalloc (n * m); ++ size_t sz; ++ if (grub_mul (n, m, &sz)) ++ grub_fatal ("gcry_xcalloc would overflow"); ++ ret = grub_zalloc (sz); + if (!ret) + grub_fatal ("gcry_xcalloc failed"); + return ret; +@@ -56,7 +60,10 @@ void * + gcry_xcalloc_secure (size_t n, size_t m) + { + void *ret; +- ret = grub_zalloc (n * m); ++ size_t sz; ++ if (grub_mul (n, m, &sz)) ++ grub_fatal ("gcry_xcalloc would overflow"); ++ ret = grub_zalloc (sz); + if (!ret) + grub_fatal ("gcry_xcalloc failed"); + return ret; +diff --git a/grub-core/lib/posix_wrap/stdlib.h b/grub-core/lib/posix_wrap/stdlib.h +index 3b46f47ff50..7a8d385e973 100644 +--- a/grub-core/lib/posix_wrap/stdlib.h ++++ b/grub-core/lib/posix_wrap/stdlib.h +@@ -21,6 +21,7 @@ + + #include + #include ++#include + + static inline void + free (void *ptr) +@@ -37,7 +38,12 @@ malloc (grub_size_t size) + static inline void * + calloc (grub_size_t size, grub_size_t nelem) + { +- return grub_zalloc (size * nelem); ++ grub_size_t sz; ++ ++ if (grub_mul (size, nelem, &sz)) ++ return NULL; ++ ++ return grub_zalloc (sz); + } + + static inline void * +diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h +index 1ca4c78de97..577fdab45fd 100644 +--- a/include/grub/emu/misc.h ++++ b/include/grub/emu/misc.h +@@ -54,6 +54,7 @@ grub_util_device_is_mapped (const char *dev); + #define GRUB_HOST_PRIxLONG_LONG "llx" + #endif + ++void * EXPORT_FUNC(xcalloc) (grub_size_t nmemb, grub_size_t size) WARN_UNUSED_RESULT; + void * EXPORT_FUNC(xmalloc) (grub_size_t size) WARN_UNUSED_RESULT; + void * EXPORT_FUNC(xrealloc) (void *ptr, grub_size_t size) WARN_UNUSED_RESULT; + char * EXPORT_FUNC(xstrdup) (const char *str) WARN_UNUSED_RESULT; +diff --git a/include/grub/mm.h b/include/grub/mm.h +index 28e2e53eb32..9c38dd3ca5d 100644 +--- a/include/grub/mm.h ++++ b/include/grub/mm.h +@@ -29,6 +29,7 @@ + #endif + + void grub_mm_init_region (void *addr, grub_size_t size); ++void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size); + void *EXPORT_FUNC(grub_malloc) (grub_size_t size); + void *EXPORT_FUNC(grub_zalloc) (grub_size_t size); + void EXPORT_FUNC(grub_free) (void *ptr); +@@ -48,6 +49,9 @@ extern int EXPORT_VAR(grub_mm_debug); + void grub_mm_dump_free (void); + void grub_mm_dump (unsigned lineno); + ++#define grub_calloc(nmemb, size) \ ++ grub_debug_calloc (GRUB_FILE, __LINE__, nmemb, size) ++ + #define grub_malloc(size) \ + grub_debug_malloc (GRUB_FILE, __LINE__, size) + +@@ -63,6 +67,8 @@ void grub_mm_dump (unsigned lineno); + #define grub_free(ptr) \ + grub_debug_free (GRUB_FILE, __LINE__, ptr) + ++void *EXPORT_FUNC(grub_debug_calloc) (const char *file, int line, ++ grub_size_t nmemb, grub_size_t size); + void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line, + grub_size_t size); + void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line, +-- +2.26.2 + diff --git a/0208-calloc-Use-calloc-at-most-places.patch b/0208-calloc-Use-calloc-at-most-places.patch new file mode 100644 index 00000000..12ccca08 --- /dev/null +++ b/0208-calloc-Use-calloc-at-most-places.patch @@ -0,0 +1,1957 @@ +From cd97ed407e995a8457ffd2e6947972850ca72902 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 15 Jun 2020 12:26:01 -0400 +Subject: [PATCH 208/237] calloc: Use calloc() at most places + +This modifies most of the places we do some form of: + + X = malloc(Y * Z); + +to use calloc(Y, Z) instead. + +Among other issues, this fixes: + - allocation of integer overflow in grub_png_decode_image_header() + reported by Chris Coulson, + - allocation of integer overflow in luks_recover_key() + reported by Chris Coulson, + - allocation of integer overflow in grub_lvm_detect() + reported by Chris Coulson. + +Fixes: CVE-2020-14308 + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: 48eeedf1e4b +--- + grub-core/bus/usb/usbhub.c | 8 +-- + grub-core/commands/efi/lsefisystab.c | 3 +- + grub-core/commands/legacycfg.c | 6 +-- + grub-core/commands/menuentry.c | 2 +- + grub-core/commands/nativedisk.c | 2 +- + grub-core/commands/parttool.c | 12 +++-- + grub-core/commands/regexp.c | 2 +- + grub-core/commands/search_wrap.c | 2 +- + grub-core/disk/diskfilter.c | 4 +- + grub-core/disk/ieee1275/ofdisk.c | 2 +- + grub-core/disk/ldm.c | 14 +++--- + grub-core/disk/luks.c | 2 +- + grub-core/disk/lvm.c | 8 +-- + grub-core/disk/xen/xendisk.c | 2 +- + grub-core/efiemu/loadcore.c | 2 +- + grub-core/efiemu/mm.c | 6 +-- + grub-core/font/font.c | 3 +- + grub-core/fs/affs.c | 6 +-- + grub-core/fs/btrfs.c | 4 +- + grub-core/fs/hfs.c | 2 +- + grub-core/fs/hfsplus.c | 59 ++++++++++++++++------- + grub-core/fs/iso9660.c | 2 +- + grub-core/fs/ntfs.c | 4 +- + grub-core/fs/sfs.c | 2 +- + grub-core/fs/tar.c | 2 +- + grub-core/fs/udf.c | 4 +- + grub-core/fs/zfs/zfs.c | 4 +- + grub-core/gfxmenu/gui_string_util.c | 2 +- + grub-core/gfxmenu/widget-box.c | 4 +- + grub-core/io/gzio.c | 2 +- + grub-core/kern/efi/efi.c | 33 ++++++++++--- + grub-core/kern/emu/hostdisk.c | 2 +- + grub-core/kern/fs.c | 2 +- + grub-core/kern/misc.c | 2 +- + grub-core/kern/parser.c | 2 +- + grub-core/kern/uboot/uboot.c | 2 +- + grub-core/lib/libgcrypt/cipher/ac.c | 8 +-- + grub-core/lib/libgcrypt/cipher/primegen.c | 4 +- + grub-core/lib/libgcrypt/cipher/pubkey.c | 4 +- + grub-core/lib/priority_queue.c | 2 +- + grub-core/lib/reed_solomon.c | 7 ++- + grub-core/lib/relocator.c | 10 ++-- + grub-core/loader/arm/linux.c | 2 +- + grub-core/loader/efi/chainloader.c | 11 +++-- + grub-core/loader/i386/bsdXX.c | 2 +- + grub-core/loader/i386/xnu.c | 4 +- + grub-core/loader/macho.c | 2 +- + grub-core/loader/multiboot_elfxx.c | 2 +- + grub-core/loader/xnu.c | 2 +- + grub-core/mmap/mmap.c | 4 +- + grub-core/net/bootp.c | 2 +- + grub-core/net/dns.c | 10 ++-- + grub-core/net/net.c | 4 +- + grub-core/normal/charset.c | 10 ++-- + grub-core/normal/cmdline.c | 14 +++--- + grub-core/normal/menu_entry.c | 14 +++--- + grub-core/normal/menu_text.c | 4 +- + grub-core/normal/term.c | 4 +- + grub-core/osdep/linux/getroot.c | 6 +-- + grub-core/osdep/unix/config.c | 2 +- + grub-core/osdep/windows/getroot.c | 2 +- + grub-core/osdep/windows/hostdisk.c | 4 +- + grub-core/osdep/windows/init.c | 2 +- + grub-core/osdep/windows/platform.c | 4 +- + grub-core/osdep/windows/relpath.c | 2 +- + grub-core/partmap/gpt.c | 2 +- + grub-core/partmap/msdos.c | 2 +- + grub-core/script/execute.c | 2 +- + grub-core/tests/fake_input.c | 2 +- + grub-core/tests/video_checksum.c | 6 +-- + grub-core/video/capture.c | 2 +- + grub-core/video/emu/sdl.c | 2 +- + grub-core/video/i386/pc/vga.c | 2 +- + grub-core/video/readers/png.c | 2 +- + util/getroot.c | 2 +- + util/grub-file.c | 2 +- + util/grub-fstest.c | 4 +- + util/grub-install-common.c | 2 +- + util/grub-install.c | 4 +- + util/grub-mkimagexx.c | 6 +-- + util/grub-mkrescue.c | 4 +- + util/grub-mkstandalone.c | 2 +- + util/grub-pe2elf.c | 12 ++--- + util/grub-probe.c | 4 +- + include/grub/unicode.h | 4 +- + 85 files changed, 243 insertions(+), 193 deletions(-) + +diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c +index 34a7ff1b5f8..a06cce302d2 100644 +--- a/grub-core/bus/usb/usbhub.c ++++ b/grub-core/bus/usb/usbhub.c +@@ -149,8 +149,8 @@ grub_usb_add_hub (grub_usb_device_t dev) + grub_usb_set_configuration (dev, 1); + + dev->nports = hubdesc.portcnt; +- dev->children = grub_zalloc (hubdesc.portcnt * sizeof (dev->children[0])); +- dev->ports = grub_zalloc (dev->nports * sizeof (dev->ports[0])); ++ dev->children = grub_calloc (hubdesc.portcnt, sizeof (dev->children[0])); ++ dev->ports = grub_calloc (dev->nports, sizeof (dev->ports[0])); + if (!dev->children || !dev->ports) + { + grub_free (dev->children); +@@ -268,8 +268,8 @@ grub_usb_controller_dev_register_iter (grub_usb_controller_t controller, void *d + + /* Query the number of ports the root Hub has. */ + hub->nports = controller->dev->hubports (controller); +- hub->devices = grub_zalloc (sizeof (hub->devices[0]) * hub->nports); +- hub->ports = grub_zalloc (sizeof (hub->ports[0]) * hub->nports); ++ hub->devices = grub_calloc (hub->nports, sizeof (hub->devices[0])); ++ hub->ports = grub_calloc (hub->nports, sizeof (hub->ports[0])); + if (!hub->devices || !hub->ports) + { + grub_free (hub->devices); +diff --git a/grub-core/commands/efi/lsefisystab.c b/grub-core/commands/efi/lsefisystab.c +index df103022188..cd81507f5d4 100644 +--- a/grub-core/commands/efi/lsefisystab.c ++++ b/grub-core/commands/efi/lsefisystab.c +@@ -71,7 +71,8 @@ grub_cmd_lsefisystab (struct grub_command *cmd __attribute__ ((unused)), + grub_printf ("Vendor: "); + + for (vendor_utf16 = st->firmware_vendor; *vendor_utf16; vendor_utf16++); +- vendor = grub_malloc (4 * (vendor_utf16 - st->firmware_vendor) + 1); ++ /* Allocate extra 3 bytes to simplify math. */ ++ vendor = grub_calloc (4, vendor_utf16 - st->firmware_vendor + 1); + if (!vendor) + return grub_errno; + *grub_utf16_to_utf8 ((grub_uint8_t *) vendor, st->firmware_vendor, +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index ef8dd74c589..5344ebf4b3b 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -315,7 +315,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)), + if (argc < 2) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); + +- cutargs = grub_malloc (sizeof (cutargs[0]) * (argc - 1)); ++ cutargs = grub_calloc (argc - 1, sizeof (cutargs[0])); + if (!cutargs) + return grub_errno; + cutargc = argc - 1; +@@ -437,7 +437,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)), + { + char rbuf[3] = "-r"; + bsdargc = cutargc + 2; +- bsdargs = grub_malloc (sizeof (bsdargs[0]) * bsdargc); ++ bsdargs = grub_calloc (bsdargc, sizeof (bsdargs[0])); + if (!bsdargs) + { + err = grub_errno; +@@ -560,7 +560,7 @@ grub_cmd_legacy_initrdnounzip (struct grub_command *mycmd __attribute__ ((unused + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("can't find command `%s'"), + "module"); + +- newargs = grub_malloc ((argc + 1) * sizeof (newargs[0])); ++ newargs = grub_calloc (argc + 1, sizeof (newargs[0])); + if (!newargs) + return grub_errno; + grub_memcpy (newargs + 1, args, argc * sizeof (newargs[0])); +diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c +index 29736f5cd03..84edfc06b7f 100644 +--- a/grub-core/commands/menuentry.c ++++ b/grub-core/commands/menuentry.c +@@ -157,7 +157,7 @@ grub_normal_add_menu_entry (int argc, const char **args, + grub_dprintf ("menu", "menu_id:\"%s\"\n", menu_id); + + /* Save argc, args to pass as parameters to block arg later. */ +- menu_args = grub_malloc (sizeof (char*) * (argc + 1)); ++ menu_args = grub_calloc (argc + 1, sizeof (char *)); + if (! menu_args) + goto fail; + +diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c +index 2f56a870e68..d69214f6de0 100644 +--- a/grub-core/commands/nativedisk.c ++++ b/grub-core/commands/nativedisk.c +@@ -194,7 +194,7 @@ grub_cmd_nativedisk (grub_command_t cmd __attribute__ ((unused)), + else + path_prefix = prefix; + +- mods = grub_malloc (argc * sizeof (mods[0])); ++ mods = grub_calloc (argc, sizeof (mods[0])); + if (!mods) + return grub_errno; + +diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c +index 693e2cb42fc..36dadc0b1db 100644 +--- a/grub-core/commands/parttool.c ++++ b/grub-core/commands/parttool.c +@@ -59,7 +59,13 @@ grub_parttool_register(const char *part_name, + for (nargs = 0; args[nargs].name != 0; nargs++); + cur->nargs = nargs; + cur->args = (struct grub_parttool_argdesc *) +- grub_malloc ((nargs + 1) * sizeof (struct grub_parttool_argdesc)); ++ grub_calloc (nargs + 1, sizeof (struct grub_parttool_argdesc)); ++ if (!cur->args) ++ { ++ grub_free (cur); ++ curhandle--; ++ return -1; ++ } + grub_memcpy (cur->args, args, + (nargs + 1) * sizeof (struct grub_parttool_argdesc)); + +@@ -257,7 +263,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)), + return err; + } + +- parsed = (int *) grub_zalloc (argc * sizeof (int)); ++ parsed = (int *) grub_calloc (argc, sizeof (int)); + + for (i = 1; i < argc; i++) + if (! parsed[i]) +@@ -290,7 +296,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)), + } + ptool = cur; + pargs = (struct grub_parttool_args *) +- grub_zalloc (ptool->nargs * sizeof (struct grub_parttool_args)); ++ grub_calloc (ptool->nargs, sizeof (struct grub_parttool_args)); + for (j = i; j < argc; j++) + if (! parsed[j]) + { +diff --git a/grub-core/commands/regexp.c b/grub-core/commands/regexp.c +index 7c5c72fe460..612003f94c8 100644 +--- a/grub-core/commands/regexp.c ++++ b/grub-core/commands/regexp.c +@@ -116,7 +116,7 @@ grub_cmd_regexp (grub_extcmd_context_t ctxt, int argc, char **args) + if (ret) + goto fail; + +- matches = grub_zalloc (sizeof (*matches) * (regex.re_nsub + 1)); ++ matches = grub_calloc (regex.re_nsub + 1, sizeof (*matches)); + if (! matches) + goto fail; + +diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c +index d7fd26b9405..47fc8eb9966 100644 +--- a/grub-core/commands/search_wrap.c ++++ b/grub-core/commands/search_wrap.c +@@ -122,7 +122,7 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args) + for (i = 0; state[SEARCH_HINT_BAREMETAL].args[i]; i++) + nhints++; + +- hints = grub_malloc (sizeof (hints[0]) * nhints); ++ hints = grub_calloc (nhints, sizeof (hints[0])); + if (!hints) + return grub_errno; + j = 0; +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index 5447e04e702..b14fc4f0792 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -1137,7 +1137,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + array->lvs->segments->node_count = nmemb; + array->lvs->segments->raid_member_size = disk_size; + array->lvs->segments->nodes +- = grub_zalloc (nmemb * sizeof (array->lvs->segments->nodes[0])); ++ = grub_calloc (nmemb, sizeof (array->lvs->segments->nodes[0])); + array->lvs->segments->stripe_size = stripe_size; + for (i = 0; i < nmemb; i++) + { +@@ -1230,7 +1230,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, + grub_partition_t p; + for (p = disk->partition; p; p = p->parent) + s++; +- pv->partmaps = xmalloc (s * sizeof (pv->partmaps[0])); ++ pv->partmaps = xcalloc (s, sizeof (pv->partmaps[0])); + s = 0; + for (p = disk->partition; p; p = p->parent) + pv->partmaps[s++] = xstrdup (p->partmap->name); +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 235c0fe2c76..d887d4b6eee 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -297,7 +297,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + /* Power machines documentation specify 672 as maximum SAS disks in + one system. Using a slightly larger value to be safe. */ + table_size = 768; +- table = grub_malloc (table_size * sizeof (grub_uint64_t)); ++ table = grub_calloc (table_size, sizeof (grub_uint64_t)); + + if (!table) + { +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 2a22d2d6c1c..e6323701ab3 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -323,8 +323,8 @@ make_vg (grub_disk_t disk, + lv->segments->type = GRUB_DISKFILTER_MIRROR; + lv->segments->node_count = 0; + lv->segments->node_alloc = 8; +- lv->segments->nodes = grub_zalloc (sizeof (*lv->segments->nodes) +- * lv->segments->node_alloc); ++ lv->segments->nodes = grub_calloc (lv->segments->node_alloc, ++ sizeof (*lv->segments->nodes)); + if (!lv->segments->nodes) + goto fail2; + ptr = vblk[i].dynamic; +@@ -543,8 +543,8 @@ make_vg (grub_disk_t disk, + { + comp->segment_alloc = 8; + comp->segment_count = 0; +- comp->segments = grub_malloc (sizeof (*comp->segments) +- * comp->segment_alloc); ++ comp->segments = grub_calloc (comp->segment_alloc, ++ sizeof (*comp->segments)); + if (!comp->segments) + goto fail2; + } +@@ -590,8 +590,8 @@ make_vg (grub_disk_t disk, + } + comp->segments->node_count = read_int (ptr + 1, *ptr); + comp->segments->node_alloc = comp->segments->node_count; +- comp->segments->nodes = grub_zalloc (sizeof (*comp->segments->nodes) +- * comp->segments->node_alloc); ++ comp->segments->nodes = grub_calloc (comp->segments->node_alloc, ++ sizeof (*comp->segments->nodes)); + if (!lv->segments->nodes) + goto fail2; + } +@@ -1017,7 +1017,7 @@ grub_util_ldm_embed (struct grub_disk *disk, unsigned int *nsectors, + *nsectors = lv->size; + if (*nsectors > max_nsectors) + *nsectors = max_nsectors; +- *sectors = grub_malloc (*nsectors * sizeof (**sectors)); ++ *sectors = grub_calloc (*nsectors, sizeof (**sectors)); + if (!*sectors) + return grub_errno; + for (i = 0; i < *nsectors; i++) +diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c +index 86c50c61217..18b3a8bb1d3 100644 +--- a/grub-core/disk/luks.c ++++ b/grub-core/disk/luks.c +@@ -336,7 +336,7 @@ luks_recover_key (grub_disk_t source, + && grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes) + max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes); + +- split_key = grub_malloc (keysize * max_stripes); ++ split_key = grub_calloc (keysize, max_stripes); + if (!split_key) + return grub_errno; + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 0cbd0dd1629..8e76d1ae121 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -174,7 +174,7 @@ grub_lvm_detect (grub_disk_t disk, + first one. */ + + /* Allocate buffer space for the circular worst-case scenario. */ +- metadatabuf = grub_malloc (2 * mda_size); ++ metadatabuf = grub_calloc (2, mda_size); + if (! metadatabuf) + goto fail; + +@@ -427,7 +427,7 @@ grub_lvm_detect (grub_disk_t disk, + #endif + goto lvs_fail; + } +- lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count); ++ lv->segments = grub_calloc (lv->segment_count, sizeof (*seg)); + seg = lv->segments; + + for (i = 0; i < lv->segment_count; i++) +@@ -484,8 +484,8 @@ grub_lvm_detect (grub_disk_t disk, + if (seg->node_count != 1) + seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = "); + +- seg->nodes = grub_zalloc (sizeof (*stripe) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, ++ sizeof (*stripe)); + stripe = seg->nodes; + + p = grub_strstr (p, "stripes = ["); +diff --git a/grub-core/disk/xen/xendisk.c b/grub-core/disk/xen/xendisk.c +index b18a9238d87..c1b331edba7 100644 +--- a/grub-core/disk/xen/xendisk.c ++++ b/grub-core/disk/xen/xendisk.c +@@ -426,7 +426,7 @@ grub_xendisk_init (void) + if (!ctr) + return; + +- virtdisks = grub_malloc (ctr * sizeof (virtdisks[0])); ++ virtdisks = grub_calloc (ctr, sizeof (virtdisks[0])); + if (!virtdisks) + return; + if (grub_xenstore_dir ("device/vbd", fill, &ctr)) +diff --git a/grub-core/efiemu/loadcore.c b/grub-core/efiemu/loadcore.c +index 44085ef818e..2b924623f51 100644 +--- a/grub-core/efiemu/loadcore.c ++++ b/grub-core/efiemu/loadcore.c +@@ -201,7 +201,7 @@ grub_efiemu_count_symbols (const Elf_Ehdr *e) + + grub_efiemu_nelfsyms = (unsigned) s->sh_size / (unsigned) s->sh_entsize; + grub_efiemu_elfsyms = (struct grub_efiemu_elf_sym *) +- grub_malloc (sizeof (struct grub_efiemu_elf_sym) * grub_efiemu_nelfsyms); ++ grub_calloc (grub_efiemu_nelfsyms, sizeof (struct grub_efiemu_elf_sym)); + + /* Relocators */ + for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff); +diff --git a/grub-core/efiemu/mm.c b/grub-core/efiemu/mm.c +index 52a032f7b2e..9b8e0d0ad1a 100644 +--- a/grub-core/efiemu/mm.c ++++ b/grub-core/efiemu/mm.c +@@ -554,11 +554,11 @@ grub_efiemu_mmap_sort_and_uniq (void) + /* Initialize variables*/ + grub_memset (present, 0, sizeof (int) * GRUB_EFI_MAX_MEMORY_TYPE); + scanline_events = (struct grub_efiemu_mmap_scan *) +- grub_malloc (sizeof (struct grub_efiemu_mmap_scan) * 2 * mmap_num); ++ grub_calloc (mmap_num, sizeof (struct grub_efiemu_mmap_scan) * 2); + + /* Number of chunks can't increase more than by factor of 2 */ + result = (grub_efi_memory_descriptor_t *) +- grub_malloc (sizeof (grub_efi_memory_descriptor_t) * 2 * mmap_num); ++ grub_calloc (mmap_num, sizeof (grub_efi_memory_descriptor_t) * 2); + if (!result || !scanline_events) + { + grub_free (result); +@@ -660,7 +660,7 @@ grub_efiemu_mm_do_alloc (void) + + /* Preallocate mmap */ + efiemu_mmap = (grub_efi_memory_descriptor_t *) +- grub_malloc (mmap_reserved_size * sizeof (grub_efi_memory_descriptor_t)); ++ grub_calloc (mmap_reserved_size, sizeof (grub_efi_memory_descriptor_t)); + if (!efiemu_mmap) + { + grub_efiemu_unload (); +diff --git a/grub-core/font/font.c b/grub-core/font/font.c +index 53d76a64d04..68967dc1c2b 100644 +--- a/grub-core/font/font.c ++++ b/grub-core/font/font.c +@@ -293,8 +293,7 @@ load_font_index (grub_file_t file, grub_uint32_t sect_length, struct + font->num_chars = sect_length / FONT_CHAR_INDEX_ENTRY_SIZE; + + /* Allocate the character index array. */ +- font->char_index = grub_malloc (font->num_chars +- * sizeof (struct char_index_entry)); ++ font->char_index = grub_calloc (font->num_chars, sizeof (struct char_index_entry)); + if (!font->char_index) + return 1; + font->bmp_idx = grub_malloc (0x10000 * sizeof (grub_uint16_t)); +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index f673897e0fd..91073795f90 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -301,7 +301,7 @@ grub_affs_read_symlink (grub_fshelp_node_t node) + return 0; + } + latin1[symlink_size] = 0; +- utf8 = grub_malloc (symlink_size * GRUB_MAX_UTF8_PER_LATIN1 + 1); ++ utf8 = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, symlink_size); + if (!utf8) + { + grub_free (latin1); +@@ -422,7 +422,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir, + return 1; + } + +- hashtable = grub_zalloc (data->htsize * sizeof (*hashtable)); ++ hashtable = grub_calloc (data->htsize, sizeof (*hashtable)); + if (!hashtable) + return 1; + +@@ -628,7 +628,7 @@ grub_affs_label (grub_device_t device, char **label) + len = file.namelen; + if (len > sizeof (file.name)) + len = sizeof (file.name); +- *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1); ++ *label = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, len); + if (*label) + *grub_latin1_to_utf8 ((grub_uint8_t *) *label, file.name, len) = '\0'; + } +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index dac73b2fa8b..8c8aa9c3103 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -404,7 +404,7 @@ lower_bound (struct grub_btrfs_data *data, + { + desc->allocated = 16; + desc->depth = 0; +- desc->data = grub_malloc (sizeof (desc->data[0]) * desc->allocated); ++ desc->data = grub_calloc (desc->allocated, sizeof (desc->data[0])); + if (!desc->data) + return grub_errno; + } +@@ -2056,7 +2056,7 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)), + *nsectors = 64 * 2 - 1; + if (*nsectors > max_nsectors) + *nsectors = max_nsectors; +- *sectors = grub_malloc (*nsectors * sizeof (**sectors)); ++ *sectors = grub_calloc (*nsectors, sizeof (**sectors)); + if (!*sectors) + return grub_errno; + for (i = 0; i < *nsectors; i++) +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index fc36831789c..3fd4eec202c 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -1360,7 +1360,7 @@ grub_hfs_label (grub_device_t device, char **label) + grub_size_t len = data->sblock.volname[0]; + if (len > sizeof (data->sblock.volname) - 1) + len = sizeof (data->sblock.volname) - 1; +- *label = grub_malloc (len * MAX_UTF8_PER_MAC_ROMAN + 1); ++ *label = grub_calloc (MAX_UTF8_PER_MAC_ROMAN + 1, len); + if (*label) + macroman_to_utf8 (*label, data->sblock.volname + 1, + len + 1, 0); +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index 21159e858ab..db8ee7afc5d 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -661,6 +661,7 @@ list_nodes (void *record, void *hook_arg) + char *filename; + int i; + struct grub_fshelp_node *node; ++ grub_uint16_t *keyname; + struct grub_hfsplus_catfile *fileinfo; + enum grub_fshelp_filetype type = GRUB_FSHELP_UNKNOWN; + struct list_nodes_ctx *ctx = hook_arg; +@@ -719,32 +720,34 @@ list_nodes (void *record, void *hook_arg) + if (! filename) + return 0; + ++ keyname = grub_calloc (grub_be_to_cpu16 (catkey->namelen), sizeof (*keyname)); ++ if (!keyname) ++ { ++ grub_free (filename); ++ return 0; ++ } ++ + /* Make sure the byte order of the UTF16 string is correct. */ + for (i = 0; i < grub_be_to_cpu16 (catkey->namelen); i++) + { +- catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]); ++ keyname[i] = grub_be_to_cpu16 (catkey->name[i]); + +- if (catkey->name[i] == '/') +- catkey->name[i] = ':'; ++ if (keyname[i] == '/') ++ keyname[i] = ':'; + + /* If the name is obviously invalid, skip this node. */ +- if (catkey->name[i] == 0) ++ if (keyname[i] == 0) + { ++ grub_free (keyname); + grub_free (filename); + return 0; + } + } + +- *grub_utf16_to_utf8 ((grub_uint8_t *) filename, catkey->name, ++ *grub_utf16_to_utf8 ((grub_uint8_t *) filename, keyname, + grub_be_to_cpu16 (catkey->namelen)) = '\0'; + +- /* Restore the byte order to what it was previously. */ +- for (i = 0; i < grub_be_to_cpu16 (catkey->namelen); i++) +- { +- if (catkey->name[i] == ':') +- catkey->name[i] = '/'; +- catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]); +- } ++ grub_free (keyname); + + /* hfs+ is case insensitive. */ + if (! ctx->dir->data->case_sensitive) +@@ -975,6 +978,7 @@ grub_hfsplus_label (grub_device_t device, char **label) + grub_disk_t disk = device->disk; + struct grub_hfsplus_catkey *catkey; + int i, label_len; ++ grub_uint16_t *label_name; + struct grub_hfsplus_key_internal intern; + struct grub_hfsplus_btnode *node = NULL; + grub_disk_addr_t ptr = 0; +@@ -1003,22 +1007,41 @@ grub_hfsplus_label (grub_device_t device, char **label) + grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr); + + label_len = grub_be_to_cpu16 (catkey->namelen); ++ label_name = grub_calloc (label_len, sizeof (*label_name)); ++ if (!label_name) ++ { ++ grub_free (node); ++ grub_free (data); ++ return grub_errno; ++ } ++ + for (i = 0; i < label_len; i++) + { +- catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]); ++ label_name[i] = grub_be_to_cpu16 (catkey->name[i]); + + /* If the name is obviously invalid, skip this node. */ +- if (catkey->name[i] == 0) +- return 0; ++ if (label_name[i] == 0) ++ { ++ grub_free (label_name); ++ grub_free (node); ++ grub_free (data); ++ return 0; ++ } + } + +- *label = grub_malloc (label_len * GRUB_MAX_UTF8_PER_UTF16 + 1); ++ *label = grub_calloc (label_len, GRUB_MAX_UTF8_PER_UTF16 + 1); + if (! *label) +- return grub_errno; ++ { ++ grub_free (label_name); ++ grub_free (node); ++ grub_free (data); ++ return grub_errno; ++ } + +- *grub_utf16_to_utf8 ((grub_uint8_t *) (*label), catkey->name, ++ *grub_utf16_to_utf8 ((grub_uint8_t *) (*label), label_name, + label_len) = '\0'; + ++ grub_free (label_name); + grub_free (node); + grub_free (data); + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index c9c8374bf61..092b8f409ec 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -331,7 +331,7 @@ grub_iso9660_convert_string (grub_uint8_t *us, int len) + int i; + grub_uint16_t t[MAX_NAMELEN / 2 + 1]; + +- p = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1); ++ p = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1); + if (! p) + return NULL; + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 6f846886262..9827f9bb8c4 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -556,8 +556,8 @@ get_utf8 (grub_uint8_t *in, grub_size_t len) + grub_uint16_t *tmp; + grub_size_t i; + +- buf = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1); +- tmp = grub_malloc (len * sizeof (tmp[0])); ++ buf = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1); ++ tmp = grub_calloc (len, sizeof (tmp[0])); + if (!buf || !tmp) + { + grub_free (buf); +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 57b8d8da60b..663931717fd 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -266,7 +266,7 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + node->next_extent = node->block; + node->cache_size = 0; + +- node->cache = grub_malloc (sizeof (node->cache[0]) * cache_size); ++ node->cache = grub_calloc (cache_size, sizeof (node->cache[0])); + if (!node->cache) + { + grub_errno = 0; +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 39bf197aabe..4864451e19b 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -120,7 +120,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (data->linkname_alloc < linksize + 1) + { + char *n; +- n = grub_malloc (2 * (linksize + 1)); ++ n = grub_calloc (2, linksize + 1); + if (!n) + return grub_errno; + grub_free (data->linkname); +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 00a16098b47..44481da7c6d 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -873,7 +873,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf) + { + unsigned i; + utf16len = sz - 1; +- utf16 = grub_malloc (utf16len * sizeof (utf16[0])); ++ utf16 = grub_calloc (utf16len, sizeof (utf16[0])); + if (!utf16) + return NULL; + for (i = 0; i < utf16len; i++) +@@ -883,7 +883,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf) + { + unsigned i; + utf16len = (sz - 1) / 2; +- utf16 = grub_malloc (utf16len * sizeof (utf16[0])); ++ utf16 = grub_calloc (utf16len, sizeof (utf16[0])); + if (!utf16) + return NULL; + for (i = 0; i < utf16len; i++) +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 6e1fff9e9ae..f6b95d4fb02 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -3325,7 +3325,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + } + subvol->nkeys = 0; + zap_iterate (&keychain_dn, 8, count_zap_keys, &ctx, data); +- subvol->keyring = grub_zalloc (subvol->nkeys * sizeof (subvol->keyring[0])); ++ subvol->keyring = grub_calloc (subvol->nkeys, sizeof (subvol->keyring[0])); + if (!subvol->keyring) + { + grub_free (fsname); +@@ -4336,7 +4336,7 @@ grub_zfs_embed (grub_device_t device __attribute__ ((unused)), + *nsectors = (VDEV_BOOT_SIZE >> GRUB_DISK_SECTOR_BITS); + if (*nsectors > max_nsectors) + *nsectors = max_nsectors; +- *sectors = grub_malloc (*nsectors * sizeof (**sectors)); ++ *sectors = grub_calloc (*nsectors, sizeof (**sectors)); + if (!*sectors) + return grub_errno; + for (i = 0; i < *nsectors; i++) +diff --git a/grub-core/gfxmenu/gui_string_util.c b/grub-core/gfxmenu/gui_string_util.c +index a9a415e3129..ba1e1eab319 100644 +--- a/grub-core/gfxmenu/gui_string_util.c ++++ b/grub-core/gfxmenu/gui_string_util.c +@@ -55,7 +55,7 @@ canonicalize_path (const char *path) + if (*p == '/') + components++; + +- char **path_array = grub_malloc (components * sizeof (*path_array)); ++ char **path_array = grub_calloc (components, sizeof (*path_array)); + if (! path_array) + return 0; + +diff --git a/grub-core/gfxmenu/widget-box.c b/grub-core/gfxmenu/widget-box.c +index b6060288914..470597ded2b 100644 +--- a/grub-core/gfxmenu/widget-box.c ++++ b/grub-core/gfxmenu/widget-box.c +@@ -303,10 +303,10 @@ grub_gfxmenu_create_box (const char *pixmaps_prefix, + box->content_height = 0; + box->raw_pixmaps = + (struct grub_video_bitmap **) +- grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *)); ++ grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *)); + box->scaled_pixmaps = + (struct grub_video_bitmap **) +- grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *)); ++ grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *)); + + /* Initialize all pixmap pointers to NULL so that proper destruction can + be performed if an error is encountered partway through construction. */ +diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c +index 86ea8cfdea2..7024cda84ea 100644 +--- a/grub-core/io/gzio.c ++++ b/grub-core/io/gzio.c +@@ -554,7 +554,7 @@ huft_build (unsigned *b, /* code lengths in bits (all assumed <= BMAX) */ + z = 1 << j; /* table entries for j-bit table */ + + /* allocate and link in new table */ +- q = (struct huft *) grub_zalloc ((z + 1) * sizeof (struct huft)); ++ q = (struct huft *) grub_calloc (z + 1, sizeof (struct huft)); + if (! q) + { + if (h) +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 1079ac74a47..5cc4d8f84ed 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -207,7 +207,7 @@ grub_efi_set_variable(const char *var, const grub_efi_guid_t *guid, + + len = grub_strlen (var); + len16 = len * GRUB_MAX_UTF16_PER_UTF8; +- var16 = grub_malloc ((len16 + 1) * sizeof (var16[0])); ++ var16 = grub_calloc (len16 + 1, sizeof (var16[0])); + if (!var16) + return grub_errno; + len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL); +@@ -245,7 +245,7 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid, + + len = grub_strlen (var); + len16 = len * GRUB_MAX_UTF16_PER_UTF8; +- var16 = grub_malloc ((len16 + 1) * sizeof (var16[0])); ++ var16 = grub_calloc (len16 + 1, sizeof (var16[0])); + if (!var16) + return NULL; + len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL); +@@ -387,6 +387,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + { + grub_efi_file_path_device_path_t *fp; + grub_efi_uint16_t len; ++ grub_efi_char16_t *dup_name; + + *p++ = '/'; + +@@ -397,7 +398,16 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + while (len > 0 && fp->path_name[len - 1] == 0) + len--; + +- p = (char *) grub_utf16_to_utf8 ((unsigned char *) p, fp->path_name, len); ++ dup_name = grub_calloc (len, sizeof (*dup_name)); ++ if (!dup_name) ++ { ++ grub_free (name); ++ return NULL; ++ } ++ p = (char *) grub_utf16_to_utf8 ((unsigned char *) p, ++ grub_memcpy (dup_name, fp->path_name, len * sizeof (*dup_name)), ++ len); ++ grub_free (dup_name); + } + + dp = GRUB_EFI_NEXT_DEVICE_PATH (dp); +@@ -887,9 +897,20 @@ grub_efi_print_device_path (grub_efi_device_path_t *dp) + fp = (grub_efi_file_path_device_path_t *) dp; + buf = grub_malloc ((len - 4) * 2 + 1); + if (buf) +- *grub_utf16_to_utf8 (buf, fp->path_name, +- (len - 4) / sizeof (grub_efi_char16_t)) +- = '\0'; ++ { ++ grub_efi_char16_t *dup_name = grub_malloc (len - 4); ++ if (!dup_name) ++ { ++ grub_errno = GRUB_ERR_NONE; ++ grub_printf("/File((null))"); ++ grub_free (buf); ++ break; ++ } ++ *grub_utf16_to_utf8 (buf, grub_memcpy (dup_name, fp->path_name, len - 4), ++ (len - 4) / sizeof (grub_efi_char16_t)) ++ = '\0'; ++ grub_free (dup_name); ++ } + else + grub_errno = GRUB_ERR_NONE; + grub_printf ("/File(%s)", buf); +diff --git a/grub-core/kern/emu/hostdisk.c b/grub-core/kern/emu/hostdisk.c +index 87e3e251204..f57bd334c9e 100644 +--- a/grub-core/kern/emu/hostdisk.c ++++ b/grub-core/kern/emu/hostdisk.c +@@ -615,7 +615,7 @@ static char * + grub_util_path_concat_real (size_t n, int ext, va_list ap) + { + size_t totlen = 0; +- char **l = xmalloc ((n + ext) * sizeof (l[0])); ++ char **l = xcalloc (n + ext, sizeof (l[0])); + char *r, *p, *pi; + size_t i; + int first = 1; +diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c +index 1bd748be83b..730d21770f2 100644 +--- a/grub-core/kern/fs.c ++++ b/grub-core/kern/fs.c +@@ -151,7 +151,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name) + while (p); + + /* Allocate a block list. */ +- blocks = grub_zalloc (sizeof (struct grub_fs_block) * (num + 1)); ++ blocks = grub_calloc (num + 1, sizeof (struct grub_fs_block)); + if (! blocks) + return 0; + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 2477eb609ba..3d2969f131c 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -748,7 +748,7 @@ parse_printf_args (const char *fmt0, struct printf_args *args, + args->ptr = args->prealloc; + else + { +- args->ptr = grub_malloc (args->count * sizeof (args->ptr[0])); ++ args->ptr = grub_calloc (args->count, sizeof (args->ptr[0])); + if (!args->ptr) + { + grub_errno = GRUB_ERR_NONE; +diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c +index 78175aac2d3..619db3122a0 100644 +--- a/grub-core/kern/parser.c ++++ b/grub-core/kern/parser.c +@@ -213,7 +213,7 @@ grub_parser_split_cmdline (const char *cmdline, + return grub_errno; + grub_memcpy (args, buffer, bp - buffer); + +- *argv = grub_malloc (sizeof (char *) * (*argc + 1)); ++ *argv = grub_calloc (*argc + 1, sizeof (char *)); + if (!*argv) + { + grub_free (args); +diff --git a/grub-core/kern/uboot/uboot.c b/grub-core/kern/uboot/uboot.c +index cf0168e62dd..efa10f2849d 100644 +--- a/grub-core/kern/uboot/uboot.c ++++ b/grub-core/kern/uboot/uboot.c +@@ -133,7 +133,7 @@ grub_uboot_dev_enum (void) + return num_devices; + + max_devices = 2; +- enum_devices = grub_malloc (sizeof(struct device_info) * max_devices); ++ enum_devices = grub_calloc (max_devices, sizeof(struct device_info)); + if (!enum_devices) + return 0; + +diff --git a/grub-core/lib/libgcrypt/cipher/ac.c b/grub-core/lib/libgcrypt/cipher/ac.c +index f5e946a2d8f..63f6fcd11ef 100644 +--- a/grub-core/lib/libgcrypt/cipher/ac.c ++++ b/grub-core/lib/libgcrypt/cipher/ac.c +@@ -185,7 +185,7 @@ ac_data_mpi_copy (gcry_ac_mpi_t *data_mpis, unsigned int data_mpis_n, + gcry_mpi_t mpi; + char *label; + +- data_mpis_new = gcry_malloc (sizeof (*data_mpis_new) * data_mpis_n); ++ data_mpis_new = gcry_calloc (data_mpis_n, sizeof (*data_mpis_new)); + if (! data_mpis_new) + { + err = gcry_error_from_errno (errno); +@@ -572,7 +572,7 @@ _gcry_ac_data_to_sexp (gcry_ac_data_t data, gcry_sexp_t *sexp, + } + + /* Add MPI list. */ +- arg_list = gcry_malloc (sizeof (*arg_list) * (data_n + 1)); ++ arg_list = gcry_calloc (data_n + 1, sizeof (*arg_list)); + if (! arg_list) + { + err = gcry_error_from_errno (errno); +@@ -1283,7 +1283,7 @@ ac_data_construct (const char *identifier, int include_flags, + /* We build a list of arguments to pass to + gcry_sexp_build_array(). */ + data_length = _gcry_ac_data_length (data); +- arg_list = gcry_malloc (sizeof (*arg_list) * (data_length * 2)); ++ arg_list = gcry_calloc (data_length, sizeof (*arg_list) * 2); + if (! arg_list) + { + err = gcry_error_from_errno (errno); +@@ -1593,7 +1593,7 @@ _gcry_ac_key_pair_generate (gcry_ac_handle_t handle, unsigned int nbits, + arg_list_n += 2; + + /* Allocate list. */ +- arg_list = gcry_malloc (sizeof (*arg_list) * arg_list_n); ++ arg_list = gcry_calloc (arg_list_n, sizeof (*arg_list)); + if (! arg_list) + { + err = gcry_error_from_errno (errno); +diff --git a/grub-core/lib/libgcrypt/cipher/primegen.c b/grub-core/lib/libgcrypt/cipher/primegen.c +index 2788e349fa9..b12e79b1922 100644 +--- a/grub-core/lib/libgcrypt/cipher/primegen.c ++++ b/grub-core/lib/libgcrypt/cipher/primegen.c +@@ -383,7 +383,7 @@ prime_generate_internal (int need_q_factor, + } + + /* Allocate an array to track pool usage. */ +- pool_in_use = gcry_malloc (n * sizeof *pool_in_use); ++ pool_in_use = gcry_calloc (n, sizeof *pool_in_use); + if (!pool_in_use) + { + err = gpg_err_code_from_errno (errno); +@@ -765,7 +765,7 @@ gen_prime (unsigned int nbits, int secret, int randomlevel, + if (nbits < 16) + log_fatal ("can't generate a prime with less than %d bits\n", 16); + +- mods = gcry_xmalloc( no_of_small_prime_numbers * sizeof *mods ); ++ mods = gcry_xcalloc( no_of_small_prime_numbers, sizeof *mods); + /* Make nbits fit into gcry_mpi_t implementation. */ + val_2 = mpi_alloc_set_ui( 2 ); + val_3 = mpi_alloc_set_ui( 3); +diff --git a/grub-core/lib/libgcrypt/cipher/pubkey.c b/grub-core/lib/libgcrypt/cipher/pubkey.c +index 910982141e0..ca087ad75b9 100644 +--- a/grub-core/lib/libgcrypt/cipher/pubkey.c ++++ b/grub-core/lib/libgcrypt/cipher/pubkey.c +@@ -2941,7 +2941,7 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t s_pkey) + * array to a format string, so we have to do it this way :-(. */ + /* FIXME: There is now such a format specifier, so we can + change the code to be more clear. */ +- arg_list = malloc (nelem * sizeof *arg_list); ++ arg_list = calloc (nelem, sizeof *arg_list); + if (!arg_list) + { + rc = gpg_err_code_from_syserror (); +@@ -3233,7 +3233,7 @@ gcry_pk_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_hash, gcry_sexp_t s_skey) + } + strcpy (p, "))"); + +- arg_list = malloc (nelem * sizeof *arg_list); ++ arg_list = calloc (nelem, sizeof *arg_list); + if (!arg_list) + { + rc = gpg_err_code_from_syserror (); +diff --git a/grub-core/lib/priority_queue.c b/grub-core/lib/priority_queue.c +index 659be0b7f40..7d5e7c05aab 100644 +--- a/grub-core/lib/priority_queue.c ++++ b/grub-core/lib/priority_queue.c +@@ -92,7 +92,7 @@ grub_priority_queue_new (grub_size_t elsize, + { + struct grub_priority_queue *ret; + void *els; +- els = grub_malloc (elsize * 8); ++ els = grub_calloc (8, elsize); + if (!els) + return 0; + ret = (struct grub_priority_queue *) grub_malloc (sizeof (*ret)); +diff --git a/grub-core/lib/reed_solomon.c b/grub-core/lib/reed_solomon.c +index 19c20085279..79037c093f7 100644 +--- a/grub-core/lib/reed_solomon.c ++++ b/grub-core/lib/reed_solomon.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#define xcalloc calloc + #define xmalloc malloc + #define grub_memset memset + #define grub_memcpy memcpy +@@ -158,11 +159,9 @@ rs_encode (gf_single_t *data, grub_size_t s, grub_size_t rs) + gf_single_t *rs_polynomial; + unsigned int i, j; + gf_single_t *m; +- m = xmalloc ((s + rs) * sizeof (gf_single_t)); ++ m = xcalloc (s + rs, sizeof (gf_single_t)); + grub_memcpy (m, data, s * sizeof (gf_single_t)); +- grub_memset (m + s, 0, rs * sizeof (gf_single_t)); +- rs_polynomial = xmalloc ((rs + 1) * sizeof (gf_single_t)); +- grub_memset (rs_polynomial, 0, (rs + 1) * sizeof (gf_single_t)); ++ rs_polynomial = xcalloc (rs + 1, sizeof (gf_single_t)); + rs_polynomial[rs] = 1; + /* Multiply with X - a^r */ + for (j = 0; j < rs; j++) +diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c +index ea3ebc719b1..5847aac3643 100644 +--- a/grub-core/lib/relocator.c ++++ b/grub-core/lib/relocator.c +@@ -495,9 +495,9 @@ malloc_in_range (struct grub_relocator *rel, + } + #endif + +- eventt = grub_malloc (maxevents * sizeof (events[0])); ++ eventt = grub_calloc (maxevents, sizeof (events[0])); + counter = grub_malloc ((DIGITSORT_MASK + 2) * sizeof (counter[0])); +- events = grub_malloc (maxevents * sizeof (events[0])); ++ events = grub_calloc (maxevents, sizeof (events[0])); + if (!events || !eventt || !counter) + { + grub_dprintf ("relocator", "events or counter allocation failed %d\n", +@@ -963,7 +963,7 @@ malloc_in_range (struct grub_relocator *rel, + #endif + unsigned cural = 0; + int oom = 0; +- res->subchunks = grub_malloc (sizeof (res->subchunks[0]) * nallocs); ++ res->subchunks = grub_calloc (nallocs, sizeof (res->subchunks[0])); + if (!res->subchunks) + oom = 1; + res->nsubchunks = nallocs; +@@ -1562,8 +1562,8 @@ grub_relocator_prepare_relocs (struct grub_relocator *rel, grub_addr_t addr, + count[(chunk->src & 0xff) + 1]++; + } + } +- from = grub_malloc (nchunks * sizeof (sorted[0])); +- to = grub_malloc (nchunks * sizeof (sorted[0])); ++ from = grub_calloc (nchunks, sizeof (sorted[0])); ++ to = grub_calloc (nchunks, sizeof (sorted[0])); + if (!from || !to) + { + grub_free (from); +diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c +index 5f5723b4b8f..c4faa343ef2 100644 +--- a/grub-core/loader/arm/linux.c ++++ b/grub-core/loader/arm/linux.c +@@ -78,7 +78,7 @@ linux_prepare_atag (void *target_atag) + + /* some place for cmdline, initrd and terminator. */ + tmp_size = get_atag_size (atag_orig) + 20 + (arg_size) / 4; +- tmp_atag = grub_malloc (tmp_size * sizeof (grub_uint32_t)); ++ tmp_atag = grub_calloc (tmp_size, sizeof (grub_uint32_t)); + if (!tmp_atag) + return grub_errno; + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 3630b0cbf2d..2da119ad513 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -119,18 +119,23 @@ static void + copy_file_path (grub_efi_file_path_device_path_t *fp, + const char *str, grub_efi_uint16_t len) + { +- grub_efi_char16_t *p; ++ grub_efi_char16_t *p, *path_name; + grub_efi_uint16_t size; + + fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE; + fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE; + +- size = grub_utf8_to_utf16 (fp->path_name, len * GRUB_MAX_UTF16_PER_UTF8, ++ path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name)); ++ if (!path_name) ++ return; ++ ++ size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8, + (const grub_uint8_t *) str, len, 0); +- for (p = fp->path_name; p < fp->path_name + size; p++) ++ for (p = path_name; p < path_name + size; p++) + if (*p == '/') + *p = '\\'; + ++ grub_memcpy (fp->path_name, path_name, size * sizeof (*fp->path_name)); + /* File Path is NULL terminated */ + fp->path_name[size++] = '\0'; + fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp); +diff --git a/grub-core/loader/i386/bsdXX.c b/grub-core/loader/i386/bsdXX.c +index af6741d157c..a8d8bf7daed 100644 +--- a/grub-core/loader/i386/bsdXX.c ++++ b/grub-core/loader/i386/bsdXX.c +@@ -48,7 +48,7 @@ read_headers (grub_file_t file, const char *filename, Elf_Ehdr *e, char **shdr) + if (e->e_ident[EI_CLASS] != SUFFIX (ELFCLASS)) + return grub_error (GRUB_ERR_BAD_OS, N_("invalid arch-dependent ELF magic")); + +- *shdr = grub_malloc ((grub_uint32_t) e->e_shnum * e->e_shentsize); ++ *shdr = grub_calloc (e->e_shnum, e->e_shentsize); + if (! *shdr) + return grub_errno; + +diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c +index 59ef73a7385..ee0eaadc4ee 100644 +--- a/grub-core/loader/i386/xnu.c ++++ b/grub-core/loader/i386/xnu.c +@@ -295,7 +295,7 @@ grub_xnu_devprop_add_property_utf8 (struct grub_xnu_devprop_device_descriptor *d + return grub_errno; + + len = grub_strlen (name); +- utf16 = grub_malloc (sizeof (grub_uint16_t) * len); ++ utf16 = grub_calloc (len, sizeof (grub_uint16_t)); + if (!utf16) + { + grub_free (utf8); +@@ -331,7 +331,7 @@ grub_xnu_devprop_add_property_utf16 (struct grub_xnu_devprop_device_descriptor * + grub_uint16_t *utf16; + grub_err_t err; + +- utf16 = grub_malloc (sizeof (grub_uint16_t) * namelen); ++ utf16 = grub_calloc (namelen, sizeof (grub_uint16_t)); + if (!utf16) + return grub_errno; + grub_memcpy (utf16, name, sizeof (grub_uint16_t) * namelen); +diff --git a/grub-core/loader/macho.c b/grub-core/loader/macho.c +index 59b195e27ea..f61341af515 100644 +--- a/grub-core/loader/macho.c ++++ b/grub-core/loader/macho.c +@@ -97,7 +97,7 @@ grub_macho_file (grub_file_t file, const char *filename, int is_64bit) + if (grub_file_seek (macho->file, sizeof (struct grub_macho_fat_header)) + == (grub_off_t) -1) + goto fail; +- archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs); ++ archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch)); + if (!archs) + goto fail; + if (grub_file_read (macho->file, archs, +diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c +index 70cd1db513e..cc6853692a8 100644 +--- a/grub-core/loader/multiboot_elfxx.c ++++ b/grub-core/loader/multiboot_elfxx.c +@@ -217,7 +217,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld) + { + grub_uint8_t *shdr, *shdrptr; + +- shdr = grub_malloc ((grub_uint32_t) ehdr->e_shnum * ehdr->e_shentsize); ++ shdr = grub_calloc (ehdr->e_shnum, ehdr->e_shentsize); + if (!shdr) + return grub_errno; + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index df8dfdb4ba0..dc7d5409e1e 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -792,7 +792,7 @@ grub_cmd_xnu_mkext (grub_command_t cmd __attribute__ ((unused)), + if (grub_be_to_cpu32 (head.magic) == GRUB_MACHO_FAT_MAGIC) + { + narchs = grub_be_to_cpu32 (head.nfat_arch); +- archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs); ++ archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch)); + if (! archs) + { + grub_file_close (file); +diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c +index 6a31cbae325..57b4e9a72a9 100644 +--- a/grub-core/mmap/mmap.c ++++ b/grub-core/mmap/mmap.c +@@ -143,9 +143,9 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data) + + /* Initialize variables. */ + ctx.scanline_events = (struct grub_mmap_scan *) +- grub_malloc (sizeof (struct grub_mmap_scan) * 2 * mmap_num); ++ grub_calloc (mmap_num, sizeof (struct grub_mmap_scan) * 2); + +- present = grub_zalloc (sizeof (present[0]) * current_priority); ++ present = grub_calloc (current_priority, sizeof (present[0])); + + if (! ctx.scanline_events || !present) + { +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index 8b6fc9f2411..adf36fa4a9d 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -1326,7 +1326,7 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)), + if (ncards == 0) + return grub_error (GRUB_ERR_NET_NO_CARD, N_("no network card found")); + +- ifaces = grub_zalloc (ncards * sizeof (ifaces[0])); ++ ifaces = grub_calloc (ncards, sizeof (ifaces[0])); + if (!ifaces) + return grub_errno; + +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index 5d9afe093c0..e332d5eb4a4 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -285,8 +285,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)), + ptr++; + ptr += 4; + } +- *data->addresses = grub_malloc (sizeof ((*data->addresses)[0]) +- * grub_be_to_cpu16 (head->ancount)); ++ *data->addresses = grub_calloc (grub_be_to_cpu16 (head->ancount), ++ sizeof ((*data->addresses)[0])); + if (!*data->addresses) + { + grub_errno = GRUB_ERR_NONE; +@@ -406,8 +406,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)), + dns_cache[h].addresses = 0; + dns_cache[h].name = grub_strdup (data->oname); + dns_cache[h].naddresses = *data->naddresses; +- dns_cache[h].addresses = grub_malloc (*data->naddresses +- * sizeof (dns_cache[h].addresses[0])); ++ dns_cache[h].addresses = grub_calloc (*data->naddresses, ++ sizeof (dns_cache[h].addresses[0])); + dns_cache[h].limit_time = grub_get_time_ms () + 1000 * ttl_all; + if (!dns_cache[h].addresses || !dns_cache[h].name) + { +@@ -479,7 +479,7 @@ grub_net_dns_lookup (const char *name, + } + } + +- sockets = grub_malloc (sizeof (sockets[0]) * n_servers); ++ sockets = grub_calloc (n_servers, sizeof (sockets[0])); + if (!sockets) + return grub_errno; + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 19ff2d486a1..0e72bbb9b39 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -338,8 +338,8 @@ grub_cmd_ipv6_autoconf (struct grub_command *cmd __attribute__ ((unused)), + ncards++; + } + +- ifaces = grub_zalloc (ncards * sizeof (ifaces[0])); +- slaacs = grub_zalloc (ncards * sizeof (slaacs[0])); ++ ifaces = grub_calloc (ncards, sizeof (ifaces[0])); ++ slaacs = grub_calloc (ncards, sizeof (slaacs[0])); + if (!ifaces || !slaacs) + { + grub_free (ifaces); +diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c +index b0ab47d73fd..d57fb72faa8 100644 +--- a/grub-core/normal/charset.c ++++ b/grub-core/normal/charset.c +@@ -203,7 +203,7 @@ grub_utf8_to_ucs4_alloc (const char *msg, grub_uint32_t **unicode_msg, + { + grub_size_t msg_len = grub_strlen (msg); + +- *unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t)); ++ *unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t)); + + if (!*unicode_msg) + return -1; +@@ -488,7 +488,7 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen, + } + else + { +- n = grub_malloc (sizeof (n[0]) * (out->ncomb + 1)); ++ n = grub_calloc (out->ncomb + 1, sizeof (n[0])); + if (!n) + { + grub_errno = GRUB_ERR_NONE; +@@ -842,7 +842,7 @@ grub_bidi_line_logical_to_visual (const grub_uint32_t *logical, + } \ + } + +- visual = grub_malloc (sizeof (visual[0]) * logical_len); ++ visual = grub_calloc (logical_len, sizeof (visual[0])); + if (!visual) + return -1; + +@@ -1165,8 +1165,8 @@ grub_bidi_logical_to_visual (const grub_uint32_t *logical, + { + const grub_uint32_t *line_start = logical, *ptr; + struct grub_unicode_glyph *visual_ptr; +- *visual_out = visual_ptr = grub_malloc (3 * sizeof (visual_ptr[0]) +- * (logical_len + 2)); ++ *visual_out = visual_ptr = grub_calloc (logical_len + 2, ++ 3 * sizeof (visual_ptr[0])); + if (!visual_ptr) + return -1; + for (ptr = logical; ptr <= logical + logical_len; ptr++) +diff --git a/grub-core/normal/cmdline.c b/grub-core/normal/cmdline.c +index c037d5050ed..c57242e2ea9 100644 +--- a/grub-core/normal/cmdline.c ++++ b/grub-core/normal/cmdline.c +@@ -41,7 +41,7 @@ grub_err_t + grub_set_history (int newsize) + { + grub_uint32_t **old_hist_lines = hist_lines; +- hist_lines = grub_malloc (sizeof (grub_uint32_t *) * newsize); ++ hist_lines = grub_calloc (newsize, sizeof (grub_uint32_t *)); + + /* Copy the old lines into the new buffer. */ + if (old_hist_lines) +@@ -114,7 +114,7 @@ static void + grub_history_set (int pos, grub_uint32_t *s, grub_size_t len) + { + grub_free (hist_lines[pos]); +- hist_lines[pos] = grub_malloc ((len + 1) * sizeof (grub_uint32_t)); ++ hist_lines[pos] = grub_calloc (len + 1, sizeof (grub_uint32_t)); + if (!hist_lines[pos]) + { + grub_print_error (); +@@ -349,7 +349,7 @@ grub_cmdline_get (const char *prompt_translated) + char *ret; + unsigned nterms; + +- buf = grub_malloc (max_len * sizeof (grub_uint32_t)); ++ buf = grub_calloc (max_len, sizeof (grub_uint32_t)); + if (!buf) + return 0; + +@@ -377,7 +377,7 @@ grub_cmdline_get (const char *prompt_translated) + FOR_ACTIVE_TERM_OUTPUTS(cur) + nterms++; + +- cl_terms = grub_malloc (sizeof (cl_terms[0]) * nterms); ++ cl_terms = grub_calloc (nterms, sizeof (cl_terms[0])); + if (!cl_terms) + { + grub_free (buf); +@@ -385,7 +385,7 @@ grub_cmdline_get (const char *prompt_translated) + } + cl_term_cur = cl_terms; + +- unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t)); ++ unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t)); + if (!unicode_msg) + { + grub_free (buf); +@@ -495,7 +495,7 @@ grub_cmdline_get (const char *prompt_translated) + grub_uint32_t *insert; + + insertlen = grub_strlen (insertu8); +- insert = grub_malloc ((insertlen + 1) * sizeof (grub_uint32_t)); ++ insert = grub_calloc (insertlen + 1, sizeof (grub_uint32_t)); + if (!insert) + { + grub_free (insertu8); +@@ -602,7 +602,7 @@ grub_cmdline_get (const char *prompt_translated) + + grub_free (kill_buf); + +- kill_buf = grub_malloc ((n + 1) * sizeof(grub_uint32_t)); ++ kill_buf = grub_calloc (n + 1, sizeof (grub_uint32_t)); + if (grub_errno) + { + grub_print_error (); +diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c +index 5785f67ee1c..f31487c1f58 100644 +--- a/grub-core/normal/menu_entry.c ++++ b/grub-core/normal/menu_entry.c +@@ -95,8 +95,8 @@ init_line (struct screen *screen, struct line *linep) + { + linep->len = 0; + linep->max_len = 80; +- linep->buf = grub_malloc ((linep->max_len + 1) * sizeof (linep->buf[0])); +- linep->pos = grub_zalloc (screen->nterms * sizeof (linep->pos[0])); ++ linep->buf = grub_calloc (linep->max_len + 1, sizeof (linep->buf[0])); ++ linep->pos = grub_calloc (screen->nterms, sizeof (linep->pos[0])); + if (! linep->buf || !linep->pos) + { + grub_free (linep->buf); +@@ -287,7 +287,7 @@ update_screen (struct screen *screen, struct per_term_screen *term_screen, + pos = linep->pos + (term_screen - screen->terms); + + if (!*pos) +- *pos = grub_zalloc ((linep->len + 1) * sizeof (**pos)); ++ *pos = grub_calloc (linep->len + 1, sizeof (**pos)); + + if (i == region_start || linep == screen->lines + screen->line + || (i > region_start && mode == ALL_LINES)) +@@ -471,7 +471,7 @@ insert_string (struct screen *screen, const char *s, int update) + + /* Insert the string. */ + current_linep = screen->lines + screen->line; +- unicode_msg = grub_malloc ((p - s) * sizeof (grub_uint32_t)); ++ unicode_msg = grub_calloc (p - s, sizeof (grub_uint32_t)); + + if (!unicode_msg) + return 0; +@@ -1023,7 +1023,7 @@ complete (struct screen *screen, int continuous, int update) + if (completion_buffer.buf) + { + buflen = grub_strlen (completion_buffer.buf); +- ucs4 = grub_malloc (sizeof (grub_uint32_t) * (buflen + 1)); ++ ucs4 = grub_calloc (buflen + 1, sizeof (grub_uint32_t)); + + if (!ucs4) + { +@@ -1265,7 +1265,7 @@ grub_menu_entry_run (grub_menu_entry_t entry) + for (i = 0; i < (unsigned) screen->num_lines; i++) + { + grub_free (screen->lines[i].pos); +- screen->lines[i].pos = grub_zalloc (screen->nterms * sizeof (screen->lines[i].pos[0])); ++ screen->lines[i].pos = grub_calloc (screen->nterms, sizeof (screen->lines[i].pos[0])); + if (! screen->lines[i].pos) + { + grub_print_error (); +@@ -1275,7 +1275,7 @@ grub_menu_entry_run (grub_menu_entry_t entry) + } + } + +- screen->terms = grub_zalloc (screen->nterms * sizeof (screen->terms[0])); ++ screen->terms = grub_calloc (screen->nterms, sizeof (screen->terms[0])); + if (!screen->terms) + { + grub_print_error (); +diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c +index 7681f7d2893..ca135624356 100644 +--- a/grub-core/normal/menu_text.c ++++ b/grub-core/normal/menu_text.c +@@ -78,7 +78,7 @@ grub_print_message_indented_real (const char *msg, int margin_left, + grub_size_t msg_len = grub_strlen (msg) + 2; + int ret = 0; + +- unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t)); ++ unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t)); + + if (!unicode_msg) + return 0; +@@ -167,7 +167,7 @@ print_entry (int y, int highlight, grub_menu_entry_t entry, + + title = entry ? entry->title : ""; + title_len = grub_strlen (title); +- unicode_title = grub_malloc (title_len * sizeof (*unicode_title)); ++ unicode_title = grub_calloc (title_len, sizeof (*unicode_title)); + if (! unicode_title) + /* XXX How to show this error? */ + return; +diff --git a/grub-core/normal/term.c b/grub-core/normal/term.c +index ac5d69f0fb5..93a3a0d912e 100644 +--- a/grub-core/normal/term.c ++++ b/grub-core/normal/term.c +@@ -264,7 +264,7 @@ grub_term_save_pos (void) + FOR_ACTIVE_TERM_OUTPUTS(cur) + cnt++; + +- ret = grub_malloc (cnt * sizeof (ret[0])); ++ ret = grub_calloc (cnt, sizeof (ret[0])); + if (!ret) + return NULL; + +@@ -1013,7 +1013,7 @@ grub_xnputs (const char *str, grub_size_t msg_len) + + grub_error_push (); + +- unicode_str = grub_malloc (msg_len * sizeof (grub_uint32_t)); ++ unicode_str = grub_calloc (msg_len, sizeof (grub_uint32_t)); + + grub_error_pop (); + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index 36429a7cd25..f0c503f43d3 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -176,7 +176,7 @@ grub_util_raid_getmembers (const char *name, int bootable) + if (ret != 0) + grub_util_error (_("ioctl GET_ARRAY_INFO error: %s"), strerror (errno)); + +- devicelist = xmalloc ((info.nr_disks + 1) * sizeof (char *)); ++ devicelist = xcalloc (info.nr_disks + 1, sizeof (char *)); + + for (i = 0, j = 0; j < info.nr_disks; i++) + { +@@ -249,7 +249,7 @@ grub_find_root_devices_from_btrfs (const char *dir) + return NULL; + } + +- ret = xmalloc ((fsi.num_devices + 1) * sizeof (ret[0])); ++ ret = xcalloc (fsi.num_devices + 1, sizeof (ret[0])); + + for (i = 1; i <= fsi.max_id && j < fsi.num_devices; i++) + { +@@ -508,7 +508,7 @@ grub_find_root_devices_from_mountinfo (const char *dir, char **relroot) + if (relroot) + *relroot = NULL; + +- entries = xmalloc (entry_max * sizeof (*entries)); ++ entries = xcalloc (entry_max, sizeof (*entries)); + + again: + fp = grub_util_fopen ("/proc/self/mountinfo", "r"); +diff --git a/grub-core/osdep/unix/config.c b/grub-core/osdep/unix/config.c +index b637c58efb7..46a881530c0 100644 +--- a/grub-core/osdep/unix/config.c ++++ b/grub-core/osdep/unix/config.c +@@ -102,7 +102,7 @@ grub_util_load_config (struct grub_util_config *cfg) + argv[0] = "sh"; + argv[1] = "-c"; + +- script = xmalloc (4 * strlen (cfgfile) + 300); ++ script = xcalloc (4, strlen (cfgfile) + 300); + + ptr = script; + memcpy (ptr, ". '", 3); +diff --git a/grub-core/osdep/windows/getroot.c b/grub-core/osdep/windows/getroot.c +index 661d9546192..eada663b261 100644 +--- a/grub-core/osdep/windows/getroot.c ++++ b/grub-core/osdep/windows/getroot.c +@@ -59,7 +59,7 @@ grub_get_mount_point (const TCHAR *path) + + for (ptr = path; *ptr; ptr++); + allocsize = (ptr - path + 10) * 2; +- out = xmalloc (allocsize * sizeof (out[0])); ++ out = xcalloc (allocsize, sizeof (out[0])); + + /* When pointing to EFI system partition GetVolumePathName fails + for ESP root and returns abberant information for everything +diff --git a/grub-core/osdep/windows/hostdisk.c b/grub-core/osdep/windows/hostdisk.c +index 6f49df465d7..580b3f2dae7 100644 +--- a/grub-core/osdep/windows/hostdisk.c ++++ b/grub-core/osdep/windows/hostdisk.c +@@ -111,7 +111,7 @@ grub_util_get_windows_path_real (const char *path) + + while (1) + { +- fpa = xmalloc (alloc * sizeof (fpa[0])); ++ fpa = xcalloc (alloc, sizeof (fpa[0])); + + len = GetFullPathName (tpath, alloc, fpa, NULL); + if (len >= alloc) +@@ -393,7 +393,7 @@ grub_util_fd_opendir (const char *name) + for (l = 0; name_windows[l]; l++); + for (l--; l >= 0 && (name_windows[l] == '\\' || name_windows[l] == '/'); l--); + l++; +- pattern = xmalloc ((l + 3) * sizeof (pattern[0])); ++ pattern = xcalloc (l + 3, sizeof (pattern[0])); + memcpy (pattern, name_windows, l * sizeof (pattern[0])); + pattern[l] = '\\'; + pattern[l + 1] = '*'; +diff --git a/grub-core/osdep/windows/init.c b/grub-core/osdep/windows/init.c +index e8ffd62c6a0..6297de6326a 100644 +--- a/grub-core/osdep/windows/init.c ++++ b/grub-core/osdep/windows/init.c +@@ -161,7 +161,7 @@ grub_util_host_init (int *argc __attribute__ ((unused)), + LPWSTR *targv; + + targv = CommandLineToArgvW (tcmdline, argc); +- *argv = xmalloc ((*argc + 1) * sizeof (argv[0])); ++ *argv = xcalloc (*argc + 1, sizeof (argv[0])); + + for (i = 0; i < *argc; i++) + (*argv)[i] = grub_util_tchar_to_utf8 (targv[i]); +diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c +index 912269191eb..04e0eda9aeb 100644 +--- a/grub-core/osdep/windows/platform.c ++++ b/grub-core/osdep/windows/platform.c +@@ -225,8 +225,8 @@ grub_install_register_efi (grub_device_t efidir_grub_dev, + grub_util_error ("%s", _("no EFI routines are available when running in BIOS mode")); + + distrib8_len = grub_strlen (efi_distributor); +- distributor16 = xmalloc ((distrib8_len + 1) * GRUB_MAX_UTF16_PER_UTF8 +- * sizeof (grub_uint16_t)); ++ distributor16 = xcalloc (distrib8_len + 1, ++ GRUB_MAX_UTF16_PER_UTF8 * sizeof (grub_uint16_t)); + distrib16_len = grub_utf8_to_utf16 (distributor16, distrib8_len * GRUB_MAX_UTF16_PER_UTF8, + (const grub_uint8_t *) efi_distributor, + distrib8_len, 0); +diff --git a/grub-core/osdep/windows/relpath.c b/grub-core/osdep/windows/relpath.c +index cb0861744ae..478e8ef14d5 100644 +--- a/grub-core/osdep/windows/relpath.c ++++ b/grub-core/osdep/windows/relpath.c +@@ -72,7 +72,7 @@ grub_make_system_path_relative_to_its_root (const char *path) + if (dirwindows[0] && dirwindows[1] == ':') + offset = 2; + } +- ret = xmalloc (sizeof (ret[0]) * (flen - offset + 2)); ++ ret = xcalloc (flen - offset + 2, sizeof (ret[0])); + if (dirwindows[offset] != '\\' + && dirwindows[offset] != '/' + && dirwindows[offset]) +diff --git a/grub-core/partmap/gpt.c b/grub-core/partmap/gpt.c +index 103f6796f39..72a2e37cd48 100644 +--- a/grub-core/partmap/gpt.c ++++ b/grub-core/partmap/gpt.c +@@ -199,7 +199,7 @@ gpt_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors, + *nsectors = ctx.len; + if (*nsectors > max_nsectors) + *nsectors = max_nsectors; +- *sectors = grub_malloc (*nsectors * sizeof (**sectors)); ++ *sectors = grub_calloc (*nsectors, sizeof (**sectors)); + if (!*sectors) + return grub_errno; + for (i = 0; i < *nsectors; i++) +diff --git a/grub-core/partmap/msdos.c b/grub-core/partmap/msdos.c +index 6d4b455a19c..81ca6b90e67 100644 +--- a/grub-core/partmap/msdos.c ++++ b/grub-core/partmap/msdos.c +@@ -337,7 +337,7 @@ pc_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors, + avail_nsectors = *nsectors; + if (*nsectors > max_nsectors) + *nsectors = max_nsectors; +- *sectors = grub_malloc (*nsectors * sizeof (**sectors)); ++ *sectors = grub_calloc (*nsectors, sizeof (**sectors)); + if (!*sectors) + return grub_errno; + for (i = 0; i < *nsectors; i++) +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 7d327f59d92..528ddfd36f0 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -587,7 +587,7 @@ gettext_append (struct grub_script_argv *result, const char *orig_str) + for (iptr = orig_str; *iptr; iptr++) + if (*iptr == '$') + dollar_cnt++; +- ctx.allowed_strings = grub_malloc (sizeof (ctx.allowed_strings[0]) * dollar_cnt); ++ ctx.allowed_strings = grub_calloc (dollar_cnt, sizeof (ctx.allowed_strings[0])); + + if (parse_string (orig_str, gettext_save_allow, &ctx, 0)) + goto fail; +diff --git a/grub-core/tests/fake_input.c b/grub-core/tests/fake_input.c +index 2d60852989c..b5eb516be2d 100644 +--- a/grub-core/tests/fake_input.c ++++ b/grub-core/tests/fake_input.c +@@ -49,7 +49,7 @@ grub_terminal_input_fake_sequence (int *seq_in, int nseq_in) + saved = grub_term_inputs; + if (seq) + grub_free (seq); +- seq = grub_malloc (nseq_in * sizeof (seq[0])); ++ seq = grub_calloc (nseq_in, sizeof (seq[0])); + if (!seq) + return; + +diff --git a/grub-core/tests/video_checksum.c b/grub-core/tests/video_checksum.c +index 74d5b65e5c7..44d0810698a 100644 +--- a/grub-core/tests/video_checksum.c ++++ b/grub-core/tests/video_checksum.c +@@ -336,7 +336,7 @@ grub_video_capture_write_bmp (const char *fname, + { + case 4: + { +- grub_uint8_t *buffer = xmalloc (mode_info->width * 3); ++ grub_uint8_t *buffer = xcalloc (3, mode_info->width); + grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1); + grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1); + grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1); +@@ -367,7 +367,7 @@ grub_video_capture_write_bmp (const char *fname, + } + case 3: + { +- grub_uint8_t *buffer = xmalloc (mode_info->width * 3); ++ grub_uint8_t *buffer = xcalloc (3, mode_info->width); + grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1); + grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1); + grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1); +@@ -407,7 +407,7 @@ grub_video_capture_write_bmp (const char *fname, + } + case 2: + { +- grub_uint8_t *buffer = xmalloc (mode_info->width * 3); ++ grub_uint8_t *buffer = xcalloc (3, mode_info->width); + grub_uint16_t rmask = ((1 << mode_info->red_mask_size) - 1); + grub_uint16_t gmask = ((1 << mode_info->green_mask_size) - 1); + grub_uint16_t bmask = ((1 << mode_info->blue_mask_size) - 1); +diff --git a/grub-core/video/capture.c b/grub-core/video/capture.c +index 4f83c744116..4d3195e017b 100644 +--- a/grub-core/video/capture.c ++++ b/grub-core/video/capture.c +@@ -89,7 +89,7 @@ grub_video_capture_start (const struct grub_video_mode_info *mode_info, + framebuffer.mode_info = *mode_info; + framebuffer.mode_info.blit_format = grub_video_get_blit_format (&framebuffer.mode_info); + +- framebuffer.ptr = grub_malloc (framebuffer.mode_info.height * framebuffer.mode_info.pitch); ++ framebuffer.ptr = grub_calloc (framebuffer.mode_info.height, framebuffer.mode_info.pitch); + if (!framebuffer.ptr) + return grub_errno; + +diff --git a/grub-core/video/emu/sdl.c b/grub-core/video/emu/sdl.c +index a2f639f66de..0ebab6f57dd 100644 +--- a/grub-core/video/emu/sdl.c ++++ b/grub-core/video/emu/sdl.c +@@ -172,7 +172,7 @@ grub_video_sdl_set_palette (unsigned int start, unsigned int count, + if (start + count > mode_info.number_of_colors) + count = mode_info.number_of_colors - start; + +- tmp = grub_malloc (count * sizeof (tmp[0])); ++ tmp = grub_calloc (count, sizeof (tmp[0])); + for (i = 0; i < count; i++) + { + tmp[i].r = palette_data[i].r; +diff --git a/grub-core/video/i386/pc/vga.c b/grub-core/video/i386/pc/vga.c +index 01f47112d37..b2f776c997b 100644 +--- a/grub-core/video/i386/pc/vga.c ++++ b/grub-core/video/i386/pc/vga.c +@@ -127,7 +127,7 @@ grub_video_vga_setup (unsigned int width, unsigned int height, + + vga_height = height ? : 480; + +- framebuffer.temporary_buffer = grub_malloc (vga_height * VGA_WIDTH); ++ framebuffer.temporary_buffer = grub_calloc (vga_height, VGA_WIDTH); + framebuffer.front_page = 0; + framebuffer.back_page = 0; + if (!framebuffer.temporary_buffer) +diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c +index e1a01e99fd0..e85df3c1b04 100644 +--- a/grub-core/video/readers/png.c ++++ b/grub-core/video/readers/png.c +@@ -309,7 +309,7 @@ grub_png_decode_image_header (struct grub_png_data *data) + if (data->is_16bit || data->is_gray || data->is_palette) + #endif + { +- data->image_data = grub_malloc (data->image_height * data->row_bytes); ++ data->image_data = grub_calloc (data->image_height, data->row_bytes); + if (grub_errno) + return grub_errno; + +diff --git a/util/getroot.c b/util/getroot.c +index fa3460d6cd8..6feb2a4de40 100644 +--- a/util/getroot.c ++++ b/util/getroot.c +@@ -219,7 +219,7 @@ make_device_name (const char *drive) + char *ret, *ptr; + const char *iptr; + +- ret = xmalloc (strlen (drive) * 2); ++ ret = xcalloc (2, strlen (drive)); + ptr = ret; + for (iptr = drive; *iptr; iptr++) + { +diff --git a/util/grub-file.c b/util/grub-file.c +index 50c18b6835a..b2e7dd69f4c 100644 +--- a/util/grub-file.c ++++ b/util/grub-file.c +@@ -54,7 +54,7 @@ main (int argc, char *argv[]) + + grub_util_host_init (&argc, &argv); + +- argv2 = xmalloc (argc * sizeof (argv2[0])); ++ argv2 = xcalloc (argc, sizeof (argv2[0])); + + if (argc == 2 && strcmp (argv[1], "--version") == 0) + { +diff --git a/util/grub-fstest.c b/util/grub-fstest.c +index 5095fa8356c..b238a6c3276 100644 +--- a/util/grub-fstest.c ++++ b/util/grub-fstest.c +@@ -650,7 +650,7 @@ argp_parser (int key, char *arg, struct argp_state *state) + if (args_count < num_disks) + { + if (args_count == 0) +- images = xmalloc (num_disks * sizeof (images[0])); ++ images = xcalloc (num_disks, sizeof (images[0])); + images[args_count] = grub_canonicalize_file_name (arg); + args_count++; + return 0; +@@ -734,7 +734,7 @@ main (int argc, char *argv[]) + + grub_util_host_init (&argc, &argv); + +- args = xmalloc (argc * sizeof (args[0])); ++ args = xcalloc (argc, sizeof (args[0])); + + argp_parse (&argp, argc, argv, 0, 0, 0); + +diff --git a/util/grub-install-common.c b/util/grub-install-common.c +index 0a2e24a79f1..cf993c059ad 100644 +--- a/util/grub-install-common.c ++++ b/util/grub-install-common.c +@@ -281,7 +281,7 @@ handle_install_list (struct install_list *il, const char *val, + il->n_entries++; + } + il->n_alloc = il->n_entries + 1; +- il->entries = xmalloc (il->n_alloc * sizeof (il->entries[0])); ++ il->entries = xcalloc (il->n_alloc, sizeof (il->entries[0])); + ptr = val; + for (ce = il->entries; ; ce++) + { +diff --git a/util/grub-install.c b/util/grub-install.c +index 16f137ca854..3bf0e063a86 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -623,7 +623,7 @@ device_map_check_duplicates (const char *dev_map) + if (! fp) + return; + +- d = xmalloc (alloced * sizeof (d[0])); ++ d = xcalloc (alloced, sizeof (d[0])); + + while (fgets (buf, sizeof (buf), fp)) + { +@@ -1232,7 +1232,7 @@ main (int argc, char *argv[]) + ndev++; + } + +- grub_drives = xmalloc (sizeof (grub_drives[0]) * (ndev + 1)); ++ grub_drives = xcalloc (ndev + 1, sizeof (grub_drives[0])); + + for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++, + curdrive++) +diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c +index 75773446d0f..527da236b60 100644 +--- a/util/grub-mkimagexx.c ++++ b/util/grub-mkimagexx.c +@@ -1997,10 +1997,8 @@ SUFFIX (grub_mkimage_load_image) (const char *kernel_path, + + grub_host_to_target16 (e->e_shstrndx) * smd.section_entsize); + smd.strtab = (char *) e + grub_host_to_target_addr (s->sh_offset); + +- smd.addrs = xmalloc (sizeof (*smd.addrs) * smd.num_sections); +- memset (smd.addrs, 0, sizeof (*smd.addrs) * smd.num_sections); +- smd.vaddrs = xmalloc (sizeof (*smd.vaddrs) * smd.num_sections); +- memset (smd.vaddrs, 0, sizeof (*smd.vaddrs) * smd.num_sections); ++ smd.addrs = xcalloc (smd.num_sections, sizeof (*smd.addrs)); ++ smd.vaddrs = xcalloc (smd.num_sections, sizeof (*smd.vaddrs)); + + SUFFIX (locate_sections) (e, kernel_path, &smd, layout, image_target); + +diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c +index 9545945d8f3..21e72bde474 100644 +--- a/util/grub-mkrescue.c ++++ b/util/grub-mkrescue.c +@@ -441,8 +441,8 @@ main (int argc, char *argv[]) + xorriso = xstrdup ("xorriso"); + label_font = grub_util_path_concat (2, pkgdatadir, "unicode.pf2"); + +- argp_argv = xmalloc (sizeof (argp_argv[0]) * argc); +- xorriso_tail_argv = xmalloc (sizeof (argp_argv[0]) * argc); ++ argp_argv = xcalloc (argc, sizeof (argp_argv[0])); ++ xorriso_tail_argv = xcalloc (argc, sizeof (argp_argv[0])); + + xorriso_tail_argc = 0; + /* Program name */ +diff --git a/util/grub-mkstandalone.c b/util/grub-mkstandalone.c +index 4907d44c0bd..edf309717c3 100644 +--- a/util/grub-mkstandalone.c ++++ b/util/grub-mkstandalone.c +@@ -296,7 +296,7 @@ main (int argc, char *argv[]) + grub_util_host_init (&argc, &argv); + grub_util_disable_fd_syncs (); + +- files = xmalloc ((argc + 1) * sizeof (files[0])); ++ files = xcalloc (argc + 1, sizeof (files[0])); + + argp_parse (&argp, argc, argv, 0, 0, 0); + +diff --git a/util/grub-pe2elf.c b/util/grub-pe2elf.c +index 0d4084a108e..11331294f1b 100644 +--- a/util/grub-pe2elf.c ++++ b/util/grub-pe2elf.c +@@ -100,9 +100,9 @@ write_section_data (FILE* fp, const char *name, char *image, + char *pe_strtab = (image + pe_chdr->symtab_offset + + pe_chdr->num_symbols * sizeof (struct grub_pe32_symbol)); + +- section_map = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (int)); ++ section_map = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (int)); + section_map[0] = 0; +- shdr = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (shdr[0])); ++ shdr = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (shdr[0])); + idx = 1; + idx_reloc = pe_chdr->num_sections + 1; + +@@ -233,7 +233,7 @@ write_reloc_section (FILE* fp, const char *name, char *image, + + pe_sec = pe_shdr + shdr[i].sh_link; + pe_rel = (struct grub_pe32_reloc *) (image + pe_sec->relocations_offset); +- rel = (elf_reloc_t *) xmalloc (pe_sec->num_relocations * sizeof (elf_reloc_t)); ++ rel = (elf_reloc_t *) xcalloc (pe_sec->num_relocations, sizeof (elf_reloc_t)); + num_rels = 0; + modified = 0; + +@@ -365,12 +365,10 @@ write_symbol_table (FILE* fp, const char *name, char *image, + pe_symtab = (struct grub_pe32_symbol *) (image + pe_chdr->symtab_offset); + pe_strtab = (char *) (pe_symtab + pe_chdr->num_symbols); + +- symtab = (Elf_Sym *) xmalloc ((pe_chdr->num_symbols + 1) * +- sizeof (Elf_Sym)); +- memset (symtab, 0, (pe_chdr->num_symbols + 1) * sizeof (Elf_Sym)); ++ symtab = (Elf_Sym *) xcalloc (pe_chdr->num_symbols + 1, sizeof (Elf_Sym)); + num_syms = 1; + +- symtab_map = (int *) xmalloc (pe_chdr->num_symbols * sizeof (int)); ++ symtab_map = (int *) xcalloc (pe_chdr->num_symbols, sizeof (int)); + + for (i = 0; i < (int) pe_chdr->num_symbols; + i += pe_symtab->num_aux + 1, pe_symtab += pe_symtab->num_aux + 1) +diff --git a/util/grub-probe.c b/util/grub-probe.c +index e50bd43699d..4a88b84b0e7 100644 +--- a/util/grub-probe.c ++++ b/util/grub-probe.c +@@ -361,8 +361,8 @@ probe (const char *path, char **device_names, char delim) + grub_util_pull_device (*curdev); + ndev++; + } +- +- drives_names = xmalloc (sizeof (drives_names[0]) * (ndev + 1)); ++ ++ drives_names = xcalloc (ndev + 1, sizeof (drives_names[0])); + + for (curdev = device_names, curdrive = drives_names; *curdev; curdev++, + curdrive++) +diff --git a/include/grub/unicode.h b/include/grub/unicode.h +index a0403e91f9a..4de986a8576 100644 +--- a/include/grub/unicode.h ++++ b/include/grub/unicode.h +@@ -293,7 +293,7 @@ grub_unicode_glyph_dup (const struct grub_unicode_glyph *in) + grub_memcpy (out, in, sizeof (*in)); + if (in->ncomb > ARRAY_SIZE (out->combining_inline)) + { +- out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0])); ++ out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0])); + if (!out->combining_ptr) + { + grub_free (out); +@@ -315,7 +315,7 @@ grub_unicode_set_glyph (struct grub_unicode_glyph *out, + grub_memcpy (out, in, sizeof (*in)); + if (in->ncomb > ARRAY_SIZE (out->combining_inline)) + { +- out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0])); ++ out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0])); + if (!out->combining_ptr) + return; + grub_memcpy (out->combining_ptr, in->combining_ptr, +-- +2.26.2 + diff --git a/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch b/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch new file mode 100644 index 00000000..c891557b --- /dev/null +++ b/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch @@ -0,0 +1,1323 @@ +From b3dd39088e5b2efb190e33e2a0b71c9d1dc93118 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 15 Jun 2020 12:28:27 -0400 +Subject: [PATCH 209/237] malloc: Use overflow checking primitives where we do + complex allocations + +This attempts to fix the places where we do the following where +arithmetic_expr may include unvalidated data: + + X = grub_malloc(arithmetic_expr); + +It accomplishes this by doing the arithmetic ahead of time using grub_add(), +grub_sub(), grub_mul() and testing for overflow before proceeding. + +Among other issues, this fixes: + - allocation of integer overflow in grub_video_bitmap_create() + reported by Chris Coulson, + - allocation of integer overflow in grub_png_decode_image_header() + reported by Chris Coulson, + - allocation of integer overflow in grub_squash_read_symlink() + reported by Chris Coulson, + - allocation of integer overflow in grub_ext2_read_symlink() + reported by Chris Coulson, + - allocation of integer overflow in read_section_as_string() + reported by Chris Coulson. + +Fixes: CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: 5fb2befbf04 +--- + grub-core/commands/legacycfg.c | 29 +++++++++++++++---- + grub-core/commands/wildcard.c | 36 ++++++++++++++++++++---- + grub-core/disk/ldm.c | 32 +++++++++++++++------ + grub-core/font/font.c | 7 ++++- + grub-core/fs/btrfs.c | 29 +++++++++++++------ + grub-core/fs/ext2.c | 10 ++++++- + grub-core/fs/iso9660.c | 51 ++++++++++++++++++++++++---------- + grub-core/fs/sfs.c | 27 ++++++++++++++---- + grub-core/fs/squash4.c | 45 ++++++++++++++++++++++-------- + grub-core/fs/udf.c | 41 +++++++++++++++++---------- + grub-core/fs/xfs.c | 11 +++++--- + grub-core/fs/zfs/zfs.c | 22 ++++++++++----- + grub-core/fs/zfs/zfscrypt.c | 7 ++++- + grub-core/lib/arg.c | 20 +++++++++++-- + grub-core/loader/i386/bsd.c | 8 +++++- + grub-core/net/dns.c | 9 +++++- + grub-core/normal/charset.c | 10 +++++-- + grub-core/normal/cmdline.c | 14 ++++++++-- + grub-core/normal/menu_entry.c | 13 +++++++-- + grub-core/script/argv.c | 16 +++++++++-- + grub-core/script/lexer.c | 21 ++++++++++++-- + grub-core/video/bitmap.c | 25 +++++++++++------ + grub-core/video/readers/png.c | 13 +++++++-- + 23 files changed, 383 insertions(+), 113 deletions(-) + +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index 5344ebf4b3b..9afc2f33ab1 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -104,13 +105,22 @@ legacy_file (const char *filename) + if (newsuffix) + { + char *t; +- ++ grub_size_t sz; ++ ++ if (grub_add (grub_strlen (suffix), grub_strlen (newsuffix), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ goto fail_0; ++ } ++ + t = suffix; +- suffix = grub_realloc (suffix, grub_strlen (suffix) +- + grub_strlen (newsuffix) + 1); ++ suffix = grub_realloc (suffix, sz); + if (!suffix) + { + grub_free (t); ++ ++ fail_0: + grub_free (entrysrc); + grub_free (parsed); + grub_free (newsuffix); +@@ -154,13 +164,22 @@ legacy_file (const char *filename) + else + { + char *t; ++ grub_size_t sz; ++ ++ if (grub_add (grub_strlen (entrysrc), grub_strlen (parsed), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ goto fail_1; ++ } + + t = entrysrc; +- entrysrc = grub_realloc (entrysrc, grub_strlen (entrysrc) +- + grub_strlen (parsed) + 1); ++ entrysrc = grub_realloc (entrysrc, sz); + if (!entrysrc) + { + grub_free (t); ++ ++ fail_1: + grub_free (parsed); + grub_free (suffix); + return grub_errno; +diff --git a/grub-core/commands/wildcard.c b/grub-core/commands/wildcard.c +index 02c46f9fdfa..c223411371e 100644 +--- a/grub-core/commands/wildcard.c ++++ b/grub-core/commands/wildcard.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -48,6 +49,7 @@ merge (char **dest, char **ps) + int i; + int j; + char **p; ++ grub_size_t sz; + + if (! dest) + return ps; +@@ -60,7 +62,12 @@ merge (char **dest, char **ps) + for (j = 0; ps[j]; j++) + ; + +- p = grub_realloc (dest, sizeof (char*) * (i + j + 1)); ++ if (grub_add (i, j, &sz) || ++ grub_add (sz, 1, &sz) || ++ grub_mul (sz, sizeof (char *), &sz)) ++ return dest; ++ ++ p = grub_realloc (dest, sz); + if (! p) + { + grub_free (dest); +@@ -115,8 +122,15 @@ make_regex (const char *start, const char *end, regex_t *regexp) + char ch; + int i = 0; + unsigned len = end - start; +- char *buffer = grub_malloc (len * 2 + 2 + 1); /* worst case size. */ ++ char *buffer; ++ grub_size_t sz; + ++ /* Worst case size is (len * 2 + 2 + 1). */ ++ if (grub_mul (len, 2, &sz) || ++ grub_add (sz, 3, &sz)) ++ return 1; ++ ++ buffer = grub_malloc (sz); + if (! buffer) + return 1; + +@@ -226,6 +240,7 @@ match_devices_iter (const char *name, void *data) + struct match_devices_ctx *ctx = data; + char **t; + char *buffer; ++ grub_size_t sz; + + /* skip partitions if asked to. */ + if (ctx->noparts && grub_strchr (name, ',')) +@@ -239,11 +254,16 @@ match_devices_iter (const char *name, void *data) + if (regexec (ctx->regexp, buffer, 0, 0, 0)) + { + grub_dprintf ("expand", "not matched\n"); ++ fail: + grub_free (buffer); + return 0; + } + +- t = grub_realloc (ctx->devs, sizeof (char*) * (ctx->ndev + 2)); ++ if (grub_add (ctx->ndev, 2, &sz) || ++ grub_mul (sz, sizeof (char *), &sz)) ++ goto fail; ++ ++ t = grub_realloc (ctx->devs, sz); + if (! t) + { + grub_free (buffer); +@@ -300,6 +320,7 @@ match_files_iter (const char *name, + struct match_files_ctx *ctx = data; + char **t; + char *buffer; ++ grub_size_t sz; + + /* skip . and .. names */ + if (grub_strcmp(".", name) == 0 || grub_strcmp("..", name) == 0) +@@ -315,9 +336,14 @@ match_files_iter (const char *name, + if (! buffer) + return 1; + +- t = grub_realloc (ctx->files, sizeof (char*) * (ctx->nfile + 2)); +- if (! t) ++ if (grub_add (ctx->nfile, 2, &sz) || ++ grub_mul (sz, sizeof (char *), &sz)) ++ goto fail; ++ ++ t = grub_realloc (ctx->files, sz); ++ if (!t) + { ++ fail: + grub_free (buffer); + return 1; + } +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index e6323701ab3..58f8a53e1ab 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_UTIL + #include +@@ -289,6 +290,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -350,7 +352,13 @@ make_vg (grub_disk_t disk, + grub_free (lv); + goto fail2; + } +- lv->name = grub_malloc (*ptr + 1); ++ if (grub_add (*ptr, 1, &sz)) ++ { ++ grub_free (lv->internal_id); ++ grub_free (lv); ++ goto fail2; ++ } ++ lv->name = grub_malloc (sz); + if (!lv->name) + { + grub_free (lv->internal_id); +@@ -599,10 +607,13 @@ make_vg (grub_disk_t disk, + if (lv->segments->node_alloc == lv->segments->node_count) + { + void *t; +- lv->segments->node_alloc *= 2; +- t = grub_realloc (lv->segments->nodes, +- sizeof (*lv->segments->nodes) +- * lv->segments->node_alloc); ++ grub_size_t sz; ++ ++ if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || ++ grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) ++ goto fail2; ++ ++ t = grub_realloc (lv->segments->nodes, sz); + if (!t) + goto fail2; + lv->segments->nodes = t; +@@ -723,10 +734,13 @@ make_vg (grub_disk_t disk, + if (comp->segment_alloc == comp->segment_count) + { + void *t; +- comp->segment_alloc *= 2; +- t = grub_realloc (comp->segments, +- comp->segment_alloc +- * sizeof (*comp->segments)); ++ grub_size_t sz; ++ ++ if (grub_mul (comp->segment_alloc, 2, &comp->segment_alloc) || ++ grub_mul (comp->segment_alloc, sizeof (*comp->segments), &sz)) ++ goto fail2; ++ ++ t = grub_realloc (comp->segments, sz); + if (!t) + goto fail2; + comp->segments = t; +diff --git a/grub-core/font/font.c b/grub-core/font/font.c +index 68967dc1c2b..d63354fb51b 100644 +--- a/grub-core/font/font.c ++++ b/grub-core/font/font.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -360,9 +361,13 @@ static char * + read_section_as_string (struct font_file_section *section) + { + char *str; ++ grub_size_t sz; + grub_ssize_t ret; + +- str = grub_malloc (section->length + 1); ++ if (grub_add (section->length, 1, &sz)) ++ return NULL; ++ ++ str = grub_malloc (sz); + if (!str) + return 0; + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 8c8aa9c3103..1d801f6c9ee 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -321,9 +322,13 @@ save_ref (struct grub_btrfs_leaf_descriptor *desc, + if (desc->allocated < desc->depth) + { + void *newdata; +- desc->allocated *= 2; +- newdata = grub_realloc (desc->data, sizeof (desc->data[0]) +- * desc->allocated); ++ grub_size_t sz; ++ ++ if (grub_mul (desc->allocated, 2, &desc->allocated) || ++ grub_mul (desc->allocated, sizeof (desc->data[0]), &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ newdata = grub_realloc (desc->data, sz); + if (!newdata) + return grub_errno; + desc->data = newdata; +@@ -618,15 +623,21 @@ find_device (struct grub_btrfs_data *data, grub_uint64_t id, int do_rescan) + if (data->n_devices_attached > data->n_devices_allocated) + { + void *tmp; +- data->n_devices_allocated = 2 * data->n_devices_attached + 1; +- data->devices_attached +- = grub_realloc (tmp = data->devices_attached, +- data->n_devices_allocated +- * sizeof (data->devices_attached[0])); ++ grub_size_t sz; ++ ++ if (grub_mul (data->n_devices_attached, 2, &data->n_devices_allocated) || ++ grub_add (data->n_devices_allocated, 1, &data->n_devices_allocated) || ++ grub_mul (data->n_devices_allocated, sizeof (data->devices_attached[0]), &sz)) ++ goto fail; ++ ++ data->devices_attached = grub_realloc (tmp = data->devices_attached, sz); + if (!data->devices_attached) + { +- grub_device_close (ctx.dev_found); + data->devices_attached = tmp; ++ ++ fail: ++ if (ctx.dev_found) ++ grub_device_close (ctx.dev_found); + return NULL; + } + } +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index b8ad75a0ff7..b4bd019f49a 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -703,6 +704,7 @@ grub_ext2_read_symlink (grub_fshelp_node_t node) + { + char *symlink; + struct grub_fshelp_node *diro = node; ++ grub_size_t sz; + + if (! diro->inode_read) + { +@@ -717,7 +719,13 @@ grub_ext2_read_symlink (grub_fshelp_node_t node) + } + } + +- symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1); ++ if (grub_add (grub_le_to_cpu32 (diro->inode.size), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ ++ symlink = grub_malloc (sz); + if (! symlink) + return 0; + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 092b8f409ec..f45841e2b47 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -531,8 +532,13 @@ add_part (struct iterate_dir_ctx *ctx, + int len2) + { + int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0; ++ grub_size_t sz; + +- ctx->symlink = grub_realloc (ctx->symlink, size + len2 + 1); ++ if (grub_add (size, len2, &sz) || ++ grub_add (sz, 1, &sz)) ++ return; ++ ++ ctx->symlink = grub_realloc (ctx->symlink, sz); + if (! ctx->symlink) + return; + +@@ -560,17 +566,24 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + { + grub_size_t off = 0, csize = 1; + char *old; ++ grub_size_t sz; ++ + csize = entry->len - 5; + old = ctx->filename; + if (ctx->filename_alloc) + { + off = grub_strlen (ctx->filename); +- ctx->filename = grub_realloc (ctx->filename, csize + off + 1); ++ if (grub_add (csize, off, &sz) || ++ grub_add (sz, 1, &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ctx->filename = grub_realloc (ctx->filename, sz); + } + else + { + off = 0; +- ctx->filename = grub_zalloc (csize + 1); ++ if (grub_add (csize, 1, &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ctx->filename = grub_zalloc (sz); + } + if (!ctx->filename) + { +@@ -776,14 +789,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir, + if (node->have_dirents >= node->alloc_dirents) + { + struct grub_fshelp_node *new_node; +- node->alloc_dirents *= 2; +- new_node = grub_realloc (node, +- sizeof (struct grub_fshelp_node) +- + ((node->alloc_dirents +- - ARRAY_SIZE (node->dirents)) +- * sizeof (node->dirents[0]))); ++ grub_size_t sz; ++ ++ if (grub_mul (node->alloc_dirents, 2, &node->alloc_dirents) || ++ grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) || ++ grub_mul (sz, sizeof (node->dirents[0]), &sz) || ++ grub_add (sz, sizeof (struct grub_fshelp_node), &sz)) ++ goto fail_0; ++ ++ new_node = grub_realloc (node, sz); + if (!new_node) + { ++ fail_0: + if (ctx.filename_alloc) + grub_free (ctx.filename); + grub_free (node); +@@ -799,14 +816,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir, + * sizeof (node->dirents[0]) < grub_strlen (ctx.symlink) + 1) + { + struct grub_fshelp_node *new_node; +- new_node = grub_realloc (node, +- sizeof (struct grub_fshelp_node) +- + ((node->alloc_dirents +- - ARRAY_SIZE (node->dirents)) +- * sizeof (node->dirents[0])) +- + grub_strlen (ctx.symlink) + 1); ++ grub_size_t sz; ++ ++ if (grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) || ++ grub_mul (sz, sizeof (node->dirents[0]), &sz) || ++ grub_add (sz, sizeof (struct grub_fshelp_node) + 1, &sz) || ++ grub_add (sz, grub_strlen (ctx.symlink), &sz)) ++ goto fail_1; ++ ++ new_node = grub_realloc (node, sz); + if (!new_node) + { ++ fail_1: + if (ctx.filename_alloc) + grub_free (ctx.filename); + grub_free (node); +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 663931717fd..3ddc6b5e287 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -307,10 +308,15 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + if (node->cache && node->cache_size >= node->cache_allocated) + { + struct cache_entry *e = node->cache; +- e = grub_realloc (node->cache,node->cache_allocated * 2 +- * sizeof (e[0])); ++ grub_size_t sz; ++ ++ if (grub_mul (node->cache_allocated, 2 * sizeof (e[0]), &sz)) ++ goto fail; ++ ++ e = grub_realloc (node->cache, sz); + if (!e) + { ++ fail: + grub_errno = 0; + grub_free (node->cache); + node->cache = 0; +@@ -477,10 +483,16 @@ grub_sfs_create_node (struct grub_fshelp_node **node, + grub_size_t len = grub_strlen (name); + grub_uint8_t *name_u8; + int ret; ++ grub_size_t sz; ++ ++ if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) || ++ grub_add (sz, 1, &sz)) ++ return 1; ++ + *node = grub_malloc (sizeof (**node)); + if (!*node) + return 1; +- name_u8 = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1); ++ name_u8 = grub_malloc (sz); + if (!name_u8) + { + grub_free (*node); +@@ -724,8 +736,13 @@ grub_sfs_label (grub_device_t device, char **label) + data = grub_sfs_mount (disk); + if (data) + { +- grub_size_t len = grub_strlen (data->label); +- *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1); ++ grub_size_t sz, len = grub_strlen (data->label); ++ ++ if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) || ++ grub_add (sz, 1, &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ *label = grub_malloc (sz); + if (*label) + *grub_latin1_to_utf8 ((grub_uint8_t *) *label, + (const grub_uint8_t *) data->label, +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index 2c967c65a42..f9bef38fc42 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + + #include "xz.h" +@@ -459,7 +460,17 @@ grub_squash_read_symlink (grub_fshelp_node_t node) + { + char *ret; + grub_err_t err; +- ret = grub_malloc (grub_le_to_cpu32 (node->ino.symlink.namelen) + 1); ++ grub_size_t sz; ++ ++ if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ ++ ret = grub_malloc (sz); ++ if (!ret) ++ return NULL; + + err = read_chunk (node->data, ret, + grub_le_to_cpu32 (node->ino.symlink.namelen), +@@ -506,11 +517,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + + { + grub_fshelp_node_t node; +- node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0])); ++ grub_size_t sz; ++ ++ if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) || ++ grub_add (sz, sizeof (*node), &sz)) ++ return 0; ++ ++ node = grub_malloc (sz); + if (!node) + return 0; +- grub_memcpy (node, dir, +- sizeof (*node) + dir->stsize * sizeof (dir->stack[0])); ++ grub_memcpy (node, dir, sz); + if (hook (".", GRUB_FSHELP_DIR, node, hook_data)) + return 1; + +@@ -518,12 +534,15 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + { + grub_err_t err; + +- node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0])); ++ if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) || ++ grub_add (sz, sizeof (*node), &sz)) ++ return 0; ++ ++ node = grub_malloc (sz); + if (!node) + return 0; + +- grub_memcpy (node, dir, +- sizeof (*node) + dir->stsize * sizeof (dir->stack[0])); ++ grub_memcpy (node, dir, sz); + + node->stsize--; + err = read_chunk (dir->data, &node->ino, sizeof (node->ino), +@@ -557,6 +576,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + enum grub_fshelp_filetype filetype = GRUB_FSHELP_REG; + struct grub_squash_dirent di; + struct grub_squash_inode ino; ++ grub_size_t sz; + + err = read_chunk (dir->data, &di, sizeof (di), + grub_le_to_cpu64 (dir->data->sb.diroffset) +@@ -589,13 +609,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + if (grub_le_to_cpu16 (di.type) == SQUASH_TYPE_SYMLINK) + filetype = GRUB_FSHELP_SYMLINK; + +- node = grub_malloc (sizeof (*node) +- + (dir->stsize + 1) * sizeof (dir->stack[0])); ++ if (grub_add (dir->stsize, 1, &sz) || ++ grub_mul (sz, sizeof (dir->stack[0]), &sz) || ++ grub_add (sz, sizeof (*node), &sz)) ++ return 0; ++ ++ node = grub_malloc (sz); + if (! node) + return 0; + +- grub_memcpy (node, dir, +- sizeof (*node) + dir->stsize * sizeof (dir->stack[0])); ++ grub_memcpy (node, dir, sz - sizeof(dir->stack[0])); + + node->ino = ino; + node->stack[node->stsize].ino_chunk = grub_le_to_cpu32 (dh.ino_chunk); +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 44481da7c6d..be41b48f913 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -890,9 +891,19 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf) + utf16[i] = (raw[2 * i + 1] << 8) | raw[2*i + 2]; + } + if (!outbuf) +- outbuf = grub_malloc (utf16len * GRUB_MAX_UTF8_PER_UTF16 + 1); ++ { ++ grub_size_t size; ++ ++ if (grub_mul (utf16len, GRUB_MAX_UTF8_PER_UTF16, &size) || ++ grub_add (size, 1, &size)) ++ goto fail; ++ ++ outbuf = grub_malloc (size); ++ } + if (outbuf) + *grub_utf16_to_utf8 ((grub_uint8_t *) outbuf, utf16, utf16len) = '\0'; ++ ++ fail: + grub_free (utf16); + return outbuf; + } +@@ -1005,7 +1016,7 @@ grub_udf_read_symlink (grub_fshelp_node_t node) + grub_size_t sz = U64 (node->block.fe.file_size); + grub_uint8_t *raw; + const grub_uint8_t *ptr; +- char *out, *optr; ++ char *out = NULL, *optr; + + if (sz < 4) + return NULL; +@@ -1013,14 +1024,16 @@ grub_udf_read_symlink (grub_fshelp_node_t node) + if (!raw) + return NULL; + if (grub_udf_read_file (node, NULL, NULL, 0, sz, (char *) raw) < 0) +- { +- grub_free (raw); +- return NULL; +- } ++ goto fail_1; + +- out = grub_malloc (sz * 2 + 1); ++ if (grub_mul (sz, 2, &sz) || ++ grub_add (sz, 1, &sz)) ++ goto fail_0; ++ ++ out = grub_malloc (sz); + if (!out) + { ++ fail_0: + grub_free (raw); + return NULL; + } +@@ -1031,17 +1044,17 @@ grub_udf_read_symlink (grub_fshelp_node_t node) + { + grub_size_t s; + if ((grub_size_t) (ptr - raw + 4) > sz) +- goto fail; ++ goto fail_1; + if (!(ptr[2] == 0 && ptr[3] == 0)) +- goto fail; ++ goto fail_1; + s = 4 + ptr[1]; + if ((grub_size_t) (ptr - raw + s) > sz) +- goto fail; ++ goto fail_1; + switch (*ptr) + { + case 1: + if (ptr[1]) +- goto fail; ++ goto fail_1; + /* Fallthrough. */ + case 2: + /* in 4 bytes. out: 1 byte. */ +@@ -1066,11 +1079,11 @@ grub_udf_read_symlink (grub_fshelp_node_t node) + if (optr != out) + *optr++ = '/'; + if (!read_string (ptr + 4, s - 4, optr)) +- goto fail; ++ goto fail_1; + optr += grub_strlen (optr); + break; + default: +- goto fail; ++ goto fail_1; + } + ptr += s; + } +@@ -1078,7 +1091,7 @@ grub_udf_read_symlink (grub_fshelp_node_t node) + grub_free (raw); + return out; + +- fail: ++ fail_1: + grub_free (raw); + grub_free (out); + grub_error (GRUB_ERR_BAD_FS, "invalid symlink"); +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 3b00c744e23..66e66dd58cc 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -899,6 +900,7 @@ static struct grub_xfs_data * + grub_xfs_mount (grub_disk_t disk) + { + struct grub_xfs_data *data = 0; ++ grub_size_t sz; + + data = grub_zalloc (sizeof (struct grub_xfs_data)); + if (!data) +@@ -913,10 +915,11 @@ grub_xfs_mount (grub_disk_t disk) + if (!grub_xfs_sb_valid(data)) + goto fail; + +- data = grub_realloc (data, +- sizeof (struct grub_xfs_data) +- - sizeof (struct grub_xfs_inode) +- + grub_xfs_inode_size(data) + 1); ++ if (grub_add (grub_xfs_inode_size (data), ++ sizeof (struct grub_xfs_data) - sizeof (struct grub_xfs_inode) + 1, &sz)) ++ goto fail; ++ ++ data = grub_realloc (data, sz); + + if (! data) + goto fail; +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index f6b95d4fb02..c6204367e78 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -55,6 +55,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -773,11 +774,14 @@ fill_vdev_info (struct grub_zfs_data *data, + if (data->n_devices_attached > data->n_devices_allocated) + { + void *tmp; +- data->n_devices_allocated = 2 * data->n_devices_attached + 1; +- data->devices_attached +- = grub_realloc (tmp = data->devices_attached, +- data->n_devices_allocated +- * sizeof (data->devices_attached[0])); ++ grub_size_t sz; ++ ++ if (grub_mul (data->n_devices_attached, 2, &data->n_devices_allocated) || ++ grub_add (data->n_devices_allocated, 1, &data->n_devices_allocated) || ++ grub_mul (data->n_devices_allocated, sizeof (data->devices_attached[0]), &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ data->devices_attached = grub_realloc (tmp = data->devices_attached, sz); + if (!data->devices_attached) + { + data->devices_attached = tmp; +@@ -3468,14 +3472,18 @@ grub_zfs_nvlist_lookup_nvlist (const char *nvlist, const char *name) + { + char *nvpair; + char *ret; +- grub_size_t size; ++ grub_size_t size, sz; + int found; + + found = nvlist_find_value (nvlist, name, DATA_TYPE_NVLIST, &nvpair, + &size, 0); + if (!found) + return 0; +- ret = grub_zalloc (size + 3 * sizeof (grub_uint32_t)); ++ ++ if (grub_add (size, 3 * sizeof (grub_uint32_t), &sz)) ++ return 0; ++ ++ ret = grub_zalloc (sz); + if (!ret) + return 0; + grub_memcpy (ret, nvlist, sizeof (grub_uint32_t)); +diff --git a/grub-core/fs/zfs/zfscrypt.c b/grub-core/fs/zfs/zfscrypt.c +index 87eef621d6d..f8488c35344 100644 +--- a/grub-core/fs/zfs/zfscrypt.c ++++ b/grub-core/fs/zfs/zfscrypt.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -82,9 +83,13 @@ grub_zfs_add_key (grub_uint8_t *key_in, + int passphrase) + { + struct grub_zfs_wrap_key *key; ++ grub_size_t sz; ++ + if (!passphrase && keylen > 32) + keylen = 32; +- key = grub_malloc (sizeof (*key) + keylen); ++ if (grub_add (sizeof (*key), keylen, &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ key = grub_malloc (sz); + if (!key) + return grub_errno; + key->is_passphrase = passphrase; +diff --git a/grub-core/lib/arg.c b/grub-core/lib/arg.c +index ccc185017ee..8439a0062ff 100644 +--- a/grub-core/lib/arg.c ++++ b/grub-core/lib/arg.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + /* Built-in parser for default options. */ + static const struct grub_arg_option help_options[] = +@@ -216,7 +217,13 @@ static inline grub_err_t + add_arg (char ***argl, int *num, char *s) + { + char **p = *argl; +- *argl = grub_realloc (*argl, (++(*num) + 1) * sizeof (char *)); ++ grub_size_t sz; ++ ++ if (grub_add (++(*num), 1, &sz) || ++ grub_mul (sz, sizeof (char *), &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ ++ *argl = grub_realloc (*argl, sz); + if (! *argl) + { + grub_free (p); +@@ -431,6 +438,7 @@ grub_arg_list_alloc(grub_extcmd_t extcmd, int argc, + grub_size_t argcnt; + struct grub_arg_list *list; + const struct grub_arg_option *options; ++ grub_size_t sz0, sz1; + + options = extcmd->options; + if (! options) +@@ -443,7 +451,15 @@ grub_arg_list_alloc(grub_extcmd_t extcmd, int argc, + argcnt += ((grub_size_t) argc + 1) / 2 + 1; /* max possible for any option */ + } + +- list = grub_zalloc (sizeof (*list) * i + sizeof (char*) * argcnt); ++ if (grub_mul (sizeof (*list), i, &sz0) || ++ grub_mul (sizeof (char *), argcnt, &sz1) || ++ grub_add (sz0, sz1, &sz0)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return 0; ++ } ++ ++ list = grub_zalloc (sz0); + if (! list) + return 0; + +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index 87709aa23e8..0f317632a3b 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_MACHINE_PCBIOS + #include + #endif +@@ -1007,11 +1008,16 @@ grub_netbsd_add_modules (void) + struct grub_netbsd_btinfo_modules *mods; + unsigned i; + grub_err_t err; ++ grub_size_t sz; + + for (mod = netbsd_mods; mod; mod = mod->next) + modcnt++; + +- mods = grub_malloc (sizeof (*mods) + sizeof (mods->mods[0]) * modcnt); ++ if (grub_mul (modcnt, sizeof (mods->mods[0]), &sz) || ++ grub_add (sz, sizeof (*mods), &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ mods = grub_malloc (sz); + if (!mods) + return grub_errno; + +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index e332d5eb4a4..906ec7d6782 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + struct dns_cache_element + { +@@ -51,9 +52,15 @@ grub_net_add_dns_server (const struct grub_net_network_level_address *s) + { + int na = dns_servers_alloc * 2; + struct grub_net_network_level_address *ns; ++ grub_size_t sz; ++ + if (na < 8) + na = 8; +- ns = grub_realloc (dns_servers, na * sizeof (ns[0])); ++ ++ if (grub_mul (na, sizeof (ns[0]), &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ ns = grub_realloc (dns_servers, sz); + if (!ns) + return grub_errno; + dns_servers_alloc = na; +diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c +index d57fb72faa8..4dfcc31078d 100644 +--- a/grub-core/normal/charset.c ++++ b/grub-core/normal/charset.c +@@ -48,6 +48,7 @@ + #include + #include + #include ++#include + + #if HAVE_FONT_SOURCE + #include "widthspec.h" +@@ -464,6 +465,7 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen, + { + struct grub_unicode_combining *n; + unsigned j; ++ grub_size_t sz; + + if (!haveout) + continue; +@@ -477,10 +479,14 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen, + n = out->combining_inline; + else if (out->ncomb > (int) ARRAY_SIZE (out->combining_inline)) + { +- n = grub_realloc (out->combining_ptr, +- sizeof (n[0]) * (out->ncomb + 1)); ++ if (grub_add (out->ncomb, 1, &sz) || ++ grub_mul (sz, sizeof (n[0]), &sz)) ++ goto fail; ++ ++ n = grub_realloc (out->combining_ptr, sz); + if (!n) + { ++ fail: + grub_errno = GRUB_ERR_NONE; + continue; + } +diff --git a/grub-core/normal/cmdline.c b/grub-core/normal/cmdline.c +index c57242e2ea9..de03fe63b3d 100644 +--- a/grub-core/normal/cmdline.c ++++ b/grub-core/normal/cmdline.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + static grub_uint32_t *kill_buf; + +@@ -307,12 +308,21 @@ cl_insert (struct cmdline_term *cl_terms, unsigned nterms, + if (len + (*llen) >= (*max_len)) + { + grub_uint32_t *nbuf; +- (*max_len) *= 2; +- nbuf = grub_realloc ((*buf), sizeof (grub_uint32_t) * (*max_len)); ++ grub_size_t sz; ++ ++ if (grub_mul (*max_len, 2, max_len) || ++ grub_mul (*max_len, sizeof (grub_uint32_t), &sz)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ goto fail; ++ } ++ ++ nbuf = grub_realloc ((*buf), sz); + if (nbuf) + (*buf) = nbuf; + else + { ++ fail: + grub_print_error (); + grub_errno = GRUB_ERR_NONE; + (*max_len) /= 2; +diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c +index f31487c1f58..de64a367c4e 100644 +--- a/grub-core/normal/menu_entry.c ++++ b/grub-core/normal/menu_entry.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + enum update_mode + { +@@ -113,10 +114,18 @@ ensure_space (struct line *linep, int extra) + { + if (linep->max_len < linep->len + extra) + { +- linep->max_len = 2 * (linep->len + extra); +- linep->buf = grub_realloc (linep->buf, (linep->max_len + 1) * sizeof (linep->buf[0])); ++ grub_size_t sz0, sz1; ++ ++ if (grub_add (linep->len, extra, &sz0) || ++ grub_mul (sz0, 2, &sz0) || ++ grub_add (sz0, 1, &sz1) || ++ grub_mul (sz1, sizeof (linep->buf[0]), &sz1)) ++ return 0; ++ ++ linep->buf = grub_realloc (linep->buf, sz1); + if (! linep->buf) + return 0; ++ linep->max_len = sz0; + } + + return 1; +diff --git a/grub-core/script/argv.c b/grub-core/script/argv.c +index 217ec5d1e1b..5751fdd5708 100644 +--- a/grub-core/script/argv.c ++++ b/grub-core/script/argv.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + /* Return nearest power of two that is >= v. */ + static unsigned +@@ -81,11 +82,16 @@ int + grub_script_argv_next (struct grub_script_argv *argv) + { + char **p = argv->args; ++ grub_size_t sz; + + if (argv->args && argv->argc && argv->args[argv->argc - 1] == 0) + return 0; + +- p = grub_realloc (p, round_up_exp ((argv->argc + 2) * sizeof (char *))); ++ if (grub_add (argv->argc, 2, &sz) || ++ grub_mul (sz, sizeof (char *), &sz)) ++ return 1; ++ ++ p = grub_realloc (p, round_up_exp (sz)); + if (! p) + return 1; + +@@ -105,13 +111,19 @@ grub_script_argv_append (struct grub_script_argv *argv, const char *s, + { + grub_size_t a; + char *p = argv->args[argv->argc - 1]; ++ grub_size_t sz; + + if (! s) + return 0; + + a = p ? grub_strlen (p) : 0; + +- p = grub_realloc (p, round_up_exp ((a + slen + 1) * sizeof (char))); ++ if (grub_add (a, slen, &sz) || ++ grub_add (sz, 1, &sz) || ++ grub_mul (sz, sizeof (char), &sz)) ++ return 1; ++ ++ p = grub_realloc (p, round_up_exp (sz)); + if (! p) + return 1; + +diff --git a/grub-core/script/lexer.c b/grub-core/script/lexer.c +index c6bd3172fab..5fb0cbd0bc9 100644 +--- a/grub-core/script/lexer.c ++++ b/grub-core/script/lexer.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #define yytext_ptr char * + #include "grub_script.tab.h" +@@ -110,10 +111,14 @@ grub_script_lexer_record (struct grub_parser_param *parser, char *str) + old = lexer->recording; + if (lexer->recordlen < len) + lexer->recordlen = len; +- lexer->recordlen *= 2; ++ ++ if (grub_mul (lexer->recordlen, 2, &lexer->recordlen)) ++ goto fail; ++ + lexer->recording = grub_realloc (lexer->recording, lexer->recordlen); + if (!lexer->recording) + { ++ fail: + grub_free (old); + lexer->recordpos = 0; + lexer->recordlen = 0; +@@ -130,7 +135,7 @@ int + grub_script_lexer_yywrap (struct grub_parser_param *parserstate, + const char *input) + { +- grub_size_t len = 0; ++ grub_size_t len = 0, sz; + char *p = 0; + char *line = 0; + YY_BUFFER_STATE buffer; +@@ -168,12 +173,22 @@ grub_script_lexer_yywrap (struct grub_parser_param *parserstate, + } + else if (len && line[len - 1] != '\n') + { +- p = grub_realloc (line, len + 2); ++ if (grub_add (len, 2, &sz)) ++ { ++ grub_free (line); ++ grub_script_yyerror (parserstate, N_("overflow is detected")); ++ return 1; ++ } ++ ++ p = grub_realloc (line, sz); + if (p) + { + p[len++] = '\n'; + p[len] = '\0'; + } ++ else ++ grub_free (line); ++ + line = p; + } + +diff --git a/grub-core/video/bitmap.c b/grub-core/video/bitmap.c +index b2e0315665b..6256e209a6b 100644 +--- a/grub-core/video/bitmap.c ++++ b/grub-core/video/bitmap.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -58,7 +59,7 @@ grub_video_bitmap_create (struct grub_video_bitmap **bitmap, + enum grub_video_blit_format blit_format) + { + struct grub_video_mode_info *mode_info; +- unsigned int size; ++ grub_size_t size; + + if (!bitmap) + return grub_error (GRUB_ERR_BUG, "invalid argument"); +@@ -137,19 +138,25 @@ grub_video_bitmap_create (struct grub_video_bitmap **bitmap, + + mode_info->pitch = width * mode_info->bytes_per_pixel; + +- /* Calculate size needed for the data. */ +- size = (width * mode_info->bytes_per_pixel) * height; ++ /* Calculate size needed for the data. */ ++ if (grub_mul (width, mode_info->bytes_per_pixel, &size) || ++ grub_mul (size, height, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ goto fail; ++ } + + (*bitmap)->data = grub_zalloc (size); + if (! (*bitmap)->data) +- { +- grub_free (*bitmap); +- *bitmap = 0; +- +- return grub_errno; +- } ++ goto fail; + + return GRUB_ERR_NONE; ++ ++ fail: ++ grub_free (*bitmap); ++ *bitmap = NULL; ++ ++ return grub_errno; + } + + /* Frees all resources allocated by bitmap. */ +diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c +index e85df3c1b04..719e647e44f 100644 +--- a/grub-core/video/readers/png.c ++++ b/grub-core/video/readers/png.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -301,9 +302,17 @@ grub_png_decode_image_header (struct grub_png_data *data) + data->bpp <<= 1; + + data->color_bits = color_bits; +- data->row_bytes = data->image_width * data->bpp; ++ ++ if (grub_mul (data->image_width, data->bpp, &data->row_bytes)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ + if (data->color_bits <= 4) +- data->row_bytes = (data->image_width * data->color_bits + 7) / 8; ++ { ++ if (grub_mul (data->image_width, data->color_bits + 7, &data->row_bytes)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ ++ data->row_bytes >>= 3; ++ } + + #ifndef GRUB_CPU_WORDS_BIGENDIAN + if (data->is_16bit || data->is_gray || data->is_palette) +-- +2.26.2 + diff --git a/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch b/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch new file mode 100644 index 00000000..95fe5f1f --- /dev/null +++ b/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch @@ -0,0 +1,69 @@ +From 5efb4029deaa8e0bfc7a4293a28e25469500ec06 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sat, 4 Jul 2020 12:25:09 -0400 +Subject: [PATCH 210/237] iso9660: Don't leak memory on realloc() failures + +Signed-off-by: Peter Jones +Reviewed-by: Daniel Kiper +Upstream-commit-id: f2bd30b2fe7 +--- + grub-core/fs/iso9660.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index f45841e2b47..6fc9302bce3 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -533,14 +533,20 @@ add_part (struct iterate_dir_ctx *ctx, + { + int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0; + grub_size_t sz; ++ char *new; + + if (grub_add (size, len2, &sz) || + grub_add (sz, 1, &sz)) + return; + +- ctx->symlink = grub_realloc (ctx->symlink, sz); +- if (! ctx->symlink) +- return; ++ new = grub_realloc (ctx->symlink, sz); ++ if (!new) ++ { ++ grub_free (ctx->symlink); ++ ctx->symlink = NULL; ++ return; ++ } ++ ctx->symlink = new; + + grub_memcpy (ctx->symlink + size, part, len2); + ctx->symlink[size + len2] = 0; +@@ -634,7 +640,12 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + is the length. Both are part of the `Component + Record'. */ + if (ctx->symlink && !ctx->was_continue) +- add_part (ctx, "/", 1); ++ { ++ add_part (ctx, "/", 1); ++ if (grub_errno) ++ return grub_errno; ++ } ++ + add_part (ctx, (char *) &entry->data[pos + 2], + entry->data[pos + 1]); + ctx->was_continue = (entry->data[pos] & 1); +@@ -653,6 +664,11 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + add_part (ctx, "/", 1); + break; + } ++ ++ /* Check if grub_realloc() failed in add_part(). */ ++ if (grub_errno) ++ return grub_errno; ++ + /* In pos + 1 the length of the `Component Record' is + stored. */ + pos += entry->data[pos + 1] + 2; +-- +2.26.2 + diff --git a/0211-font-Do-not-load-more-than-one-NAME-section.patch b/0211-font-Do-not-load-more-than-one-NAME-section.patch new file mode 100644 index 00000000..8556448a --- /dev/null +++ b/0211-font-Do-not-load-more-than-one-NAME-section.patch @@ -0,0 +1,38 @@ +From 085192b4f863bdf03506c8029999361b1dd82ac0 Mon Sep 17 00:00:00 2001 +From: Daniel Kiper +Date: Tue, 7 Jul 2020 15:36:26 +0200 +Subject: [PATCH 211/237] font: Do not load more than one NAME section + +The GRUB font file can have one NAME section only. Though if somebody +crafts a broken font file with many NAME sections and loads it then the +GRUB leaks memory. So, prevent against that by loading first NAME +section and failing in controlled way on following one. + +Reported-by: Chris Coulson +Signed-off-by: Daniel Kiper +Reviewed-by: Jan Setje-Eilers +Upstream-commit-id: 482814113dc +--- + grub-core/font/font.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/grub-core/font/font.c b/grub-core/font/font.c +index d63354fb51b..a7b955a1a74 100644 +--- a/grub-core/font/font.c ++++ b/grub-core/font/font.c +@@ -532,6 +532,12 @@ grub_font_load (const char *filename) + if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME, + sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0) + { ++ if (font->name != NULL) ++ { ++ grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections"); ++ goto fail; ++ } ++ + font->name = read_section_as_string (§ion); + if (!font->name) + goto fail; +-- +2.26.2 + diff --git a/0212-gfxmenu-Fix-double-free-in-load_image.patch b/0212-gfxmenu-Fix-double-free-in-load_image.patch new file mode 100644 index 00000000..aeb027a2 --- /dev/null +++ b/0212-gfxmenu-Fix-double-free-in-load_image.patch @@ -0,0 +1,36 @@ +From 356d5cc44af753218db6a9e8e49f0d0a64e287f7 Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Wed, 8 Jul 2020 20:41:56 +0000 +Subject: [PATCH 212/237] gfxmenu: Fix double free in load_image() + +self->bitmap should be zeroed after free. Otherwise, there is a chance +to double free (USE_AFTER_FREE) it later in rescale_image(). + +Fixes: CID 292472 + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: 5d3e84b15a4 +--- + grub-core/gfxmenu/gui_image.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/gfxmenu/gui_image.c b/grub-core/gfxmenu/gui_image.c +index 29784ed2d9a..6b2e976f16e 100644 +--- a/grub-core/gfxmenu/gui_image.c ++++ b/grub-core/gfxmenu/gui_image.c +@@ -195,7 +195,10 @@ load_image (grub_gui_image_t self, const char *path) + return grub_errno; + + if (self->bitmap && (self->bitmap != self->raw_bitmap)) +- grub_video_bitmap_destroy (self->bitmap); ++ { ++ grub_video_bitmap_destroy (self->bitmap); ++ self->bitmap = 0; ++ } + if (self->raw_bitmap) + grub_video_bitmap_destroy (self->raw_bitmap); + +-- +2.26.2 + diff --git a/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch b/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch new file mode 100644 index 00000000..05109ccc --- /dev/null +++ b/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch @@ -0,0 +1,57 @@ +From 677e7108f235defb7ec6e7107963cf3576b0eab4 Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Wed, 8 Jul 2020 21:30:43 +0000 +Subject: [PATCH 213/237] xnu: Fix double free in + grub_xnu_devprop_add_property() + +grub_xnu_devprop_add_property() should not free utf8 and utf16 as it get +allocated and freed in the caller. + +Minor improvement: do prop fields initialization after memory allocations. + +Fixes: CID 292442, CID 292457, CID 292460, CID 292466 + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: 4d5e2d13519 +--- + grub-core/loader/i386/xnu.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c +index ee0eaadc4ee..c760db30fc0 100644 +--- a/grub-core/loader/i386/xnu.c ++++ b/grub-core/loader/i386/xnu.c +@@ -262,20 +262,19 @@ grub_xnu_devprop_add_property (struct grub_xnu_devprop_device_descriptor *dev, + if (!prop) + return grub_errno; + ++ prop->data = grub_malloc (datalen); ++ if (!prop->data) ++ { ++ grub_free (prop); ++ return grub_errno; ++ } ++ grub_memcpy (prop->data, data, datalen); ++ + prop->name = utf8; + prop->name16 = utf16; + prop->name16len = utf16len; +- + prop->length = datalen; +- prop->data = grub_malloc (prop->length); +- if (!prop->data) +- { +- grub_free (prop->name); +- grub_free (prop->name16); +- grub_free (prop); +- return grub_errno; +- } +- grub_memcpy (prop->data, data, prop->length); ++ + grub_list_push (GRUB_AS_LIST_P (&dev->properties), + GRUB_AS_LIST (prop)); + return GRUB_ERR_NONE; +-- +2.26.2 + diff --git a/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch b/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch new file mode 100644 index 00000000..96794f1c --- /dev/null +++ b/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch @@ -0,0 +1,52 @@ +From efb9080d69c08171b5cccc202c7a1735ab85e80a Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Thu, 9 Jul 2020 03:05:23 +0000 +Subject: [PATCH 214/237] lzma: Make sure we don't dereference past array + +The two dimensional array p->posSlotEncoder[4][64] is being dereferenced +using the GetLenToPosState() macro which checks if len is less than 5, +and if so subtracts 2 from it. If len = 0, that is 0 - 2 = 4294967294. +Obviously we don't want to dereference that far out so we check if the +position found is greater or equal kNumLenToPosStates (4) and bail out. + +N.B.: Upstream LZMA 18.05 and later has this function completely rewritten +without any history. + +Fixes: CID 51526 + +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Daniel Kiper +Upstream-commit-id: f91e043bda4 +--- + grub-core/lib/LzmaEnc.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/grub-core/lib/LzmaEnc.c b/grub-core/lib/LzmaEnc.c +index f2ec04a8c28..753e56a95e3 100644 +--- a/grub-core/lib/LzmaEnc.c ++++ b/grub-core/lib/LzmaEnc.c +@@ -1877,13 +1877,19 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize + } + else + { +- UInt32 posSlot; ++ UInt32 posSlot, lenToPosState; + RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0); + p->state = kMatchNextStates[p->state]; + LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices); + pos -= LZMA_NUM_REPS; + GetPosSlot(pos, posSlot); +- RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot); ++ lenToPosState = GetLenToPosState(len); ++ if (lenToPosState >= kNumLenToPosStates) ++ { ++ p->result = SZ_ERROR_DATA; ++ return CheckErrors(p); ++ } ++ RcTree_Encode(&p->rc, p->posSlotEncoder[lenToPosState], kNumPosSlotBits, posSlot); + + if (posSlot >= kStartPosModelIndex) + { +-- +2.26.2 + diff --git a/0215-term-Fix-overflow-on-user-inputs.patch b/0215-term-Fix-overflow-on-user-inputs.patch new file mode 100644 index 00000000..d44dc9d5 --- /dev/null +++ b/0215-term-Fix-overflow-on-user-inputs.patch @@ -0,0 +1,66 @@ +From d2864a6873bf3a8749d678b271c32f3a5ae0fa1e Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 7 Jul 2020 15:12:25 -0400 +Subject: [PATCH 215/237] term: Fix overflow on user inputs + +This requires a very weird input from the serial interface but can cause +an overflow in input_buf (keys) overwriting the next variable (npending) +with the user choice: + +(pahole output) + +struct grub_terminfo_input_state { + int input_buf[6]; /* 0 24 */ + int npending; /* 24 4 */ <- CORRUPT + ...snip... + +The magic string requires causing this is "ESC,O,],0,1,2,q" and we overflow +npending with "q" (aka increase npending to 161). The simplest fix is to +just to disallow overwrites input_buf, which exactly what this patch does. + +Fixes: CID 292449 + +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Daniel Kiper +Upstream-commit-id: 98dfa546777 +--- + grub-core/term/terminfo.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/grub-core/term/terminfo.c b/grub-core/term/terminfo.c +index 537a5c0cb0b..44d0b3b19fb 100644 +--- a/grub-core/term/terminfo.c ++++ b/grub-core/term/terminfo.c +@@ -398,7 +398,7 @@ grub_terminfo_getwh (struct grub_term_output *term) + } + + static void +-grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len, ++grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len, int max_len, + int (*readkey) (struct grub_term_input *term)) + { + int c; +@@ -414,6 +414,9 @@ grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len, + if (c == -1) \ + return; \ + \ ++ if (*len >= max_len) \ ++ return; \ ++ \ + keys[*len] = c; \ + (*len)++; \ + } +@@ -602,8 +605,8 @@ grub_terminfo_getkey (struct grub_term_input *termi) + return ret; + } + +- grub_terminfo_readkey (termi, data->input_buf, +- &data->npending, data->readkey); ++ grub_terminfo_readkey (termi, data->input_buf, &data->npending, ++ GRUB_TERMINFO_READKEY_MAX_LEN, data->readkey); + + #if defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275) + if (data->npending == 1 && data->input_buf[0] == GRUB_TERM_ESC +-- +2.26.2 + diff --git a/0216-udf-Fix-memory-leak.patch b/0216-udf-Fix-memory-leak.patch new file mode 100644 index 00000000..0e2c41b3 --- /dev/null +++ b/0216-udf-Fix-memory-leak.patch @@ -0,0 +1,56 @@ +From a85ad19c960f48f18bcbbeb7ef8f65ff83979608 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Tue, 7 Jul 2020 22:02:31 -0400 +Subject: [PATCH 216/237] udf: Fix memory leak + +Fixes: CID 73796 + +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Daniel Kiper +Reviewed-by: Jan Setje-Eilers +Upstream-commit-id: 8da62d8183c +--- + grub-core/fs/udf.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index be41b48f913..6670beb5665 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -965,8 +965,10 @@ grub_udf_iterate_dir (grub_fshelp_node_t dir, + return 0; + + if (grub_udf_read_icb (dir->data, &dirent.icb, child)) +- return 0; +- ++ { ++ grub_free (child); ++ return 0; ++ } + if (dirent.characteristics & GRUB_UDF_FID_CHAR_PARENT) + { + /* This is the parent directory. */ +@@ -988,11 +990,18 @@ grub_udf_iterate_dir (grub_fshelp_node_t dir, + dirent.file_ident_length, + (char *) raw)) + != dirent.file_ident_length) +- return 0; ++ { ++ grub_free (child); ++ return 0; ++ } + + filename = read_string (raw, dirent.file_ident_length, 0); + if (!filename) +- grub_print_error (); ++ { ++ /* As the hook won't get called. */ ++ grub_free (child); ++ grub_print_error (); ++ } + + if (filename && hook (filename, type, child, hook_data)) + { +-- +2.26.2 + diff --git a/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch b/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch new file mode 100644 index 00000000..2af622c2 --- /dev/null +++ b/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch @@ -0,0 +1,47 @@ +From 3dff974017867a65e6aae14e14a0233ce9520cb3 Mon Sep 17 00:00:00 2001 +From: Konrad Rzeszutek Wilk +Date: Fri, 26 Jun 2020 10:51:43 -0400 +Subject: [PATCH 217/237] multiboot2: Fix memory leak if + grub_create_loader_cmdline() fails + +Fixes: CID 292468 + +Signed-off-by: Konrad Rzeszutek Wilk +Reviewed-by: Daniel Kiper +Upstream-commit-id: cd6760b6289 +--- + grub-core/loader/multiboot_mbi2.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c +index 54078455e2f..47d4c6f0977 100644 +--- a/grub-core/loader/multiboot_mbi2.c ++++ b/grub-core/loader/multiboot_mbi2.c +@@ -1089,6 +1089,7 @@ grub_multiboot2_add_module (grub_addr_t start, grub_size_t size, + { + struct module *newmod; + grub_size_t len = 0; ++ grub_err_t err; + + newmod = grub_malloc (sizeof (*newmod)); + if (!newmod) +@@ -1107,8 +1108,14 @@ grub_multiboot2_add_module (grub_addr_t start, grub_size_t size, + newmod->cmdline_size = len; + total_modcmd += ALIGN_UP (len, MULTIBOOT_TAG_ALIGN); + +- grub_create_loader_cmdline (argc, argv, newmod->cmdline, +- newmod->cmdline_size); ++ err = grub_create_loader_cmdline (argc, argv, newmod->cmdline, ++ newmod->cmdline_size); ++ if (err) ++ { ++ grub_free (newmod->cmdline); ++ grub_free (newmod); ++ return err; ++ } + + if (modules_last) + modules_last->next = newmod; +-- +2.26.2 + diff --git a/0218-tftp-Do-not-use-priority-queue.patch b/0218-tftp-Do-not-use-priority-queue.patch new file mode 100644 index 00000000..2e8cd32c --- /dev/null +++ b/0218-tftp-Do-not-use-priority-queue.patch @@ -0,0 +1,281 @@ +From 46cd356a38806ea321b4db107e73114ebf959879 Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Thu, 9 Jul 2020 08:10:40 +0000 +Subject: [PATCH 218/237] tftp: Do not use priority queue + +There is not need to reassemble the order of blocks. Per RFC 1350, +server must wait for the ACK, before sending next block. Data packets +can be served immediately without putting them to priority queue. + +Logic to handle incoming packet is this: + - if packet block id equal to expected block id, then + process the packet, + - if packet block id is less than expected - this is retransmit + of old packet, then ACK it and drop the packet, + - if packet block id is more than expected - that shouldn't + happen, just drop the packet. + +It makes the tftp receive path code simpler, smaller and faster. +As a benefit, this change fixes CID# 73624 and CID# 96690, caused +by following while loop: + + while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0) + +where tftph pointer is not moving from one iteration to another, causing +to serve same packet again. Luckily, double serving didn't happen due to +data->block++ during the first iteration. + +Fixes: CID 73624, CID 96690 + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: 8316694c4f7 +--- + grub-core/net/tftp.c | 162 +++++++++++++------------------------------ + 1 file changed, 50 insertions(+), 112 deletions(-) + +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index e267af354f4..c2df3d7f6ab 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -25,7 +25,6 @@ + #include + #include + #include +-#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -106,31 +105,8 @@ typedef struct tftp_data + int have_oack; + struct grub_error_saved save_err; + grub_net_udp_socket_t sock; +- grub_priority_queue_t pq; + } *tftp_data_t; + +-static int +-cmp_block (grub_uint16_t a, grub_uint16_t b) +-{ +- grub_int16_t i = (grub_int16_t) (a - b); +- if (i > 0) +- return +1; +- if (i < 0) +- return -1; +- return 0; +-} +- +-static int +-cmp (const void *a__, const void *b__) +-{ +- struct grub_net_buff *a_ = *(struct grub_net_buff **) a__; +- struct grub_net_buff *b_ = *(struct grub_net_buff **) b__; +- struct tftphdr *a = (struct tftphdr *) a_->data; +- struct tftphdr *b = (struct tftphdr *) b_->data; +- /* We want the first elements to be on top. */ +- return -cmp_block (grub_be_to_cpu16 (a->u.data.block), grub_be_to_cpu16 (b->u.data.block)); +-} +- + static grub_err_t + ack (tftp_data_t data, grub_uint64_t block) + { +@@ -207,73 +183,60 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), + return GRUB_ERR_NONE; + } + +- err = grub_priority_queue_push (data->pq, &nb); +- if (err) +- return err; ++ /* Ack old/retransmitted block. */ ++ if (grub_be_to_cpu16 (tftph->u.data.block) < data->block + 1) ++ ack (data, grub_be_to_cpu16 (tftph->u.data.block)); ++ /* Ignore unexpected block. */ ++ else if (grub_be_to_cpu16 (tftph->u.data.block) > data->block + 1) ++ grub_dprintf ("tftp", "TFTP unexpected block # %d\n", tftph->u.data.block); ++ else ++ { ++ unsigned size; + +- { +- struct grub_net_buff **nb_top_p, *nb_top; +- while (1) +- { +- nb_top_p = grub_priority_queue_top (data->pq); +- if (!nb_top_p) +- return GRUB_ERR_NONE; +- nb_top = *nb_top_p; +- tftph = (struct tftphdr *) nb_top->data; +- if (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) >= 0) +- break; +- ack (data, grub_be_to_cpu16 (tftph->u.data.block)); +- grub_netbuff_free (nb_top); +- grub_priority_queue_pop (data->pq); +- } +- while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0) +- { +- unsigned size; +- +- grub_priority_queue_pop (data->pq); +- +- if (file->device->net->packs.count < 50) ++ if (file->device->net->packs.count < 50) ++ { + err = ack (data, data->block + 1); +- else +- { +- file->device->net->stall = 1; +- err = 0; +- } +- if (err) +- return err; ++ if (err) ++ return err; ++ } ++ else ++ file->device->net->stall = 1; + +- err = grub_netbuff_pull (nb_top, sizeof (tftph->opcode) + +- sizeof (tftph->u.data.block)); +- if (err) +- return err; +- size = nb_top->tail - nb_top->data; ++ err = grub_netbuff_pull (nb, sizeof (tftph->opcode) + ++ sizeof (tftph->u.data.block)); ++ if (err) ++ return err; ++ size = nb->tail - nb->data; + +- data->block++; +- if (size < data->block_size) +- { +- if (data->ack_sent < data->block) +- ack (data, data->block); +- file->device->net->eof = 1; +- file->device->net->stall = 1; +- grub_net_udp_close (data->sock); +- data->sock = NULL; +- } +- /* Prevent garbage in broken cards. Is it still necessary +- given that IP implementation has been fixed? +- */ +- if (size > data->block_size) +- { +- err = grub_netbuff_unput (nb_top, size - data->block_size); +- if (err) +- return err; +- } +- /* If there is data, puts packet in socket list. */ +- if ((nb_top->tail - nb_top->data) > 0) +- grub_net_put_packet (&file->device->net->packs, nb_top); +- else +- grub_netbuff_free (nb_top); +- } +- } ++ data->block++; ++ if (size < data->block_size) ++ { ++ if (data->ack_sent < data->block) ++ ack (data, data->block); ++ file->device->net->eof = 1; ++ file->device->net->stall = 1; ++ grub_net_udp_close (data->sock); ++ data->sock = NULL; ++ } ++ /* ++ * Prevent garbage in broken cards. Is it still necessary ++ * given that IP implementation has been fixed? ++ */ ++ if (size > data->block_size) ++ { ++ err = grub_netbuff_unput (nb, size - data->block_size); ++ if (err) ++ return err; ++ } ++ /* If there is data, puts packet in socket list. */ ++ if ((nb->tail - nb->data) > 0) ++ { ++ grub_net_put_packet (&file->device->net->packs, nb); ++ /* Do not free nb. */ ++ return GRUB_ERR_NONE; ++ } ++ } ++ grub_netbuff_free (nb); + return GRUB_ERR_NONE; + case TFTP_ERROR: + data->have_oack = 1; +@@ -287,19 +250,6 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), + } + } + +-static void +-destroy_pq (tftp_data_t data) +-{ +- struct grub_net_buff **nb_p; +- while ((nb_p = grub_priority_queue_top (data->pq))) +- { +- grub_netbuff_free (*nb_p); +- grub_priority_queue_pop (data->pq); +- } +- +- grub_priority_queue_destroy (data->pq); +-} +- + /* Create a normalized copy of the filename. + Compress any string of consecutive forward slashes to a single forward + slash. */ +@@ -395,13 +345,6 @@ tftp_open (struct grub_file *file, const char *filename) + file->not_easily_seekable = 1; + file->data = data; + +- data->pq = grub_priority_queue_new (sizeof (struct grub_net_buff *), cmp); +- if (!data->pq) +- { +- grub_free (data); +- return grub_errno; +- } +- + grub_dprintf("tftp", "resolving address for %s\n", file->device->net->server); + err = grub_net_resolve_address (file->device->net->server, &addr); + if (err) +@@ -410,7 +353,6 @@ tftp_open (struct grub_file *file, const char *filename) + grub_dprintf ("tftp", "file_size is %llu, block_size is %llu\n", + (unsigned long long)data->file_size, + (unsigned long long)data->block_size); +- destroy_pq (data); + grub_free (data); + return err; + } +@@ -422,7 +364,6 @@ tftp_open (struct grub_file *file, const char *filename) + if (!data->sock) + { + grub_dprintf("tftp", "connection failed\n"); +- destroy_pq (data); + grub_free (data); + return grub_errno; + } +@@ -436,7 +377,6 @@ tftp_open (struct grub_file *file, const char *filename) + if (err) + { + grub_net_udp_close (data->sock); +- destroy_pq (data); + grub_free (data); + return err; + } +@@ -453,7 +393,6 @@ tftp_open (struct grub_file *file, const char *filename) + if (grub_errno) + { + grub_net_udp_close (data->sock); +- destroy_pq (data); + grub_free (data); + return grub_errno; + } +@@ -496,7 +435,6 @@ tftp_close (struct grub_file *file) + grub_print_error (); + grub_net_udp_close (data->sock); + } +- destroy_pq (data); + grub_free (data); + return GRUB_ERR_NONE; + } +-- +2.26.2 + diff --git a/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch b/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch new file mode 100644 index 00000000..4d1bb942 --- /dev/null +++ b/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch @@ -0,0 +1,48 @@ +From 1758c2a567025aa49fd7c8ba5f3f891f7483040d Mon Sep 17 00:00:00 2001 +From: Lukasz Hawrylko +Date: Mon, 16 Dec 2019 11:15:55 +0100 +Subject: [PATCH 219/237] multiboot2: Set min address for mbi allocation to + 0x1000 + +In some cases GRUB2 allocates multiboot2 structure at 0 address, that is +a confusing behavior. Consumers of that structure can have internal NULL-checks +that will throw an error when get a pointer to data allocated at address 0. +To prevent that, define min address for mbi allocation on x86 and x86_64 +platforms. + +Signed-off-by: Lukasz Hawrylko +Reviewed-by: Daniel Kiper +Upstream-commit-id: 0f3f5b7c13f +--- + grub-core/loader/multiboot_mbi2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c +index 47d4c6f0977..797870b6138 100644 +--- a/grub-core/loader/multiboot_mbi2.c ++++ b/grub-core/loader/multiboot_mbi2.c +@@ -49,6 +49,12 @@ + #define HAS_VGA_TEXT 0 + #endif + ++#if defined (__i386__) || defined (__x86_64__) ++#define MBI_MIN_ADDR 0x1000 ++#else ++#define MBI_MIN_ADDR 0 ++#endif ++ + struct module + { + struct module *next; +@@ -747,7 +753,7 @@ grub_multiboot2_make_mbi (grub_uint32_t *target) + COMPILE_TIME_ASSERT (MULTIBOOT_TAG_ALIGN % sizeof (grub_properly_aligned_t) == 0); + + err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch, +- 0, 0xffffffff - bufsize, ++ MBI_MIN_ADDR, 0xffffffff - bufsize, + bufsize, MULTIBOOT_TAG_ALIGN, + GRUB_RELOCATOR_PREFERENCE_NONE, 1); + if (err) +-- +2.26.2 + diff --git a/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch b/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch new file mode 100644 index 00000000..a034afdf --- /dev/null +++ b/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch @@ -0,0 +1,150 @@ +From 0c7a6366d24387a2fac387374712be260694ed6c Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Wed, 15 Jul 2020 06:42:37 +0000 +Subject: [PATCH 220/237] relocator: Protect grub_relocator_alloc_chunk_addr() + input args against integer underflow/overflow + +Use arithmetic macros from safemath.h to accomplish it. In this commit, +I didn't want to be too paranoid to check every possible math equation +for overflow/underflow. Only obvious places (with non zero chance of +overflow/underflow) were refactored. + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: ebb15735f10 +--- + grub-core/loader/i386/linux.c | 9 +++++++-- + grub-core/loader/i386/pc/linux.c | 9 +++++++-- + grub-core/loader/i386/xen.c | 12 ++++++++++-- + grub-core/loader/xnu.c | 11 +++++++---- + 4 files changed, 31 insertions(+), 10 deletions(-) + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 76304f05700..b4a30f607fa 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -593,9 +594,13 @@ grub_linux_boot (void) + + { + grub_relocator_chunk_t ch; ++ grub_size_t sz; ++ ++ if (grub_add (ctx.real_size, efi_mmap_size, &sz)) ++ return GRUB_ERR_OUT_OF_RANGE; ++ + err = grub_relocator_alloc_chunk_addr (relocator, &ch, +- ctx.real_mode_target, +- (ctx.real_size + efi_mmap_size)); ++ ctx.real_mode_target, sz); + if (err) + return err; + real_mode_mem = get_virtual_current_address (ch); +diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c +index 783a3cd93bc..540891371f9 100644 +--- a/grub-core/loader/i386/pc/linux.c ++++ b/grub-core/loader/i386/pc/linux.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -231,8 +232,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + setup_sects = GRUB_LINUX_DEFAULT_SETUP_SECTS; + + real_size = setup_sects << GRUB_DISK_SECTOR_BITS; +- grub_linux16_prot_size = grub_file_size (file) +- - real_size - GRUB_DISK_SECTOR_SIZE; ++ if (grub_sub (grub_file_size (file), real_size, &grub_linux16_prot_size) || ++ grub_sub (grub_linux16_prot_size, GRUB_DISK_SECTOR_SIZE, &grub_linux16_prot_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ goto fail; ++ } + + if (! grub_linux_is_bzimage + && GRUB_LINUX_ZIMAGE_ADDR + grub_linux16_prot_size +diff --git a/grub-core/loader/i386/xen.c b/grub-core/loader/i386/xen.c +index 3073f64d5e5..85b93347b25 100644 +--- a/grub-core/loader/i386/xen.c ++++ b/grub-core/loader/i386/xen.c +@@ -40,6 +40,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -635,6 +636,7 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)), + grub_relocator_chunk_t ch; + grub_addr_t kern_start; + grub_addr_t kern_end; ++ grub_size_t sz; + + if (argc == 0) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); +@@ -699,8 +701,14 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)), + + xen_state.max_addr = ALIGN_UP (kern_end, PAGE_SIZE); + +- err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start, +- kern_end - kern_start); ++ ++ if (grub_sub (kern_end, kern_start, &sz)) ++ { ++ err = GRUB_ERR_OUT_OF_RANGE; ++ goto fail; ++ } ++ ++ err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start, sz); + if (err) + goto fail; + kern_chunk_src = get_virtual_current_address (ch); +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index dc7d5409e1e..2bf02489bad 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -59,15 +60,17 @@ grub_xnu_heap_malloc (int size, void **src, grub_addr_t *target) + { + grub_err_t err; + grub_relocator_chunk_t ch; ++ grub_addr_t tgt; ++ ++ if (grub_add (grub_xnu_heap_target_start, grub_xnu_heap_size, &tgt)) ++ return GRUB_ERR_OUT_OF_RANGE; + +- err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch, +- grub_xnu_heap_target_start +- + grub_xnu_heap_size, size); ++ err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch, tgt, size); + if (err) + return err; + + *src = get_virtual_current_address (ch); +- *target = grub_xnu_heap_target_start + grub_xnu_heap_size; ++ *target = tgt; + grub_xnu_heap_size += size; + grub_dprintf ("xnu", "val=%p\n", *src); + return GRUB_ERR_NONE; +-- +2.26.2 + diff --git a/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch b/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch new file mode 100644 index 00000000..98e1780f --- /dev/null +++ b/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch @@ -0,0 +1,338 @@ +From e2d3341a2a7bd4ef68d8c6d70922732621ea6cb3 Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Wed, 8 Jul 2020 01:44:38 +0000 +Subject: [PATCH 221/237] relocator: Protect grub_relocator_alloc_chunk_align() + max_addr against integer underflow + +This commit introduces integer underflow mitigation in max_addr calculation +in grub_relocator_alloc_chunk_align() invocation. + +It consists of 2 fixes: + 1. Introduced grub_relocator_alloc_chunk_align_safe() wrapper function to perform + sanity check for min/max and size values, and to make safe invocation of + grub_relocator_alloc_chunk_align() with validated max_addr value. Replace all + invocations such as grub_relocator_alloc_chunk_align(..., min_addr, max_addr - size, size, ...) + by grub_relocator_alloc_chunk_align_safe(..., min_addr, max_addr, size, ...). + 2. Introduced UP_TO_TOP32(s) macro for the cases where max_addr is 32-bit top + address (0xffffffff - size + 1) or similar. + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: 10498c8ba17 +--- + grub-core/lib/i386/relocator.c | 28 ++++++++++---------------- + grub-core/lib/mips/relocator.c | 6 ++---- + grub-core/lib/powerpc/relocator.c | 6 ++---- + grub-core/lib/x86_64/efi/relocator.c | 7 +++---- + grub-core/loader/i386/linux.c | 5 ++--- + grub-core/loader/i386/multiboot_mbi.c | 7 +++---- + grub-core/loader/i386/pc/linux.c | 6 ++---- + grub-core/loader/mips/linux.c | 9 +++------ + grub-core/loader/multiboot.c | 2 +- + grub-core/loader/multiboot_elfxx.c | 10 ++++----- + grub-core/loader/multiboot_mbi2.c | 10 ++++----- + grub-core/loader/xnu_resume.c | 2 +- + include/grub/relocator.h | 29 +++++++++++++++++++++++++++ + 13 files changed, 69 insertions(+), 58 deletions(-) + +diff --git a/grub-core/lib/i386/relocator.c b/grub-core/lib/i386/relocator.c +index 71dd4f0ab0c..34cbe834fa3 100644 +--- a/grub-core/lib/i386/relocator.c ++++ b/grub-core/lib/i386/relocator.c +@@ -83,11 +83,10 @@ grub_relocator32_boot (struct grub_relocator *rel, + /* Specific memory range due to Global Descriptor Table for use by payload + that we will store in returned chunk. The address range and preference + are based on "THE LINUX/x86 BOOT PROTOCOL" specification. */ +- err = grub_relocator_alloc_chunk_align (rel, &ch, 0x1000, +- 0x9a000 - RELOCATOR_SIZEOF (32), +- RELOCATOR_SIZEOF (32), 16, +- GRUB_RELOCATOR_PREFERENCE_LOW, +- avoid_efi_bootservices); ++ err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x1000, 0x9a000, ++ RELOCATOR_SIZEOF (32), 16, ++ GRUB_RELOCATOR_PREFERENCE_LOW, ++ avoid_efi_bootservices); + if (err) + return err; + +@@ -125,13 +124,10 @@ grub_relocator16_boot (struct grub_relocator *rel, + grub_relocator_chunk_t ch; + + /* Put it higher than the byte it checks for A20 check. */ +- err = grub_relocator_alloc_chunk_align (rel, &ch, 0x8010, +- 0xa0000 - RELOCATOR_SIZEOF (16) +- - GRUB_RELOCATOR16_STACK_SIZE, +- RELOCATOR_SIZEOF (16) +- + GRUB_RELOCATOR16_STACK_SIZE, 16, +- GRUB_RELOCATOR_PREFERENCE_NONE, +- 0); ++ err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x8010, 0xa0000, ++ RELOCATOR_SIZEOF (16) + ++ GRUB_RELOCATOR16_STACK_SIZE, 16, ++ GRUB_RELOCATOR_PREFERENCE_NONE, 0); + if (err) + return err; + +@@ -183,11 +179,9 @@ grub_relocator64_boot (struct grub_relocator *rel, + void *relst; + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_align (rel, &ch, min_addr, +- max_addr - RELOCATOR_SIZEOF (64), +- RELOCATOR_SIZEOF (64), 16, +- GRUB_RELOCATOR_PREFERENCE_NONE, +- 0); ++ err = grub_relocator_alloc_chunk_align_safe (rel, &ch, min_addr, max_addr, ++ RELOCATOR_SIZEOF (64), 16, ++ GRUB_RELOCATOR_PREFERENCE_NONE, 0); + if (err) + return err; + +diff --git a/grub-core/lib/mips/relocator.c b/grub-core/lib/mips/relocator.c +index 9d5f49cb93a..743b213e695 100644 +--- a/grub-core/lib/mips/relocator.c ++++ b/grub-core/lib/mips/relocator.c +@@ -120,10 +120,8 @@ grub_relocator32_boot (struct grub_relocator *rel, + unsigned i; + grub_addr_t vtarget; + +- err = grub_relocator_alloc_chunk_align (rel, &ch, 0, +- (0xffffffff - stateset_size) +- + 1, stateset_size, +- sizeof (grub_uint32_t), ++ err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size), ++ stateset_size, sizeof (grub_uint32_t), + GRUB_RELOCATOR_PREFERENCE_NONE, 0); + if (err) + return err; +diff --git a/grub-core/lib/powerpc/relocator.c b/grub-core/lib/powerpc/relocator.c +index bdf2b111be7..8ffb8b68683 100644 +--- a/grub-core/lib/powerpc/relocator.c ++++ b/grub-core/lib/powerpc/relocator.c +@@ -115,10 +115,8 @@ grub_relocator32_boot (struct grub_relocator *rel, + unsigned i; + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_align (rel, &ch, 0, +- (0xffffffff - stateset_size) +- + 1, stateset_size, +- sizeof (grub_uint32_t), ++ err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size), ++ stateset_size, sizeof (grub_uint32_t), + GRUB_RELOCATOR_PREFERENCE_NONE, 0); + if (err) + return err; +diff --git a/grub-core/lib/x86_64/efi/relocator.c b/grub-core/lib/x86_64/efi/relocator.c +index 3caef7a4021..7d200a125ee 100644 +--- a/grub-core/lib/x86_64/efi/relocator.c ++++ b/grub-core/lib/x86_64/efi/relocator.c +@@ -50,10 +50,9 @@ grub_relocator64_efi_boot (struct grub_relocator *rel, + * 64-bit relocator code may live above 4 GiB quite well. + * However, I do not want ask for problems. Just in case. + */ +- err = grub_relocator_alloc_chunk_align (rel, &ch, 0, +- 0x100000000 - RELOCATOR_SIZEOF (64_efi), +- RELOCATOR_SIZEOF (64_efi), 16, +- GRUB_RELOCATOR_PREFERENCE_NONE, 1); ++ err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0, 0x100000000, ++ RELOCATOR_SIZEOF (64_efi), 16, ++ GRUB_RELOCATOR_PREFERENCE_NONE, 1); + if (err) + return err; + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index b4a30f607fa..191f1631e88 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -231,9 +231,8 @@ allocate_pages (grub_size_t prot_size, grub_size_t *align, + for (; err && *align + 1 > min_align; (*align)--) + { + grub_errno = GRUB_ERR_NONE; +- err = grub_relocator_alloc_chunk_align (relocator, &ch, +- 0x1000000, +- 0xffffffff & ~prot_size, ++ err = grub_relocator_alloc_chunk_align (relocator, &ch, 0x1000000, ++ UP_TO_TOP32 (prot_size), + prot_size, 1 << *align, + GRUB_RELOCATOR_PREFERENCE_LOW, + 1); +diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c +index ca85358f771..9d3466d6ace 100644 +--- a/grub-core/loader/i386/multiboot_mbi.c ++++ b/grub-core/loader/i386/multiboot_mbi.c +@@ -470,10 +470,9 @@ grub_multiboot_make_mbi (grub_uint32_t *target) + + bufsize = grub_multiboot_get_mbi_size (); + +- err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch, +- 0x10000, 0xa0000 - bufsize, +- bufsize, 4, +- GRUB_RELOCATOR_PREFERENCE_NONE, 0); ++ err = grub_relocator_alloc_chunk_align_safe (grub_multiboot_relocator, &ch, ++ 0x10000, 0xa0000, bufsize, 4, ++ GRUB_RELOCATOR_PREFERENCE_NONE, 0); + if (err) + return err; + ptrorig = get_virtual_current_address (ch); +diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c +index 540891371f9..63736fae950 100644 +--- a/grub-core/loader/i386/pc/linux.c ++++ b/grub-core/loader/i386/pc/linux.c +@@ -460,10 +460,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + + { + grub_relocator_chunk_t ch; +- err = grub_relocator_alloc_chunk_align (relocator, &ch, +- addr_min, addr_max - size, +- size, 0x1000, +- GRUB_RELOCATOR_PREFERENCE_HIGH, 0); ++ err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, addr_min, addr_max, size, ++ 0x1000, GRUB_RELOCATOR_PREFERENCE_HIGH, 0); + if (err) + return err; + initrd_chunk = get_virtual_current_address (ch); +diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c +index 5f383be3d07..27c1db84a44 100644 +--- a/grub-core/loader/mips/linux.c ++++ b/grub-core/loader/mips/linux.c +@@ -434,12 +434,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + { + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_align (relocator, &ch, +- (target_addr & 0x1fffffff) +- + linux_size + 0x10000, +- (0x10000000 - size), +- size, 0x10000, +- GRUB_RELOCATOR_PREFERENCE_NONE, 0); ++ err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, (target_addr & 0x1fffffff) + ++ linux_size + 0x10000, 0x10000000, size, ++ 0x10000, GRUB_RELOCATOR_PREFERENCE_NONE, 0); + + if (err) + goto fail; +diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c +index 9a8dae5565b..f455e803910 100644 +--- a/grub-core/loader/multiboot.c ++++ b/grub-core/loader/multiboot.c +@@ -407,7 +407,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)), + { + grub_relocator_chunk_t ch; + err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch, +- lowest_addr, (0xffffffff - size) + 1, ++ lowest_addr, UP_TO_TOP32 (size), + size, MULTIBOOT_MOD_ALIGN, + GRUB_RELOCATOR_PREFERENCE_NONE, 1); + if (err) +diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c +index cc6853692a8..f2318e0d165 100644 +--- a/grub-core/loader/multiboot_elfxx.c ++++ b/grub-core/loader/multiboot_elfxx.c +@@ -109,10 +109,10 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld) + if (load_size > mld->max_addr || mld->min_addr > mld->max_addr - load_size) + return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size"); + +- err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch, +- mld->min_addr, mld->max_addr - load_size, +- load_size, mld->align ? mld->align : 1, +- mld->preference, mld->avoid_efi_boot_services); ++ err = grub_relocator_alloc_chunk_align_safe (GRUB_MULTIBOOT (relocator), &ch, ++ mld->min_addr, mld->max_addr, ++ load_size, mld->align ? mld->align : 1, ++ mld->preference, mld->avoid_efi_boot_services); + + if (err) + { +@@ -256,7 +256,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld) + continue; + + err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch, 0, +- (0xffffffff - sh->sh_size) + 1, ++ UP_TO_TOP32 (sh->sh_size), + sh->sh_size, sh->sh_addralign, + GRUB_RELOCATOR_PREFERENCE_NONE, + mld->avoid_efi_boot_services); +diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c +index 797870b6138..0185c2ab894 100644 +--- a/grub-core/loader/multiboot_mbi2.c ++++ b/grub-core/loader/multiboot_mbi2.c +@@ -304,10 +304,10 @@ grub_multiboot2_load (grub_file_t file, const char *filename) + return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size"); + } + +- err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch, +- mld.min_addr, mld.max_addr - code_size, +- code_size, mld.align ? mld.align : 1, +- mld.preference, keep_bs); ++ err = grub_relocator_alloc_chunk_align_safe (grub_multiboot2_relocator, &ch, ++ mld.min_addr, mld.max_addr, ++ code_size, mld.align ? mld.align : 1, ++ mld.preference, keep_bs); + } + else + err = grub_relocator_alloc_chunk_addr (grub_multiboot2_relocator, +@@ -753,7 +753,7 @@ grub_multiboot2_make_mbi (grub_uint32_t *target) + COMPILE_TIME_ASSERT (MULTIBOOT_TAG_ALIGN % sizeof (grub_properly_aligned_t) == 0); + + err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch, +- MBI_MIN_ADDR, 0xffffffff - bufsize, ++ MBI_MIN_ADDR, UP_TO_TOP32 (bufsize), + bufsize, MULTIBOOT_TAG_ALIGN, + GRUB_RELOCATOR_PREFERENCE_NONE, 1); + if (err) +diff --git a/grub-core/loader/xnu_resume.c b/grub-core/loader/xnu_resume.c +index 534a74438b2..99119558d21 100644 +--- a/grub-core/loader/xnu_resume.c ++++ b/grub-core/loader/xnu_resume.c +@@ -129,7 +129,7 @@ grub_xnu_resume (char *imagename) + { + grub_relocator_chunk_t ch; + err = grub_relocator_alloc_chunk_align (grub_xnu_relocator, &ch, 0, +- (0xffffffff - hibhead.image_size) + 1, ++ UP_TO_TOP32 (hibhead.image_size), + hibhead.image_size, + GRUB_XNU_PAGESIZE, + GRUB_RELOCATOR_PREFERENCE_NONE, 0); +diff --git a/include/grub/relocator.h b/include/grub/relocator.h +index 24d8672d22c..1b3bdd92ac6 100644 +--- a/include/grub/relocator.h ++++ b/include/grub/relocator.h +@@ -49,6 +49,35 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel, + int preference, + int avoid_efi_boot_services); + ++/* ++ * Wrapper for grub_relocator_alloc_chunk_align() with purpose of ++ * protecting against integer underflow. ++ * ++ * Compare to its callee, max_addr has different meaning here. ++ * It covers entire chunk and not just start address of the chunk. ++ */ ++static inline grub_err_t ++grub_relocator_alloc_chunk_align_safe (struct grub_relocator *rel, ++ grub_relocator_chunk_t *out, ++ grub_phys_addr_t min_addr, ++ grub_phys_addr_t max_addr, ++ grub_size_t size, grub_size_t align, ++ int preference, ++ int avoid_efi_boot_services) ++{ ++ /* Sanity check and ensure following equation (max_addr - size) is safe. */ ++ if (max_addr < size || (max_addr - size) < min_addr) ++ return GRUB_ERR_OUT_OF_RANGE; ++ ++ return grub_relocator_alloc_chunk_align (rel, out, min_addr, ++ max_addr - size, ++ size, align, preference, ++ avoid_efi_boot_services); ++} ++ ++/* Top 32-bit address minus s bytes and plus 1 byte. */ ++#define UP_TO_TOP32(s) ((~(s) & 0xffffffff) + 1) ++ + #define GRUB_RELOCATOR_PREFERENCE_NONE 0 + #define GRUB_RELOCATOR_PREFERENCE_LOW 1 + #define GRUB_RELOCATOR_PREFERENCE_HIGH 2 +-- +2.26.2 + diff --git a/0222-script-Remove-unused-fields-from-grub_script_functio.patch b/0222-script-Remove-unused-fields-from-grub_script_functio.patch new file mode 100644 index 00000000..d31ccf04 --- /dev/null +++ b/0222-script-Remove-unused-fields-from-grub_script_functio.patch @@ -0,0 +1,34 @@ +From a358cbbdcd0350796828904623ebcb88ca844627 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Fri, 10 Jul 2020 11:21:14 +0100 +Subject: [PATCH 222/237] script: Remove unused fields from + grub_script_function struct + +Signed-off-by: Chris Coulson +Reviewed-by: Daniel Kiper +Upstream-commit-id: d04089c8e52 +--- + include/grub/script_sh.h | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h +index 360c2be1f05..b382bcf09bc 100644 +--- a/include/grub/script_sh.h ++++ b/include/grub/script_sh.h +@@ -359,13 +359,8 @@ struct grub_script_function + /* The script function. */ + struct grub_script *func; + +- /* The flags. */ +- unsigned flags; +- + /* The next element. */ + struct grub_script_function *next; +- +- int references; + }; + typedef struct grub_script_function *grub_script_function_t; + +-- +2.26.2 + diff --git a/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch b/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch new file mode 100644 index 00000000..1f406a70 --- /dev/null +++ b/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch @@ -0,0 +1,108 @@ +From f32da3dd1388e61b1f443a419e2fb1d8333bb9a3 Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Fri, 10 Jul 2020 14:41:45 +0100 +Subject: [PATCH 223/237] script: Avoid a use-after-free when redefining a + function during execution + +Defining a new function with the same name as a previously defined +function causes the grub_script and associated resources for the +previous function to be freed. If the previous function is currently +executing when a function with the same name is defined, this results +in use-after-frees when processing subsequent commands in the original +function. + +Instead, reject a new function definition if it has the same name as +a previously defined function, and that function is currently being +executed. Although a behavioural change, this should be backwards +compatible with existing configurations because they can't be +dependent on the current behaviour without being broken. + +Signed-off-by: Chris Coulson +Reviewed-by: Daniel Kiper +Upstream-commit-id: f6253a1f540 +--- + grub-core/script/execute.c | 2 ++ + grub-core/script/function.c | 16 +++++++++++++--- + include/grub/script_sh.h | 2 ++ + grub-core/script/parser.y | 3 ++- + 4 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 528ddfd36f0..a1aadb9ee05 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -872,7 +872,9 @@ grub_script_function_call (grub_script_function_t func, int argc, char **args) + old_scope = scope; + scope = &new_scope; + ++ func->executing++; + ret = grub_script_execute (func->func); ++ func->executing--; + + function_return = 0; + active_loops = loops; +diff --git a/grub-core/script/function.c b/grub-core/script/function.c +index d36655e510f..3aad04bf9dd 100644 +--- a/grub-core/script/function.c ++++ b/grub-core/script/function.c +@@ -34,6 +34,7 @@ grub_script_function_create (struct grub_script_arg *functionname_arg, + func = (grub_script_function_t) grub_malloc (sizeof (*func)); + if (! func) + return 0; ++ func->executing = 0; + + func->name = grub_strdup (functionname_arg->str); + if (! func->name) +@@ -60,10 +61,19 @@ grub_script_function_create (struct grub_script_arg *functionname_arg, + grub_script_function_t q; + + q = *p; +- grub_script_free (q->func); +- q->func = cmd; + grub_free (func); +- func = q; ++ if (q->executing > 0) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, ++ N_("attempt to redefine a function being executed")); ++ func = NULL; ++ } ++ else ++ { ++ grub_script_free (q->func); ++ q->func = cmd; ++ func = q; ++ } + } + else + { +diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h +index b382bcf09bc..6c48e075122 100644 +--- a/include/grub/script_sh.h ++++ b/include/grub/script_sh.h +@@ -361,6 +361,8 @@ struct grub_script_function + + /* The next element. */ + struct grub_script_function *next; ++ ++ unsigned executing; + }; + typedef struct grub_script_function *grub_script_function_t; + +diff --git a/grub-core/script/parser.y b/grub-core/script/parser.y +index 4f0ab8319e3..f80b86b6f15 100644 +--- a/grub-core/script/parser.y ++++ b/grub-core/script/parser.y +@@ -289,7 +289,8 @@ function: "function" "name" + grub_script_mem_free (state->func_mem); + else { + script->children = state->scripts; +- grub_script_function_create ($2, script); ++ if (!grub_script_function_create ($2, script)) ++ grub_script_free (script); + } + + state->scripts = $3; +-- +2.26.2 + diff --git a/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch b/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch new file mode 100644 index 00000000..3b5f41be --- /dev/null +++ b/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch @@ -0,0 +1,46 @@ +From 6915294adb87c0c85644977ede5e2e8410145e47 Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Fri, 17 Jul 2020 05:17:26 +0000 +Subject: [PATCH 224/237] relocator: Fix grub_relocator_alloc_chunk_align() top + memory allocation + +Current implementation of grub_relocator_alloc_chunk_align() +does not allow allocation of the top byte. + +Assuming input args are: + max_addr = 0xfffff000; + size = 0x1000; + +And this is valid. But following overflow protection will +unnecessarily move max_addr one byte down (to 0xffffefff): + if (max_addr > ~size) + max_addr = ~size; + +~size + 1 will fix the situation. In addition, check size +for non zero to do not zero max_addr. + +Signed-off-by: Alexey Makhalov +Reviewed-by: Daniel Kiper +Upstream-commit-id: ab80a97eb1f +--- + grub-core/lib/relocator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c +index 5847aac3643..f2c1944c28d 100644 +--- a/grub-core/lib/relocator.c ++++ b/grub-core/lib/relocator.c +@@ -1386,8 +1386,8 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel, + }; + grub_addr_t min_addr2 = 0, max_addr2; + +- if (max_addr > ~size) +- max_addr = ~size; ++ if (size && (max_addr > ~size)) ++ max_addr = ~size + 1; + + #ifdef GRUB_MACHINE_PCBIOS + if (min_addr < 0x1000) +-- +2.26.2 + diff --git a/0225-hfsplus-fix-two-more-overflows.patch b/0225-hfsplus-fix-two-more-overflows.patch new file mode 100644 index 00000000..bdb225b2 --- /dev/null +++ b/0225-hfsplus-fix-two-more-overflows.patch @@ -0,0 +1,57 @@ +From e69336cd346bcd06931e290fe059e3e749f1fe0a Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 14:43:31 -0400 +Subject: [PATCH 225/237] hfsplus: fix two more overflows + +Both node->size and node->namelen come from the supplied filesystem, +which may be user-supplied. We can't trust them for the math unless we +know they don't overflow; making sure they go through calloc() first +will give us that. + +Signed-off-by: Peter Jones +Reviewed-by: Darren Kenny +Upstream-commit-id: b4915078903 +--- + grub-core/fs/hfsplus.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index db8ee7afc5d..6ceea039b65 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -475,8 +476,12 @@ grub_hfsplus_read_symlink (grub_fshelp_node_t node) + { + char *symlink; + grub_ssize_t numread; ++ grub_size_t sz = node->size; + +- symlink = grub_malloc (node->size + 1); ++ if (grub_add (sz, 1, &sz)) ++ return NULL; ++ ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -715,8 +720,8 @@ list_nodes (void *record, void *hook_arg) + if (type == GRUB_FSHELP_UNKNOWN) + return 0; + +- filename = grub_malloc (grub_be_to_cpu16 (catkey->namelen) +- * GRUB_MAX_UTF8_PER_UTF16 + 1); ++ filename = grub_calloc (grub_be_to_cpu16 (catkey->namelen), ++ GRUB_MAX_UTF8_PER_UTF16 + 1); + if (! filename) + return 0; + +-- +2.26.2 + diff --git a/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch b/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch new file mode 100644 index 00000000..9d1509ab --- /dev/null +++ b/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch @@ -0,0 +1,112 @@ +From d5bced0897b30edfbf0428e6ae57c59166b0b7b3 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 15:48:20 -0400 +Subject: [PATCH 226/237] lvm: fix two more potential data-dependent alloc + overflows + +It appears to be possible to make a (possibly invalid) lvm PV with a +metadata size field that overflows our type when adding it to the +address we've allocated. Even if it doesn't, it may be possible to do +so with the math using the outcome of that as an operand. Check them +both. + +Signed-off-by: Peter Jones +Signed-off-by: Darren Kenny +Upstream-commit-id: 45ec6046ea0 +--- + grub-core/disk/lvm.c | 47 ++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 39 insertions(+), 8 deletions(-) + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 8e76d1ae121..cca8ec668ba 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_UTIL + #include +@@ -102,10 +103,11 @@ grub_lvm_detect (grub_disk_t disk, + { + grub_err_t err; + grub_uint64_t mda_offset, mda_size; ++ grub_size_t ptr; + char buf[GRUB_LVM_LABEL_SIZE]; + char vg_id[GRUB_LVM_ID_STRLEN+1]; + char pv_id[GRUB_LVM_ID_STRLEN+1]; +- char *metadatabuf, *vgname; ++ char *metadatabuf, *mda_end, *vgname; + const char *p, *q; + struct grub_lvm_label_header *lh = (struct grub_lvm_label_header *) buf; + struct grub_lvm_pv_header *pvh; +@@ -206,19 +208,31 @@ grub_lvm_detect (grub_disk_t disk, + grub_le_to_cpu64 (rlocn->size) - + grub_le_to_cpu64 (mdah->size)); + } +- p = q = metadatabuf + grub_le_to_cpu64 (rlocn->offset); + +- while (*q != ' ' && q < metadatabuf + mda_size) +- q++; +- +- if (q == metadatabuf + mda_size) ++ if (grub_add ((grub_size_t)metadatabuf, ++ (grub_size_t)grub_le_to_cpu64 (rlocn->offset), ++ &ptr)) + { ++error_parsing_metadata: + #ifdef GRUB_UTIL + grub_util_info ("error parsing metadata"); + #endif + goto fail2; + } + ++ p = q = (char *)ptr; ++ ++ if (grub_add ((grub_size_t)metadatabuf, (grub_size_t)mda_size, &ptr)) ++ goto error_parsing_metadata; ++ ++ mda_end = (char *)ptr; ++ ++ while (*q != ' ' && q < mda_end) ++ q++; ++ ++ if (q == mda_end) ++ goto error_parsing_metadata; ++ + vgname_len = q - p; + vgname = grub_malloc (vgname_len + 1); + if (!vgname) +@@ -368,8 +382,25 @@ grub_lvm_detect (grub_disk_t disk, + { + const char *iptr; + char *optr; +- lv->fullname = grub_malloc (sizeof ("lvm/") - 1 + 2 * vgname_len +- + 1 + 2 * s + 1); ++ ++ /* this is kind of hard to read with our safe (but rather ++ * baroque) math primatives, but it boils down to: ++ * ++ * sz0 = vgname_len * 2 + 1 ++ * + s * 2 + 1 ++ * + sizeof ("lvm/") - 1; ++ */ ++ grub_size_t sz0 = vgname_len, sz1 = s; ++ ++ if (grub_mul (sz0, 2, &sz0) || ++ grub_add (sz0, 1, &sz0) || ++ grub_mul (sz1, 2, &sz1) || ++ grub_add (sz1, 1, &sz1) || ++ grub_add (sz0, sz1, &sz0) || ++ grub_add (sz0, sizeof ("lvm/") - 1, &sz0)) ++ goto lvs_fail; ++ ++ lv->fullname = grub_malloc (sz0); + if (!lv->fullname) + goto lvs_fail; + +-- +2.26.2 + diff --git a/0227-emu-make-grub_free-NULL-safe.patch b/0227-emu-make-grub_free-NULL-safe.patch new file mode 100644 index 00000000..cd934ea6 --- /dev/null +++ b/0227-emu-make-grub_free-NULL-safe.patch @@ -0,0 +1,34 @@ +From 586555d31fc16e666aa1cb108ef4acdc4d8e280d Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 16:08:08 -0400 +Subject: [PATCH 227/237] emu: make grub_free(NULL) safe + +The grub_free() implementation in kern/mm.c safely handles NULL +pointers, and code at many places depends on this. We don't know that +the same is true on all host OSes, so we need to handle the same +behavior in grub-emu's implementation. + +Signed-off-by: Peter Jones +Reviewed-by: Darren Kenny +Upstream-commit-id: 96bb109e658 +--- + grub-core/kern/emu/mm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c +index 145b01d3719..4d1046a219e 100644 +--- a/grub-core/kern/emu/mm.c ++++ b/grub-core/kern/emu/mm.c +@@ -60,7 +60,8 @@ grub_zalloc (grub_size_t size) + void + grub_free (void *ptr) + { +- free (ptr); ++ if (ptr) ++ free (ptr); + } + + void * +-- +2.26.2 + diff --git a/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch b/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch new file mode 100644 index 00000000..a5ff8c9b --- /dev/null +++ b/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch @@ -0,0 +1,252 @@ +From 44da24d70495387b459db27c22cc7aa3c28b3ef9 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 16:53:27 -0400 +Subject: [PATCH 228/237] efi: fix some malformed device path arithmetic + errors. + +Several places we take the length of a device path and subtract 4 from +it, without ever checking that it's >= 4. There are also cases where +this kind of malformation will result in unpredictable iteration, +including treating the length from one dp node as the type in the next +node. These are all errors, no matter where the data comes from. + +This patch adds a checking macro, GRUB_EFI_DEVICE_PATH_VALID(), which +can be used in several places, and makes GRUB_EFI_NEXT_DEVICE_PATH() +return NULL and GRUB_EFI_END_ENTIRE_DEVICE_PATH() evaluate as true when +the length is too small. Additionally, it makes several places in the +code check for and return errors in these cases. + +Signed-off-by: Peter Jones +Upstream-commit-id: 23e68a83990 +--- + grub-core/kern/efi/efi.c | 67 +++++++++++++++++++++++++----- + grub-core/loader/efi/chainloader.c | 19 ++++++++- + grub-core/loader/i386/xnu.c | 9 ++-- + include/grub/efi/api.h | 14 ++++--- + 4 files changed, 88 insertions(+), 21 deletions(-) + +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 5cc4d8f84ed..969d13dd3f8 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -347,7 +347,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + + dp = dp0; + +- while (1) ++ while (dp) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -357,9 +357,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE + && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE) + { +- grub_efi_uint16_t len; +- len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4) +- / sizeof (grub_efi_char16_t)); ++ grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ len = (len - 4) / sizeof (grub_efi_char16_t); + filesize += GRUB_MAX_UTF8_PER_UTF16 * len + 2; + } + +@@ -375,7 +381,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + if (!name) + return NULL; + +- while (1) ++ while (dp) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -391,8 +397,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0) + + *p++ = '/'; + +- len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4) +- / sizeof (grub_efi_char16_t)); ++ len = GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ len = (len - 4) / sizeof (grub_efi_char16_t); + fp = (grub_efi_file_path_device_path_t *) dp; + /* According to EFI spec Path Name is NULL terminated */ + while (len > 0 && fp->path_name[len - 1] == 0) +@@ -467,7 +480,26 @@ grub_efi_duplicate_device_path (const grub_efi_device_path_t *dp) + ; + p = GRUB_EFI_NEXT_DEVICE_PATH (p)) + { +- total_size += GRUB_EFI_DEVICE_PATH_LENGTH (p); ++ grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (p); ++ ++ /* ++ * In the event that we find a node that's completely garbage, for ++ * example if we get to 0x7f 0x01 0x02 0x00 ... (EndInstance with a size ++ * of 2), GRUB_EFI_END_ENTIRE_DEVICE_PATH() will be true and ++ * GRUB_EFI_NEXT_DEVICE_PATH() will return NULL, so we won't continue, ++ * and neither should our consumers, but there won't be any error raised ++ * even though the device path is junk. ++ * ++ * This keeps us from passing junk down back to our caller. ++ */ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ total_size += len; + if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (p)) + break; + } +@@ -512,7 +544,7 @@ dump_vendor_path (const char *type, grub_efi_vendor_device_path_t *vendor) + void + grub_efi_print_device_path (grub_efi_device_path_t *dp) + { +- while (1) ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp)) + { + grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp); + grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp); +@@ -984,7 +1016,11 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1, + /* Return non-zero. */ + return 1; + +- while (1) ++ if (dp1 == dp2) ++ return 0; ++ ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp1) ++ && GRUB_EFI_DEVICE_PATH_VALID (dp2)) + { + grub_efi_uint8_t type1, type2; + grub_efi_uint8_t subtype1, subtype2; +@@ -1020,5 +1056,16 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1, + dp2 = (grub_efi_device_path_t *) ((char *) dp2 + len2); + } + ++ /* ++ * There's no "right" answer here, but we probably don't want to call a valid ++ * dp and an invalid dp equal, so pick one way or the other. ++ */ ++ if (GRUB_EFI_DEVICE_PATH_VALID (dp1) && ++ !GRUB_EFI_DEVICE_PATH_VALID (dp2)) ++ return 1; ++ else if (!GRUB_EFI_DEVICE_PATH_VALID (dp1) && ++ GRUB_EFI_DEVICE_PATH_VALID (dp2)) ++ return -1; ++ + return 0; + } +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 2da119ad513..c2411b6dab2 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -125,6 +125,12 @@ copy_file_path (grub_efi_file_path_device_path_t *fp, + fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE; + fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE; + ++ if (!GRUB_EFI_DEVICE_PATH_VALID ((grub_efi_device_path_t *)fp)) ++ { ++ grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI Device Path is invalid"); ++ return; ++ } ++ + path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name)); + if (!path_name) + return; +@@ -164,9 +170,18 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + + size = 0; + d = dp; +- while (1) ++ while (d) + { +- size += GRUB_EFI_DEVICE_PATH_LENGTH (d); ++ grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (d); ++ ++ if (len < 4) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "malformed EFI Device Path node has length=%d", len); ++ return NULL; ++ } ++ ++ size += len; + if ((GRUB_EFI_END_ENTIRE_DEVICE_PATH (d))) + break; + d = GRUB_EFI_NEXT_DEVICE_PATH (d); +diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c +index c760db30fc0..44f7ebfa2b6 100644 +--- a/grub-core/loader/i386/xnu.c ++++ b/grub-core/loader/i386/xnu.c +@@ -515,14 +515,15 @@ grub_cmd_devprop_load (grub_command_t cmd __attribute__ ((unused)), + + devhead = buf; + buf = devhead + 1; +- dpstart = buf; ++ dp = dpstart = buf; + +- do ++ while (GRUB_EFI_DEVICE_PATH_VALID (dp) && buf < bufend) + { +- dp = buf; + buf = (char *) buf + GRUB_EFI_DEVICE_PATH_LENGTH (dp); ++ if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp)) ++ break; ++ dp = buf; + } +- while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp) && buf < bufend); + + dev = grub_xnu_devprop_add_device (dpstart, (char *) buf + - (char *) dpstart); +diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h +index 0c15cffa23c..3bff70d1c0e 100644 +--- a/include/grub/efi/api.h ++++ b/include/grub/efi/api.h +@@ -666,6 +666,7 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t; + #define GRUB_EFI_DEVICE_PATH_TYPE(dp) ((dp)->type & 0x7f) + #define GRUB_EFI_DEVICE_PATH_SUBTYPE(dp) ((dp)->subtype) + #define GRUB_EFI_DEVICE_PATH_LENGTH(dp) ((dp)->length) ++#define GRUB_EFI_DEVICE_PATH_VALID(dp) ((dp) != NULL && GRUB_EFI_DEVICE_PATH_LENGTH (dp) >= 4) + + /* The End of Device Path nodes. */ + #define GRUB_EFI_END_DEVICE_PATH_TYPE (0xff & 0x7f) +@@ -674,13 +675,16 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t; + #define GRUB_EFI_END_THIS_DEVICE_PATH_SUBTYPE 0x01 + + #define GRUB_EFI_END_ENTIRE_DEVICE_PATH(dp) \ +- (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \ +- && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \ +- == GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE)) ++ (!GRUB_EFI_DEVICE_PATH_VALID (dp) || \ ++ (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \ ++ && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \ ++ == GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE))) + + #define GRUB_EFI_NEXT_DEVICE_PATH(dp) \ +- ((grub_efi_device_path_t *) ((char *) (dp) \ +- + GRUB_EFI_DEVICE_PATH_LENGTH (dp))) ++ (GRUB_EFI_DEVICE_PATH_VALID (dp) \ ++ ? ((grub_efi_device_path_t *) \ ++ ((char *) (dp) + GRUB_EFI_DEVICE_PATH_LENGTH (dp))) \ ++ : NULL) + + /* Hardware Device Path. */ + #define GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE 1 +-- +2.26.2 + diff --git a/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch b/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch new file mode 100644 index 00000000..6902f82b --- /dev/null +++ b/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch @@ -0,0 +1,88 @@ +From bb89851e5cdcc38421550dd437cbddb60595456c Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Wed, 22 Jul 2020 17:06:04 +0100 +Subject: [PATCH 229/237] Fix a regression caused by "efi: fix some malformed + device path arithmetic errors" + +This commit introduced a bogus check inside copy_file_path to +determine whether the destination grub_efi_file_path_device_path_t +was valid before anything was copied to it. Depending on the +contents of the heap buffer, this check could fail which would +result in copy_file_path returning early. + +Without any error propagated to the caller, make_file_path would +then try to advance the invalid device path node with +GRUB_EFI_NEXT_DEVICE_PATH, which would also fail, returning a NULL +pointer that would subsequently be dereferenced. + +Remove the bogus check, and also propagate errors from copy_file_path. +--- + grub-core/loader/efi/chainloader.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index c2411b6dab2..8b99cf23e9d 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -115,7 +115,7 @@ grub_chainloader_boot (void) + return grub_errno; + } + +-static void ++static grub_err_t + copy_file_path (grub_efi_file_path_device_path_t *fp, + const char *str, grub_efi_uint16_t len) + { +@@ -125,15 +125,9 @@ copy_file_path (grub_efi_file_path_device_path_t *fp, + fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE; + fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE; + +- if (!GRUB_EFI_DEVICE_PATH_VALID ((grub_efi_device_path_t *)fp)) +- { +- grub_error (GRUB_ERR_BAD_ARGUMENT, "EFI Device Path is invalid"); +- return; +- } +- + path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name)); + if (!path_name) +- return; ++ return grub_error (GRUB_ERR_OUT_OF_MEMORY, "failed to allocate path buffer"); + + size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8, + (const grub_uint8_t *) str, len, 0); +@@ -145,6 +139,8 @@ copy_file_path (grub_efi_file_path_device_path_t *fp, + /* File Path is NULL terminated */ + fp->path_name[size++] = '\0'; + fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp); ++ grub_free (path_name); ++ return GRUB_ERR_NONE; + } + + static grub_efi_device_path_t * +@@ -202,13 +198,19 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename) + /* Fill the file path for the directory. */ + d = (grub_efi_device_path_t *) ((char *) file_path + + ((char *) d - (char *) dp)); +- copy_file_path ((grub_efi_file_path_device_path_t *) d, +- dir_start, dir_end - dir_start); ++ if (copy_file_path ((grub_efi_file_path_device_path_t *) d, ++ dir_start, dir_end - dir_start) != GRUB_ERR_NONE) ++ { ++ fail: ++ grub_free (file_path); ++ return 0; ++ } + + /* Fill the file path for the file. */ + d = GRUB_EFI_NEXT_DEVICE_PATH (d); +- copy_file_path ((grub_efi_file_path_device_path_t *) d, +- dir_end + 1, grub_strlen (dir_end + 1)); ++ if (copy_file_path ((grub_efi_file_path_device_path_t *) d, ++ dir_end + 1, grub_strlen (dir_end + 1)) != GRUB_ERR_NONE) ++ goto fail; + + /* Fill the end of device path nodes. */ + d = GRUB_EFI_NEXT_DEVICE_PATH (d); +-- +2.26.2 + diff --git a/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch b/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch new file mode 100644 index 00000000..e5ff1fc3 --- /dev/null +++ b/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch @@ -0,0 +1,165 @@ +From 092b0c6b0ba0cc1cfb91fe2901795ae295b77b5d Mon Sep 17 00:00:00 2001 +From: Alexey Makhalov +Date: Mon, 20 Jul 2020 23:03:05 +0000 +Subject: [PATCH 230/237] efi: Fix use-after-free in halt/reboot path + +commit 92bfc33db984 ("efi: Free malloc regions on exit") +introduced memory freeing in grub_efi_fini(), which is +used not only by exit path but by halt/reboot one as well. +As result of memory freeing, code and data regions used by +modules, such as halt, reboot, acpi (used by halt) also got +freed. After return to module code, CPU executes, filled +by UEFI firmware (tested with edk2), 0xAFAFAFAF pattern as +a code. Which leads to #UD exception later. + +grub> halt +!!!! X64 Exception Type - 06(#UD - Invalid Opcode) CPU Apic ID - 00000000 !!!! +RIP - 0000000003F4EC28, CS - 0000000000000038, RFLAGS - 0000000000200246 +RAX - 0000000000000000, RCX - 00000000061DA188, RDX - 0A74C0854DC35D41 +RBX - 0000000003E10E08, RSP - 0000000007F0F860, RBP - 0000000000000000 +RSI - 00000000064DB768, RDI - 000000000832C5C3 +R8 - 0000000000000002, R9 - 0000000000000000, R10 - 00000000061E2E52 +R11 - 0000000000000020, R12 - 0000000003EE5C1F, R13 - 00000000061E0FF4 +R14 - 0000000003E10D80, R15 - 00000000061E2F60 +DS - 0000000000000030, ES - 0000000000000030, FS - 0000000000000030 +GS - 0000000000000030, SS - 0000000000000030 +CR0 - 0000000080010033, CR2 - 0000000000000000, CR3 - 0000000007C01000 +CR4 - 0000000000000668, CR8 - 0000000000000000 +DR0 - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000 +DR3 - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400 +GDTR - 00000000079EEA98 0000000000000047, LDTR - 0000000000000000 +IDTR - 0000000007598018 0000000000000FFF, TR - 0000000000000000 +FXSAVE_STATE - 0000000007F0F4C0 + +Proposal here is to continue to free allocated memory for +exit boot services path but keep it for halt/reboot path +as it won't be much security concern here. +Introduced GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY +loader flag to be used by efi halt/reboot path. + +Signed-off-by: Alexey Makhalov +Reviewed-by: Darren Kenny +--- + grub-core/kern/arm/efi/init.c | 3 +++ + grub-core/kern/arm64/efi/init.c | 3 +++ + grub-core/kern/efi/efi.c | 3 ++- + grub-core/kern/efi/init.c | 1 - + grub-core/kern/i386/efi/init.c | 9 +++++++-- + grub-core/kern/ia64/efi/init.c | 9 +++++++-- + grub-core/lib/efi/halt.c | 3 ++- + include/grub/loader.h | 1 + + 8 files changed, 25 insertions(+), 7 deletions(-) + +diff --git a/grub-core/kern/arm/efi/init.c b/grub-core/kern/arm/efi/init.c +index 06df60e2f0e..40c3b467fc6 100644 +--- a/grub-core/kern/arm/efi/init.c ++++ b/grub-core/kern/arm/efi/init.c +@@ -71,4 +71,7 @@ grub_machine_fini (int flags) + efi_call_1 (b->close_event, tmr_evt); + + grub_efi_fini (); ++ ++ if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY)) ++ grub_efi_memory_fini (); + } +diff --git a/grub-core/kern/arm64/efi/init.c b/grub-core/kern/arm64/efi/init.c +index 6224999ec9c..5010caefd66 100644 +--- a/grub-core/kern/arm64/efi/init.c ++++ b/grub-core/kern/arm64/efi/init.c +@@ -57,4 +57,7 @@ grub_machine_fini (int flags) + return; + + grub_efi_fini (); ++ ++ if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY)) ++ grub_efi_memory_fini (); + } +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 969d13dd3f8..1a52bdacac5 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -157,7 +157,8 @@ grub_efi_get_loaded_image (grub_efi_handle_t image_handle) + void + grub_reboot (void) + { +- grub_machine_fini (GRUB_LOADER_FLAG_NORETURN); ++ grub_machine_fini (GRUB_LOADER_FLAG_NORETURN | ++ GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY); + efi_call_4 (grub_efi_system_table->runtime_services->reset_system, + GRUB_EFI_RESET_COLD, GRUB_EFI_SUCCESS, 0, NULL); + for (;;) ; +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index d1afa3af11e..2ffb5205dda 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -131,5 +131,4 @@ grub_efi_fini (void) + { + grub_efidisk_fini (); + grub_console_fini (); +- grub_efi_memory_fini (); + } +diff --git a/grub-core/kern/i386/efi/init.c b/grub-core/kern/i386/efi/init.c +index a28316cc640..46476e27eae 100644 +--- a/grub-core/kern/i386/efi/init.c ++++ b/grub-core/kern/i386/efi/init.c +@@ -38,6 +38,11 @@ grub_machine_init (void) + void + grub_machine_fini (int flags) + { +- if (flags & GRUB_LOADER_FLAG_NORETURN) +- grub_efi_fini (); ++ if (!(flags & GRUB_LOADER_FLAG_NORETURN)) ++ return; ++ ++ grub_efi_fini (); ++ ++ if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY)) ++ grub_efi_memory_fini (); + } +diff --git a/grub-core/kern/ia64/efi/init.c b/grub-core/kern/ia64/efi/init.c +index b5ecbd09121..f1965571b1d 100644 +--- a/grub-core/kern/ia64/efi/init.c ++++ b/grub-core/kern/ia64/efi/init.c +@@ -70,6 +70,11 @@ grub_machine_init (void) + void + grub_machine_fini (int flags) + { +- if (flags & GRUB_LOADER_FLAG_NORETURN) +- grub_efi_fini (); ++ if (!(flags & GRUB_LOADER_FLAG_NORETURN)) ++ return; ++ ++ grub_efi_fini (); ++ ++ if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY)) ++ grub_efi_memory_fini (); + } +diff --git a/grub-core/lib/efi/halt.c b/grub-core/lib/efi/halt.c +index e9441c844ac..a69a77681e3 100644 +--- a/grub-core/lib/efi/halt.c ++++ b/grub-core/lib/efi/halt.c +@@ -28,7 +28,8 @@ + void + grub_halt (void) + { +- grub_machine_fini (GRUB_LOADER_FLAG_NORETURN); ++ grub_machine_fini (GRUB_LOADER_FLAG_NORETURN | ++ GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY); + #if !defined(__ia64__) && !defined(__arm__) && !defined(__aarch64__) + grub_acpi_halt (); + #endif +diff --git a/include/grub/loader.h b/include/grub/loader.h +index 7f82a499fd9..b208642821b 100644 +--- a/include/grub/loader.h ++++ b/include/grub/loader.h +@@ -33,6 +33,7 @@ enum + { + GRUB_LOADER_FLAG_NORETURN = 1, + GRUB_LOADER_FLAG_PXE_NOT_UNLOAD = 2, ++ GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY = 4, + }; + + void EXPORT_FUNC (grub_loader_set) (grub_err_t (*boot) (void), +-- +2.26.2 + diff --git a/0231-efi-dhcp-fix-some-allocation-error-checking.patch b/0231-efi-dhcp-fix-some-allocation-error-checking.patch new file mode 100644 index 00000000..751f21e0 --- /dev/null +++ b/0231-efi-dhcp-fix-some-allocation-error-checking.patch @@ -0,0 +1,40 @@ +From e8d3b5faccac28f0b204fcc227a00cc83662f23b Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 17:11:06 -0400 +Subject: [PATCH 231/237] efi+dhcp: fix some allocation error checking. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/dhcp.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/grub-core/net/efi/dhcp.c b/grub-core/net/efi/dhcp.c +index dbef63d8c08..e5c79b748b0 100644 +--- a/grub-core/net/efi/dhcp.c ++++ b/grub-core/net/efi/dhcp.c +@@ -80,7 +80,7 @@ grub_efi_dhcp4_parse_dns (grub_efi_dhcp4_protocol_t *dhcp4, grub_efi_dhcp4_packe + if (status != GRUB_EFI_BUFFER_TOO_SMALL) + return NULL; + +- option_list = grub_malloc (option_count * sizeof(*option_list)); ++ option_list = grub_calloc (option_count, sizeof(*option_list)); + if (!option_list) + return NULL; + +@@ -360,8 +360,11 @@ grub_cmd_efi_bootp6 (struct grub_command *cmd __attribute__ ((unused)), + + if (status == GRUB_EFI_BUFFER_TOO_SMALL && count) + { +- options = grub_malloc (count * sizeof(*options)); +- status = efi_call_4 (dev->dhcp6->parse, dev->dhcp6, mode.ia->reply_packet, &count, options); ++ options = grub_calloc (count, sizeof(*options)); ++ if (options) ++ status = efi_call_4 (dev->dhcp6->parse, dev->dhcp6, mode.ia->reply_packet, &count, options); ++ else ++ status = GRUB_EFI_OUT_OF_RESOURCES; + } + + if (status != GRUB_EFI_SUCCESS) +-- +2.26.2 + diff --git a/0232-efi-http-fix-some-allocation-error-checking.patch b/0232-efi-http-fix-some-allocation-error-checking.patch new file mode 100644 index 00000000..192da3bf --- /dev/null +++ b/0232-efi-http-fix-some-allocation-error-checking.patch @@ -0,0 +1,42 @@ +From ffa36b5e2200a39a801fb0f660a40bcc687e0e48 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 17:14:15 -0400 +Subject: [PATCH 232/237] efi+http: fix some allocation error checking. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/http.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/grub-core/net/efi/http.c b/grub-core/net/efi/http.c +index de351b2cd03..c56231105e4 100644 +--- a/grub-core/net/efi/http.c ++++ b/grub-core/net/efi/http.c +@@ -392,8 +392,8 @@ grub_efihttp_open (struct grub_efi_net_device *dev, + int type) + { + grub_err_t err; +- grub_off_t size; +- char *buf; ++ grub_off_t size = 0; ++ char *buf = NULL; + char *file_name = NULL; + const char *http_path; + +@@ -421,8 +421,11 @@ grub_efihttp_open (struct grub_efi_net_device *dev, + return err; + } + +- buf = grub_malloc (size); +- efihttp_read (dev, buf, size); ++ if (size) ++ { ++ buf = grub_malloc (size); ++ efihttp_read (dev, buf, size); ++ } + + file->size = size; + file->data = buf; +-- +2.26.2 + diff --git a/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch b/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch new file mode 100644 index 00000000..79834835 --- /dev/null +++ b/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch @@ -0,0 +1,131 @@ +From c142a1f74c2c0893889b2333a0f8d03dbcea6ca5 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Sun, 19 Jul 2020 17:27:00 -0400 +Subject: [PATCH 233/237] efi/ip[46]_config.c: fix some potential allocation + overflows + +In theory all of this data comes from the firmware stack and it should +be safe, but it's better to be paranoid. + +Signed-off-by: Peter Jones +--- + grub-core/net/efi/ip4_config.c | 25 ++++++++++++++++++------- + grub-core/net/efi/ip6_config.c | 13 ++++++++++--- + 2 files changed, 28 insertions(+), 10 deletions(-) + +diff --git a/grub-core/net/efi/ip4_config.c b/grub-core/net/efi/ip4_config.c +index 38e2a04747a..000bb47ace8 100644 +--- a/grub-core/net/efi/ip4_config.c ++++ b/grub-core/net/efi/ip4_config.c +@@ -4,15 +4,20 @@ + #include + #include + #include ++#include + + char * + grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_address_t hw_address) + { + char *hw_addr, *p; +- int sz, s; +- int i; ++ grub_size_t sz, s, i; + +- sz = (int)hw_address_size * (sizeof ("XX:") - 1) + 1; ++ if (grub_mul (hw_address_size, sizeof ("XX:") - 1, &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + + hw_addr = grub_malloc (sz); + if (!hw_addr) +@@ -20,7 +25,7 @@ grub_efi_hw_address_to_string (grub_efi_uint32_t hw_address_size, grub_efi_mac_a + + p = hw_addr; + s = sz; +- for (i = 0; i < (int)hw_address_size; i++) ++ for (i = 0; i < hw_address_size; i++) + { + grub_snprintf (p, sz, "%02x:", hw_address[i]); + p += sizeof ("XX:") - 1; +@@ -227,14 +232,20 @@ grub_efi_ip4_interface_route_table (struct grub_efi_net_device *dev) + { + grub_efi_ip4_config2_interface_info_t *interface_info; + char **ret; +- int i, id; ++ int id; ++ grub_size_t i, nmemb; + + interface_info = efi_ip4_config_interface_info (dev->ip4_config); + if (!interface_info) + return NULL; + +- ret = grub_malloc (sizeof (*ret) * (interface_info->route_table_size + 1)); ++ if (grub_add (interface_info->route_table_size, 1, &nmemb)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + ++ ret = grub_calloc (nmemb, sizeof (*ret)); + if (!ret) + { + grub_free (interface_info); +@@ -242,7 +253,7 @@ grub_efi_ip4_interface_route_table (struct grub_efi_net_device *dev) + } + + id = 0; +- for (i = 0; i < (int)interface_info->route_table_size; i++) ++ for (i = 0; i < interface_info->route_table_size; i++) + { + char *subnet, *gateway, *mask; + grub_uint32_t u32_subnet, u32_gateway; +diff --git a/grub-core/net/efi/ip6_config.c b/grub-core/net/efi/ip6_config.c +index e0e00c23d21..1c5415d7185 100644 +--- a/grub-core/net/efi/ip6_config.c ++++ b/grub-core/net/efi/ip6_config.c +@@ -3,6 +3,7 @@ + #include + #include + #include ++#include + + char * + grub_efi_ip6_address_to_string (grub_efi_pxe_ipv6_address_t *address) +@@ -228,14 +229,20 @@ grub_efi_ip6_interface_route_table (struct grub_efi_net_device *dev) + { + grub_efi_ip6_config_interface_info_t *interface_info; + char **ret; +- int i, id; ++ int id; ++ grub_size_t i, nmemb; + + interface_info = efi_ip6_config_interface_info (dev->ip6_config); + if (!interface_info) + return NULL; + +- ret = grub_malloc (sizeof (*ret) * (interface_info->route_count + 1)); ++ if (grub_add (interface_info->route_count, 1, &nmemb)) ++ { ++ grub_errno = GRUB_ERR_OUT_OF_RANGE; ++ return NULL; ++ } + ++ ret = grub_calloc (nmemb, sizeof (*ret)); + if (!ret) + { + grub_free (interface_info); +@@ -243,7 +250,7 @@ grub_efi_ip6_interface_route_table (struct grub_efi_net_device *dev) + } + + id = 0; +- for (i = 0; i < (int)interface_info->route_count ; i++) ++ for (i = 0; i < interface_info->route_count ; i++) + { + char *gateway, *destination; + grub_uint64_t u64_gateway[2]; +-- +2.26.2 + diff --git a/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch b/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch new file mode 100644 index 00000000..5f34f97e --- /dev/null +++ b/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch @@ -0,0 +1,51 @@ +From 396e9868fb2c0ee18780d61ecdafec58f179b9c1 Mon Sep 17 00:00:00 2001 +From: Colin Watson +Date: Fri, 24 Jul 2020 17:18:09 +0100 +Subject: [PATCH 234/237] efilinux: Fix integer overflows in grub_cmd_initrd + +These could be triggered by an extremely large number of arguments to +the initrd command on 32-bit architectures, or a crafted filesystem with +very large files on any architecture. + +Signed-off-by: Colin Watson +--- + grub-core/loader/i386/efi/linux.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 65d1b5cc034..2bd6663625d 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -207,7 +208,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + goto fail; + } + +- files = grub_zalloc (argc * sizeof (files[0])); ++ files = grub_calloc (argc, sizeof (files[0])); + if (!files) + goto fail; + +@@ -218,7 +219,11 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)), + if (! files[i]) + goto fail; + nfiles++; +- size += ALIGN_UP (grub_file_size (files[i]), 4); ++ if (grub_add (size, ALIGN_UP (grub_file_size (files[i]), 4), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ goto fail; ++ } + } + + initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); +-- +2.26.2 + diff --git a/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch b/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch new file mode 100644 index 00000000..3267dab3 --- /dev/null +++ b/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch @@ -0,0 +1,29 @@ +From 764fd0b43b98476d1d37b4a6e406afb3f48e5472 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 24 Jul 2020 13:57:27 -0400 +Subject: [PATCH 235/237] linux loader: avoid overflow on initrd size + calculation + +Signed-off-by: Peter Jones +--- + grub-core/loader/linux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c +index c2c7cfcd0fd..61a2e144db0 100644 +--- a/grub-core/loader/linux.c ++++ b/grub-core/loader/linux.c +@@ -152,8 +152,8 @@ grub_initrd_init (int argc, char *argv[], + initrd_ctx->nfiles = 0; + initrd_ctx->components = 0; + +- initrd_ctx->components = grub_zalloc (argc +- * sizeof (initrd_ctx->components[0])); ++ initrd_ctx->components = grub_calloc (argc, ++ sizeof (initrd_ctx->components[0])); + if (!initrd_ctx->components) + return grub_errno; + +-- +2.26.2 + diff --git a/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch b/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch new file mode 100644 index 00000000..3cbb531e --- /dev/null +++ b/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch @@ -0,0 +1,101 @@ +From bb240087ce9ef9a62936fd6c1241df65a1e42d01 Mon Sep 17 00:00:00 2001 +From: Dimitri John Ledkov +Date: Wed, 22 Jul 2020 11:31:43 +0100 +Subject: [PATCH 236/237] linuxefi: fail kernel validation without shim + protocol. + +If certificates that signed grub are installed into db, grub can be +booted directly. It will then boot any kernel without signature +validation. The booted kernel will think it was booted in secureboot +mode and will implement lockdown, yet it could have been tampered. + +This version of the patch skips calling verification, when booted +without secureboot. And is indented with gnu ident. + +CVE-2020-15705 + +Reported-by: Mathieu Trudel-Lapierre +Signed-off-by: Dimitri John Ledkov +--- + grub-core/loader/arm64/linux.c | 12 ++++++++---- + grub-core/loader/efi/chainloader.c | 1 + + grub-core/loader/efi/linux.c | 1 + + grub-core/loader/i386/efi/linux.c | 13 ++++++++----- + 4 files changed, 18 insertions(+), 9 deletions(-) + +diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c +index 628b320618c..e8ce560a2d2 100644 +--- a/grub-core/loader/arm64/linux.c ++++ b/grub-core/loader/arm64/linux.c +@@ -381,11 +381,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + + grub_dprintf ("linux", "kernel @ %p\n", kernel_addr); + +- rc = grub_linuxefi_secure_validate (kernel_addr, kernel_size); +- if (rc < 0) ++ if (grub_efi_secure_boot ()) + { +- grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), argv[0]); +- goto fail; ++ rc = grub_linuxefi_secure_validate (kernel_addr, kernel_size); ++ if (rc <= 0) ++ { ++ grub_error (GRUB_ERR_INVALID_COMMAND, ++ N_("%s has invalid signature"), argv[0]); ++ goto fail; ++ } + } + + pe = (void *)((unsigned long)kernel_addr + lh.hdr_offset); +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 8b99cf23e9d..a93edc975cd 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1079,6 +1079,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + + return 0; + } ++ // -1 fall-through to fail + + fail: + if (dev) +diff --git a/grub-core/loader/efi/linux.c b/grub-core/loader/efi/linux.c +index b56ea0bc041..5f326eb4f53 100644 +--- a/grub-core/loader/efi/linux.c ++++ b/grub-core/loader/efi/linux.c +@@ -33,6 +33,7 @@ struct grub_efi_shim_lock + }; + typedef struct grub_efi_shim_lock grub_efi_shim_lock_t; + ++// Returns 1 on success, -1 on error, 0 when not available + int + grub_linuxefi_secure_validate (void *data, grub_uint32_t size) + { +diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c +index 2bd6663625d..cc6a503adb1 100644 +--- a/grub-core/loader/i386/efi/linux.c ++++ b/grub-core/loader/i386/efi/linux.c +@@ -313,12 +313,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel"); + grub_print_error(); + +- rc = grub_linuxefi_secure_validate (kernel, filelen); +- if (rc < 0) ++ if (grub_efi_secure_boot ()) + { +- grub_error (GRUB_ERR_INVALID_COMMAND, N_("%s has invalid signature"), +- argv[0]); +- goto fail; ++ rc = grub_linuxefi_secure_validate (kernel, filelen); ++ if (rc <= 0) ++ { ++ grub_error (GRUB_ERR_INVALID_COMMAND, ++ N_("%s has invalid signature"), argv[0]); ++ goto fail; ++ } + } + + lh = (struct linux_i386_kernel_header *)kernel; +-- +2.26.2 + diff --git a/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch b/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch new file mode 100644 index 00000000..19bd8192 --- /dev/null +++ b/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch @@ -0,0 +1,169 @@ +From 4cbc5ec735e914b1f084d92a94be614ac5f9d3be Mon Sep 17 00:00:00 2001 +From: Colin Watson +Date: Sat, 25 Jul 2020 12:15:37 +0100 +Subject: [PATCH 237/237] linux: Fix integer overflows in initrd size handling + +These could be triggered by a crafted filesystem with very large files. + +Fixes: CVE-2020-15707 + +Signed-off-by: Colin Watson +Reviewed-by: Jan Setje-Eilers +--- + grub-core/loader/linux.c | 75 +++++++++++++++++++++++++++++----------- + 1 file changed, 54 insertions(+), 21 deletions(-) + +diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c +index 61a2e144db0..49d2948644e 100644 +--- a/grub-core/loader/linux.c ++++ b/grub-core/loader/linux.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + struct newc_head + { +@@ -99,13 +100,13 @@ free_dir (struct dir *root) + grub_free (root); + } + +-static grub_size_t ++static grub_err_t + insert_dir (const char *name, struct dir **root, +- grub_uint8_t *ptr) ++ grub_uint8_t *ptr, grub_size_t *size) + { + struct dir *cur, **head = root; + const char *cb, *ce = name; +- grub_size_t size = 0; ++ *size = 0; + while (1) + { + for (cb = ce; *cb == '/'; cb++); +@@ -131,14 +132,22 @@ insert_dir (const char *name, struct dir **root, + ptr = make_header (ptr, name, ce - name, + 040777, 0); + } +- size += ALIGN_UP ((ce - (char *) name) +- + sizeof (struct newc_head), 4); ++ if (grub_add (*size, ++ ALIGN_UP ((ce - (char *) name) ++ + sizeof (struct newc_head), 4), ++ size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ grub_free (n->name); ++ grub_free (n); ++ return grub_errno; ++ } + *head = n; + cur = n; + } + root = &cur->next; + } +- return size; ++ return GRUB_ERR_NONE; + } + + grub_err_t +@@ -174,27 +183,33 @@ grub_initrd_init (int argc, char *argv[], + eptr = grub_strchr (ptr, ':'); + if (eptr) + { +- grub_file_filter_disable_compression (); ++ grub_size_t dir_size, name_len; ++ + initrd_ctx->components[i].newc_name = grub_strndup (ptr, eptr - ptr); +- if (!initrd_ctx->components[i].newc_name) ++ if (!initrd_ctx->components[i].newc_name || ++ insert_dir (initrd_ctx->components[i].newc_name, &root, 0, ++ &dir_size)) + { + grub_initrd_close (initrd_ctx); + return grub_errno; + } +- initrd_ctx->size +- += ALIGN_UP (sizeof (struct newc_head) +- + grub_strlen (initrd_ctx->components[i].newc_name), +- 4); +- initrd_ctx->size += insert_dir (initrd_ctx->components[i].newc_name, +- &root, 0); ++ name_len = grub_strlen (initrd_ctx->components[i].newc_name); ++ if (grub_add (initrd_ctx->size, ++ ALIGN_UP (sizeof (struct newc_head) + name_len, 4), ++ &initrd_ctx->size) || ++ grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size)) ++ goto overflow; + newc = 1; + fname = eptr + 1; + } + } + else if (newc) + { +- initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head) +- + sizeof ("TRAILER!!!") - 1, 4); ++ if (grub_add (initrd_ctx->size, ++ ALIGN_UP (sizeof (struct newc_head) ++ + sizeof ("TRAILER!!!") - 1, 4), ++ &initrd_ctx->size)) ++ goto overflow; + free_dir (root); + root = 0; + newc = 0; +@@ -209,19 +224,29 @@ grub_initrd_init (int argc, char *argv[], + initrd_ctx->nfiles++; + initrd_ctx->components[i].size + = grub_file_size (initrd_ctx->components[i].file); +- initrd_ctx->size += initrd_ctx->components[i].size; ++ if (grub_add (initrd_ctx->size, initrd_ctx->components[i].size, ++ &initrd_ctx->size)) ++ goto overflow; + } + + if (newc) + { + initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); +- initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head) +- + sizeof ("TRAILER!!!") - 1, 4); ++ if (grub_add (initrd_ctx->size, ++ ALIGN_UP (sizeof (struct newc_head) ++ + sizeof ("TRAILER!!!") - 1, 4), ++ &initrd_ctx->size)) ++ goto overflow; + free_dir (root); + root = 0; + } + + return GRUB_ERR_NONE; ++ ++overflow: ++ free_dir (root); ++ grub_initrd_close (initrd_ctx); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); + } + + grub_size_t +@@ -262,8 +287,16 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, + + if (initrd_ctx->components[i].newc_name) + { +- ptr += insert_dir (initrd_ctx->components[i].newc_name, +- &root, ptr); ++ grub_size_t dir_size; ++ ++ if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr, ++ &dir_size)) ++ { ++ free_dir (root); ++ grub_initrd_close (initrd_ctx); ++ return grub_errno; ++ } ++ ptr += dir_size; + ptr = make_header (ptr, initrd_ctx->components[i].newc_name, + grub_strlen (initrd_ctx->components[i].newc_name), + 0100777, +-- +2.26.2 + diff --git a/grub.patches b/grub.patches index 02c0a522..80251dce 100644 --- a/grub.patches +++ b/grub.patches @@ -201,3 +201,37 @@ Patch0200: 0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch Patch0201: 0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch Patch0202: 0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch Patch0203: 0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch +Patch0204: 0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch +Patch0205: 0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch +Patch0206: 0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch +Patch0207: 0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch +Patch0208: 0208-calloc-Use-calloc-at-most-places.patch +Patch0209: 0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch +Patch0210: 0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch +Patch0211: 0211-font-Do-not-load-more-than-one-NAME-section.patch +Patch0212: 0212-gfxmenu-Fix-double-free-in-load_image.patch +Patch0213: 0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch +Patch0214: 0214-lzma-Make-sure-we-don-t-dereference-past-array.patch +Patch0215: 0215-term-Fix-overflow-on-user-inputs.patch +Patch0216: 0216-udf-Fix-memory-leak.patch +Patch0217: 0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch +Patch0218: 0218-tftp-Do-not-use-priority-queue.patch +Patch0219: 0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch +Patch0220: 0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch +Patch0221: 0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch +Patch0222: 0222-script-Remove-unused-fields-from-grub_script_functio.patch +Patch0223: 0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch +Patch0224: 0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch +Patch0225: 0225-hfsplus-fix-two-more-overflows.patch +Patch0226: 0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch +Patch0227: 0227-emu-make-grub_free-NULL-safe.patch +Patch0228: 0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch +Patch0229: 0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch +Patch0230: 0230-efi-Fix-use-after-free-in-halt-reboot-path.patch +Patch0231: 0231-efi-dhcp-fix-some-allocation-error-checking.patch +Patch0232: 0232-efi-http-fix-some-allocation-error-checking.patch +Patch0233: 0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch +Patch0234: 0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch +Patch0235: 0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch +Patch0236: 0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch +Patch0237: 0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch diff --git a/grub2.spec b/grub2.spec index 3ce46c71..05f39949 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 109%{?dist} +Release: 110%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -518,6 +518,17 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Wed Jul 29 2020 Peter Jones - 2.02-110 +- "Minor" bug fixes + CVE-2020-10713 + CVE-2020-14308 + CVE-2020-14309 + CVE-2020-14310 + CVE-2020-14311 + CVE-2020-15705 + CVE-2020-15706 + CVE-2020-15707 + * Tue May 12 2020 Javier Martinez Canillas - 2.02-109 - Fix grub2-editenv segfault when attempting to shrink a variable From 124a37598612ada4fc94981e6455687b1efd8ded Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 10 Aug 2020 16:01:43 -0400 Subject: [PATCH 15/16] Rebase to version with CVE fixes --- ...t-break-FDT-extra-allocation-space-o.patch | 9 +- ...s-option-to-menu-entries-generated-f.patch | 9 +- ...ix-typo-for-gfxpayload-variable-name.patch | 7 +- ...g-Update-comment-about-running-as-ro.patch | 9 +- ...g-Write-new-env-to-tmpfile-and-then-.patch | 10 +-- ...indeterminate-getting-set-on-boot_su.patch | 9 +- ...-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch | 9 +- 0194-Fix-savedefault-with-blscfg.patch | 7 +- ...ce-char-when-appending-fields-for-va.patch | 9 +- ...rt-for-sorting-the-plus-higher-than-.patch | 9 +- ...e-the-root-variable-to-search-for-BL.patch | 9 +- ...LL-instead-of-a-zero-length-array-in.patch | 7 +- ...lscfg-Update-grub2-binary-in-ESP-for.patch | 9 +- ...lscfg-Only-mark-GRUB-as-BLS-supporte.patch | 9 +- ...lscfg-Use-install-to-copy-GRUB-binar.patch | 9 +- ...le-BLS-configuration-if-new-kernel-p.patch | 9 +- ...r-overrun-when-attempting-to-shrink-.patch | 9 +- ...etree-command-when-Secure-Boot-is-en.patch | 8 +- ...lexer-fatal-errors-actually-be-fatal.patch | 7 +- ...e-arithmetic-primitives-that-check-f.patch | 9 +- ...-we-always-have-an-overflow-checking.patch | 19 ++-- 0208-calloc-Use-calloc-at-most-places.patch | 89 +++++++++---------- ...low-checking-primitives-where-we-do-.patch | 55 ++++++------ ...on-t-leak-memory-on-realloc-failures.patch | 7 +- ...-not-load-more-than-one-NAME-section.patch | 7 +- ...fxmenu-Fix-double-free-in-load_image.patch | 7 +- ...ree-in-grub_xnu_devprop_add_property.patch | 8 +- ...sure-we-don-t-dereference-past-array.patch | 7 +- 0215-term-Fix-overflow-on-user-inputs.patch | 7 +- 0216-udf-Fix-memory-leak.patch | 7 +- ...emory-leak-if-grub_create_loader_cmd.patch | 9 +- 0218-tftp-Do-not-use-priority-queue.patch | 9 +- ...in-address-for-mbi-allocation-to-0x1.patch | 8 +- ...t-grub_relocator_alloc_chunk_addr-in.patch | 9 +- ...t-grub_relocator_alloc_chunk_align-m.patch | 15 ++-- ...used-fields-from-grub_script_functio.patch | 8 +- ...se-after-free-when-redefining-a-func.patch | 9 +- ...ub_relocator_alloc_chunk_align-top-m.patch | 9 +- 0225-hfsplus-fix-two-more-overflows.patch | 7 +- ...-potential-data-dependent-alloc-over.patch | 10 +-- 0227-emu-make-grub_free-NULL-safe.patch | 7 +- ...formed-device-path-arithmetic-errors.patch | 16 ++-- ...-caused-by-efi-fix-some-malformed-de.patch | 9 +- ...x-use-after-free-in-halt-reboot-path.patch | 7 +- ...p-fix-some-allocation-error-checking.patch | 7 +- ...p-fix-some-allocation-error-checking.patch | 7 +- ...g.c-fix-some-potential-allocation-ov.patch | 8 +- ...integer-overflows-in-grub_cmd_initrd.patch | 7 +- ...id-overflow-on-initrd-size-calculati.patch | 8 +- ...rnel-validation-without-shim-protoco.patch | 8 +- ...er-overflows-in-initrd-size-handling.patch | 9 +- 51 files changed, 204 insertions(+), 367 deletions(-) diff --git a/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch b/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch index 8f15f876..164de665 100644 --- a/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch +++ b/0187-linux-efi-arm-fdt-break-FDT-extra-allocation-space-o.patch @@ -1,8 +1,8 @@ -From 8ae9db92efe2ad02218a27d0a84261d26124af60 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Thu, 20 Jun 2019 16:21:48 +0100 -Subject: [PATCH 187/237] linux, efi, arm*, fdt: break FDT extra allocation - space out into a #define +Subject: [PATCH] linux, efi, arm*, fdt: break FDT extra allocation space out + into a #define A certain amount of dynamic space is required for the handover from GRUB/Linux-EFI-stub. This entails things like initrd addresses, @@ -46,6 +46,3 @@ index e34644631e1..2041341fd68 100644 #define FDT_MAGIC 0xD00DFEED typedef struct { --- -2.26.2 - diff --git a/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch index a3eb0991..d1366182 100644 --- a/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch +++ b/0188-Don-t-add-a-class-option-to-menu-entries-generated-f.patch @@ -1,8 +1,8 @@ -From 55ab66328a6c0142cf0944494101b704709b2df5 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Fri, 4 Oct 2019 16:43:05 +0200 -Subject: [PATCH 188/237] Don't add a class option to menu entries generated - for ppc64le +Subject: [PATCH] Don't add a class option to menu entries generated for + ppc64le For ppc64le a grub config file with menuentry commands is still generated even when BLS support is enabled. That's because BLS support was added to @@ -76,6 +76,3 @@ index 1b7536435f1..68fbedf2129 100644 menu="${menu}\t linux ${linux} ${options}\n" if [ -n "${initrd}" ] ; then menu="${menu}\t initrd ${boot_prefix}${initrd}\n" --- -2.26.2 - diff --git a/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch index 24144d98..5599fa1e 100644 --- a/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch +++ b/0189-blscfg-Fix-typo-for-gfxpayload-variable-name.patch @@ -1,7 +1,7 @@ -From dce8f564823148a4512e7f15dc97ae5640ed9d5b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 16 Oct 2019 12:16:32 +0200 -Subject: [PATCH 189/237] blscfg: Fix typo for gfxpayload variable name +Subject: [PATCH] blscfg: Fix typo for gfxpayload variable name There was a silly typo when setting the environment variable gfxpayload so graphics mode wouldn't be preserved on some machines leading to text mode. @@ -26,6 +26,3 @@ index 26dbe873fe4..8c6dd91be10 100644 "insmod gzio\n" "linux %s%s%s%s\n" "%s", --- -2.26.2 - diff --git a/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch index fc1cf459..cd4ef775 100644 --- a/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch +++ b/0190-grub-set-bootflag-Update-comment-about-running-as-ro.patch @@ -1,8 +1,8 @@ -From 2cf1cfd4a16b924afdccdb887663fb506f4a1885 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 12:15:43 +0100 -Subject: [PATCH 190/237] grub-set-bootflag: Update comment about running as - root through pkexec +Subject: [PATCH] grub-set-bootflag: Update comment about running as root + through pkexec We have stopped using pkexec for grub-set-bootflag, instead it is now installed suid root, update the comment accordingly. @@ -25,6 +25,3 @@ index 6a79ee67444..65d74ce010f 100644 * use any grub library / util functions to allow for easy auditing. * The grub headers are only included to get certain defines. */ --- -2.26.2 - diff --git a/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch index 82b3155b..122bf686 100644 --- a/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch +++ b/0191-grub-set-bootflag-Write-new-env-to-tmpfile-and-then-.patch @@ -1,8 +1,7 @@ -From 2b3341589cb47f35332332abeed1e5edcab1e4b3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 13 Nov 2019 13:02:01 +0100 -Subject: [PATCH 191/237] grub-set-bootflag: Write new env to tmpfile and then - rename +Subject: [PATCH] grub-set-bootflag: Write new env to tmpfile and then rename Make the grubenv writing code in grub-set-bootflag more robust by writing the modified grubenv to a tmpfile first and then renaming the @@ -10,7 +9,7 @@ tmpfile over the old grubenv (following symlinks). Signed-off-by: Hans de Goede --- - util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++----- + util/grub-set-bootflag.c | 87 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 78 insertions(+), 9 deletions(-) diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c @@ -151,6 +150,3 @@ index 65d74ce010f..d1c5e28862b 100644 return 0; } --- -2.26.2 - diff --git a/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch b/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch index c7d5412b..54b73e6c 100644 --- a/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch +++ b/0192-grub.d-Fix-boot_indeterminate-getting-set-on-boot_su.patch @@ -1,8 +1,8 @@ -From 5235d8a87e7b11193cb76af9381e738199f67655 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH 192/237] grub.d: Fix boot_indeterminate getting set on - boot_success=0 boot +Subject: [PATCH] grub.d: Fix boot_indeterminate getting set on boot_success=0 + boot The "grub.d: Split out boot success reset from menu auto hide script" not only moved the code to clear boot_success and boot_indeterminate @@ -73,6 +73,3 @@ index 6c88d933dde..737e1ae5b68 100644 fi # Reset boot_success for current boot set boot_success=0 --- -2.26.2 - diff --git a/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch index ab1424b6..d6e4756f 100644 --- a/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch +++ b/0193-10_linux.in-Also-use-GRUB_CMDLINE_LINUX_DEFAULT-to-s.patch @@ -1,8 +1,8 @@ -From 217890e8fd2235e92e59f54a68a2c19dcc67cc8e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 15 Oct 2019 09:08:25 +0200 -Subject: [PATCH 193/237] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to - set kernelopts +Subject: [PATCH] 10_linux.in: Also use GRUB_CMDLINE_LINUX_DEFAULT to set + kernelopts The GRUB documentation mentions that there are two variables to set the linux kernel cmdline: GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT. @@ -43,6 +43,3 @@ index 3919b8aff4e..9e015c2c134 100644 if [ -n "${GRUB_EARLY_INITRD_LINUX_CUSTOM}" ]; then ${grub_editenv} - set early_initrd="${GRUB_EARLY_INITRD_LINUX_CUSTOM}" fi --- -2.26.2 - diff --git a/0194-Fix-savedefault-with-blscfg.patch b/0194-Fix-savedefault-with-blscfg.patch index ddf48c24..ec0d52a5 100644 --- a/0194-Fix-savedefault-with-blscfg.patch +++ b/0194-Fix-savedefault-with-blscfg.patch @@ -1,7 +1,7 @@ -From e1a1226abd8f579b411b715639ab8e0abedc0f0a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Fritz Elfert Date: Sun, 12 Jan 2020 22:07:52 +0100 -Subject: [PATCH 194/237] Fix savedefault with blscfg +Subject: [PATCH] Fix savedefault with blscfg The GRUB_SAVEDEFAULT option was ignored on a BLS configuration. Fix it by making the menu entries populated from the BLS files to call savedefault @@ -48,6 +48,3 @@ index 9e015c2c134..d5319300e04 100644 fi exit 0 --- -2.26.2 - diff --git a/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch index 70d1f760..1dc9f6b7 100644 --- a/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch +++ b/0195-blscfg-add-a-space-char-when-appending-fields-for-va.patch @@ -1,8 +1,8 @@ -From 983aeec4df983df6d02f71e9d26f36571382d0b6 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 26 Nov 2019 09:51:41 +0100 -Subject: [PATCH 195/237] blscfg: add a space char when appending fields for - variable expansion +Subject: [PATCH] blscfg: add a space char when appending fields for variable + expansion The GRUB variables are expanded and replaced by their values before adding menu entries, but they didn't include space characters after the values so @@ -74,6 +74,3 @@ index f2c1fd0733d..1504be30e8e 100644 } } --- -2.26.2 - diff --git a/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch index c2c179e9..1d19216e 100644 --- a/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch +++ b/0196-blscfg-Add-support-for-sorting-the-plus-higher-than-.patch @@ -1,8 +1,8 @@ -From 42fedf2e00e13b7900f3e05c45bcdd87b58cc952 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 4 Nov 2019 17:33:30 +0100 -Subject: [PATCH 196/237] blscfg: Add support for sorting the plus ('+') higher - than base version +Subject: [PATCH] blscfg: Add support for sorting the plus ('+') higher than + base version Handle plus separator. Concept is the same as tilde, except that if one of the strings ends (base version), the other is considered as higher version. @@ -57,6 +57,3 @@ index 1504be30e8e..286a5b88d12 100644 /* If we ran to the end of either, we are finished with the loop */ if (!(*one && *two)) break; --- -2.26.2 - diff --git a/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch index 76371bb6..b1481b96 100644 --- a/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch +++ b/0197-blscfg-Always-use-the-root-variable-to-search-for-BL.patch @@ -1,8 +1,8 @@ -From b987476a6bd5462e6258f4e4c6e3c4553a2a5b6a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 14 Jan 2020 17:41:29 +0100 -Subject: [PATCH 197/237] blscfg: Always use the root variable to search for - BLS snippets +Subject: [PATCH] blscfg: Always use the root variable to search for BLS + snippets The boot and root variables are set by grub2-mkconfig to tell GRUB what are the devices and partitions used as the EFI System Partition (ESP) @@ -45,6 +45,3 @@ index 286a5b88d12..aa4e624905e 100644 } grub_dprintf ("blscfg", "opening %s\n", devid); --- -2.26.2 - diff --git a/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch index 43dff51e..46ab032c 100644 --- a/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch +++ b/0198-blscfg-return-NULL-instead-of-a-zero-length-array-in.patch @@ -1,7 +1,7 @@ -From 5668ad4ae37b70975b5f6e3da1b909bd1d51f2d5 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Mon, 16 Mar 2020 13:51:45 +0100 -Subject: [PATCH 198/237] blscfg: return NULL instead of a zero-length array in +Subject: [PATCH] blscfg: return NULL instead of a zero-length array in bls_make_list() The bls_make_list() function returns a list of all the values for a given @@ -36,6 +36,3 @@ index aa4e624905e..df6947f58cd 100644 if (num) *num = nlist; --- -2.26.2 - diff --git a/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch index e0784d87..5993a6ba 100644 --- a/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch +++ b/0199-grub-switch-to-blscfg-Update-grub2-binary-in-ESP-for.patch @@ -1,8 +1,8 @@ -From a0b42e6003987d194b9780ea91cb3c9245547521 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 26 Mar 2020 15:08:30 +0100 -Subject: [PATCH 199/237] grub-switch-to-blscfg: Update grub2 binary in ESP for - OSTree systems +Subject: [PATCH] grub-switch-to-blscfg: Update grub2 binary in ESP for OSTree + systems The grub2 EFI binary in the ESP isn't updated as a part of an OSTree update transaction. So let's make the script to update this and also create a file @@ -35,6 +35,3 @@ index 49b3985fadb..a05a8d98554 100644 GENERATE=0 if grep '^GRUB_ENABLE_BLSCFG=.*' "${etcdefaultgrub}" \ | grep -vq '^GRUB_ENABLE_BLSCFG="*true"*\s*$' ; then --- -2.26.2 - diff --git a/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch index 2edf0ee4..27ef6e0a 100644 --- a/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch +++ b/0200-grub-switch-to-blscfg-Only-mark-GRUB-as-BLS-supporte.patch @@ -1,8 +1,8 @@ -From 5c365350a3b1558114a385dc6c85fe2094247fcc Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 2 Apr 2020 11:07:24 +0200 -Subject: [PATCH 200/237] grub-switch-to-blscfg: Only mark GRUB as BLS - supported if blsdir isn't set +Subject: [PATCH] grub-switch-to-blscfg: Only mark GRUB as BLS supported if + blsdir isn't set If the user set the blsdir environemnt variable to a path that is not the default where ostree writes the BLS snippets, the blscfg module won't be @@ -35,6 +35,3 @@ index a05a8d98554..4bbed8e4fe9 100644 grub_binary="$(find /usr/lib/ostree-boot/efi/EFI/${EFIDIR}/ -name grub*.efi)" cp ${grub_binary} ${grubdir} || exit 1 # Create a hidden file to indicate that grub2 now has BLS support. --- -2.26.2 - diff --git a/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch index e400e965..c131a7f6 100644 --- a/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch +++ b/0201-grub-switch-to-blscfg-Use-install-to-copy-GRUB-binar.patch @@ -1,8 +1,8 @@ -From f654b4baf92c2d95e84ea017831f06404fbcef61 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 16 Apr 2020 18:53:03 +0200 -Subject: [PATCH 201/237] grub-switch-to-blscfg: Use install to copy GRUB - binary, modules and config +Subject: [PATCH] grub-switch-to-blscfg: Use install to copy GRUB binary, + modules and config By default the cp command truncates the destination before copying from the source, so if interrupted it can lead to a file that's half written. @@ -44,6 +44,3 @@ index 4bbed8e4fe9..3333a620c28 100644 sed -i"${backupsuffix}" \ -e 's,^GRUB_ENABLE_BLSCFG=.*,GRUB_ENABLE_BLSCFG=false,' \ "${etcdefaultgrub}" --- -2.26.2 - diff --git a/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch index dabaf52a..985c5ba3 100644 --- a/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch +++ b/0202-10_linux.in-Enable-BLS-configuration-if-new-kernel-p.patch @@ -1,8 +1,8 @@ -From 1beb2d222a7ace793287211ae3265a95bff09ad5 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Thu, 16 Apr 2020 21:11:04 +0200 -Subject: [PATCH 202/237] 10_linux.in: Enable BLS configuration if - new-kernel-pkg isn't present +Subject: [PATCH] 10_linux.in: Enable BLS configuration if new-kernel-pkg isn't + present Currently if the the GRUB_ENABLE_BLSCFG option in /etc/default/grub hasn't been set, the 10_linux script will generate a GRUB configuration that does @@ -37,6 +37,3 @@ index d5319300e04..b99eaa8f203 100644 if [ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]; then if [ x$dirname = x/ ]; then if [ -z "${prepare_root_cache}" ]; then --- -2.26.2 - diff --git a/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch index 73df6c73..09d378f2 100644 --- a/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch +++ b/0203-envblk-Fix-buffer-overrun-when-attempting-to-shrink-.patch @@ -1,8 +1,8 @@ -From fbea00c276c195e27501a33d36f148aa55d6d390 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 12 May 2020 01:00:51 +0200 -Subject: [PATCH 203/237] envblk: Fix buffer overrun when attempting to shrink - a variable value +Subject: [PATCH] envblk: Fix buffer overrun when attempting to shrink a + variable value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -58,6 +58,3 @@ index f89d86d4e8d..874506da169 100644 } else /* Move the following characters forward. */ --- -2.26.2 - diff --git a/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch b/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch index b57c0c62..274d2c16 100644 --- a/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch +++ b/0204-Forbid-the-devicetree-command-when-Secure-Boot-is-en.patch @@ -1,8 +1,7 @@ -From 0d34ea81fbc863b00148834bd0ec92537b9f4e06 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 24 Apr 2019 10:03:04 -0400 -Subject: [PATCH 204/237] Forbid the "devicetree" command when Secure Boot is - enabled. +Subject: [PATCH] Forbid the "devicetree" command when Secure Boot is enabled. Signed-off-by: Peter Jones --- @@ -70,6 +69,3 @@ index cecd617dccc..2c14a11fa6b 100644 dtb = grub_file_open (argv[0]); if (!dtb) goto out; --- -2.26.2 - diff --git a/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch b/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch index 7449b0ad..99b66f0b 100644 --- a/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch +++ b/0205-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch @@ -1,7 +1,7 @@ -From 1d19ae30454eae66bf9e7f3d0bc4028a43d258fd Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 15 Apr 2020 15:45:02 -0400 -Subject: [PATCH 205/237] yylex: Make lexer fatal errors actually be fatal +Subject: [PATCH] yylex: Make lexer fatal errors actually be fatal When presented with a command that can't be tokenized to anything smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg), @@ -65,6 +65,3 @@ index 7b44c37b76f..b7203c82309 100644 } while (0) #define COPY(str, hint) \ --- -2.26.2 - diff --git a/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch b/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch index c69a90c7..84443aed 100644 --- a/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch +++ b/0206-safemath-Add-some-arithmetic-primitives-that-check-f.patch @@ -1,8 +1,8 @@ -From ce53098c1579f0d484f212dafbf3f81f92aca42b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 15 Jun 2020 10:58:42 -0400 -Subject: [PATCH 206/237] safemath: Add some arithmetic primitives that check - for overflow +Subject: [PATCH] safemath: Add some arithmetic primitives that check for + overflow This adds a new header, include/grub/safemath.h, that includes easy to use wrappers for __builtin_{add,sub,mul}_overflow() declared like: @@ -122,6 +122,3 @@ index f3c20edc844..f8bd9116480 100644 * GNU Make * GNU Bison 2.3 or later * GNU gettext 0.17 or later --- -2.26.2 - diff --git a/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch b/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch index 9f667ecf..95a3c62a 100644 --- a/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch +++ b/0207-calloc-Make-sure-we-always-have-an-overflow-checking.patch @@ -1,7 +1,7 @@ -From edacadd3894bf78ba4070a23812de65883207098 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 15 Jun 2020 12:15:29 -0400 -Subject: [PATCH 207/237] calloc: Make sure we always have an overflow-checking +Subject: [PATCH] calloc: Make sure we always have an overflow-checking calloc() available This tries to make sure that everywhere in this source tree, we always have @@ -13,13 +13,13 @@ Signed-off-by: Peter Jones Reviewed-by: Daniel Kiper Upstream-commit-id: 79e51ab7a9a --- - grub-core/kern/emu/misc.c | 12 +++++++++ - grub-core/kern/emu/mm.c | 10 ++++++++ - grub-core/kern/mm.c | 40 ++++++++++++++++++++++++++++++ - grub-core/lib/libgcrypt_wrap/mem.c | 11 ++++++-- - grub-core/lib/posix_wrap/stdlib.h | 8 +++++- + grub-core/kern/emu/misc.c | 12 ++++++++++++ + grub-core/kern/emu/mm.c | 10 ++++++++++ + grub-core/kern/mm.c | 40 ++++++++++++++++++++++++++++++++++++++ + grub-core/lib/libgcrypt_wrap/mem.c | 11 +++++++++-- + grub-core/lib/posix_wrap/stdlib.h | 8 +++++++- include/grub/emu/misc.h | 1 + - include/grub/mm.h | 6 +++++ + include/grub/mm.h | 6 ++++++ 7 files changed, 85 insertions(+), 3 deletions(-) diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c @@ -238,6 +238,3 @@ index 28e2e53eb32..9c38dd3ca5d 100644 void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line, grub_size_t size); void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line, --- -2.26.2 - diff --git a/0208-calloc-Use-calloc-at-most-places.patch b/0208-calloc-Use-calloc-at-most-places.patch index 12ccca08..7477b426 100644 --- a/0208-calloc-Use-calloc-at-most-places.patch +++ b/0208-calloc-Use-calloc-at-most-places.patch @@ -1,7 +1,7 @@ -From cd97ed407e995a8457ffd2e6947972850ca72902 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 15 Jun 2020 12:26:01 -0400 -Subject: [PATCH 208/237] calloc: Use calloc() at most places +Subject: [PATCH] calloc: Use calloc() at most places This modifies most of the places we do some form of: @@ -23,91 +23,91 @@ Signed-off-by: Peter Jones Reviewed-by: Daniel Kiper Upstream-commit-id: 48eeedf1e4b --- - grub-core/bus/usb/usbhub.c | 8 +-- + grub-core/bus/usb/usbhub.c | 8 ++--- grub-core/commands/efi/lsefisystab.c | 3 +- - grub-core/commands/legacycfg.c | 6 +-- + grub-core/commands/legacycfg.c | 6 ++-- grub-core/commands/menuentry.c | 2 +- grub-core/commands/nativedisk.c | 2 +- - grub-core/commands/parttool.c | 12 +++-- + grub-core/commands/parttool.c | 12 +++++-- grub-core/commands/regexp.c | 2 +- grub-core/commands/search_wrap.c | 2 +- - grub-core/disk/diskfilter.c | 4 +- + grub-core/disk/diskfilter.c | 4 +-- grub-core/disk/ieee1275/ofdisk.c | 2 +- - grub-core/disk/ldm.c | 14 +++--- + grub-core/disk/ldm.c | 14 ++++---- grub-core/disk/luks.c | 2 +- - grub-core/disk/lvm.c | 8 +-- + grub-core/disk/lvm.c | 8 ++--- grub-core/disk/xen/xendisk.c | 2 +- grub-core/efiemu/loadcore.c | 2 +- - grub-core/efiemu/mm.c | 6 +-- + grub-core/efiemu/mm.c | 6 ++-- grub-core/font/font.c | 3 +- - grub-core/fs/affs.c | 6 +-- - grub-core/fs/btrfs.c | 4 +- + grub-core/fs/affs.c | 6 ++-- + grub-core/fs/btrfs.c | 4 +-- grub-core/fs/hfs.c | 2 +- - grub-core/fs/hfsplus.c | 59 ++++++++++++++++------- + grub-core/fs/hfsplus.c | 59 +++++++++++++++++++++---------- grub-core/fs/iso9660.c | 2 +- - grub-core/fs/ntfs.c | 4 +- + grub-core/fs/ntfs.c | 4 +-- grub-core/fs/sfs.c | 2 +- grub-core/fs/tar.c | 2 +- - grub-core/fs/udf.c | 4 +- - grub-core/fs/zfs/zfs.c | 4 +- + grub-core/fs/udf.c | 4 +-- + grub-core/fs/zfs/zfs.c | 4 +-- grub-core/gfxmenu/gui_string_util.c | 2 +- - grub-core/gfxmenu/widget-box.c | 4 +- + grub-core/gfxmenu/widget-box.c | 4 +-- grub-core/io/gzio.c | 2 +- - grub-core/kern/efi/efi.c | 33 ++++++++++--- + grub-core/kern/efi/efi.c | 33 +++++++++++++---- grub-core/kern/emu/hostdisk.c | 2 +- grub-core/kern/fs.c | 2 +- grub-core/kern/misc.c | 2 +- grub-core/kern/parser.c | 2 +- grub-core/kern/uboot/uboot.c | 2 +- - grub-core/lib/libgcrypt/cipher/ac.c | 8 +-- - grub-core/lib/libgcrypt/cipher/primegen.c | 4 +- - grub-core/lib/libgcrypt/cipher/pubkey.c | 4 +- + grub-core/lib/libgcrypt/cipher/ac.c | 8 ++--- + grub-core/lib/libgcrypt/cipher/primegen.c | 4 +-- + grub-core/lib/libgcrypt/cipher/pubkey.c | 4 +-- grub-core/lib/priority_queue.c | 2 +- - grub-core/lib/reed_solomon.c | 7 ++- - grub-core/lib/relocator.c | 10 ++-- + grub-core/lib/reed_solomon.c | 7 ++-- + grub-core/lib/relocator.c | 10 +++--- grub-core/loader/arm/linux.c | 2 +- - grub-core/loader/efi/chainloader.c | 11 +++-- + grub-core/loader/efi/chainloader.c | 11 ++++-- grub-core/loader/i386/bsdXX.c | 2 +- - grub-core/loader/i386/xnu.c | 4 +- + grub-core/loader/i386/xnu.c | 4 +-- grub-core/loader/macho.c | 2 +- grub-core/loader/multiboot_elfxx.c | 2 +- grub-core/loader/xnu.c | 2 +- - grub-core/mmap/mmap.c | 4 +- + grub-core/mmap/mmap.c | 4 +-- grub-core/net/bootp.c | 2 +- - grub-core/net/dns.c | 10 ++-- - grub-core/net/net.c | 4 +- - grub-core/normal/charset.c | 10 ++-- - grub-core/normal/cmdline.c | 14 +++--- - grub-core/normal/menu_entry.c | 14 +++--- - grub-core/normal/menu_text.c | 4 +- - grub-core/normal/term.c | 4 +- - grub-core/osdep/linux/getroot.c | 6 +-- + grub-core/net/dns.c | 10 +++--- + grub-core/net/net.c | 4 +-- + grub-core/normal/charset.c | 10 +++--- + grub-core/normal/cmdline.c | 14 ++++---- + grub-core/normal/menu_entry.c | 14 ++++---- + grub-core/normal/menu_text.c | 4 +-- + grub-core/normal/term.c | 4 +-- + grub-core/osdep/linux/getroot.c | 6 ++-- grub-core/osdep/unix/config.c | 2 +- grub-core/osdep/windows/getroot.c | 2 +- - grub-core/osdep/windows/hostdisk.c | 4 +- + grub-core/osdep/windows/hostdisk.c | 4 +-- grub-core/osdep/windows/init.c | 2 +- - grub-core/osdep/windows/platform.c | 4 +- + grub-core/osdep/windows/platform.c | 4 +-- grub-core/osdep/windows/relpath.c | 2 +- grub-core/partmap/gpt.c | 2 +- grub-core/partmap/msdos.c | 2 +- grub-core/script/execute.c | 2 +- grub-core/tests/fake_input.c | 2 +- - grub-core/tests/video_checksum.c | 6 +-- + grub-core/tests/video_checksum.c | 6 ++-- grub-core/video/capture.c | 2 +- grub-core/video/emu/sdl.c | 2 +- grub-core/video/i386/pc/vga.c | 2 +- grub-core/video/readers/png.c | 2 +- util/getroot.c | 2 +- util/grub-file.c | 2 +- - util/grub-fstest.c | 4 +- + util/grub-fstest.c | 4 +-- util/grub-install-common.c | 2 +- - util/grub-install.c | 4 +- - util/grub-mkimagexx.c | 6 +-- - util/grub-mkrescue.c | 4 +- + util/grub-install.c | 4 +-- + util/grub-mkimagexx.c | 6 ++-- + util/grub-mkrescue.c | 4 +-- util/grub-mkstandalone.c | 2 +- - util/grub-pe2elf.c | 12 ++--- - util/grub-probe.c | 4 +- - include/grub/unicode.h | 4 +- + util/grub-pe2elf.c | 12 +++---- + util/grub-probe.c | 4 +-- + include/grub/unicode.h | 4 +-- 85 files changed, 243 insertions(+), 193 deletions(-) diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c @@ -1952,6 +1952,3 @@ index a0403e91f9a..4de986a8576 100644 if (!out->combining_ptr) return; grub_memcpy (out->combining_ptr, in->combining_ptr, --- -2.26.2 - diff --git a/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch b/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch index c891557b..20730df8 100644 --- a/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch +++ b/0209-malloc-Use-overflow-checking-primitives-where-we-do-.patch @@ -1,8 +1,8 @@ -From b3dd39088e5b2efb190e33e2a0b71c9d1dc93118 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 15 Jun 2020 12:28:27 -0400 -Subject: [PATCH 209/237] malloc: Use overflow checking primitives where we do - complex allocations +Subject: [PATCH] malloc: Use overflow checking primitives where we do complex + allocations This attempts to fix the places where we do the following where arithmetic_expr may include unvalidated data: @@ -30,29 +30,29 @@ Signed-off-by: Peter Jones Reviewed-by: Daniel Kiper Upstream-commit-id: 5fb2befbf04 --- - grub-core/commands/legacycfg.c | 29 +++++++++++++++---- - grub-core/commands/wildcard.c | 36 ++++++++++++++++++++---- - grub-core/disk/ldm.c | 32 +++++++++++++++------ - grub-core/font/font.c | 7 ++++- - grub-core/fs/btrfs.c | 29 +++++++++++++------ - grub-core/fs/ext2.c | 10 ++++++- - grub-core/fs/iso9660.c | 51 ++++++++++++++++++++++++---------- - grub-core/fs/sfs.c | 27 ++++++++++++++---- - grub-core/fs/squash4.c | 45 ++++++++++++++++++++++-------- - grub-core/fs/udf.c | 41 +++++++++++++++++---------- - grub-core/fs/xfs.c | 11 +++++--- - grub-core/fs/zfs/zfs.c | 22 ++++++++++----- - grub-core/fs/zfs/zfscrypt.c | 7 ++++- - grub-core/lib/arg.c | 20 +++++++++++-- - grub-core/loader/i386/bsd.c | 8 +++++- - grub-core/net/dns.c | 9 +++++- - grub-core/normal/charset.c | 10 +++++-- - grub-core/normal/cmdline.c | 14 ++++++++-- - grub-core/normal/menu_entry.c | 13 +++++++-- - grub-core/script/argv.c | 16 +++++++++-- - grub-core/script/lexer.c | 21 ++++++++++++-- - grub-core/video/bitmap.c | 25 +++++++++++------ - grub-core/video/readers/png.c | 13 +++++++-- + grub-core/commands/legacycfg.c | 29 +++++++++++++++++++----- + grub-core/commands/wildcard.c | 36 ++++++++++++++++++++++++----- + grub-core/disk/ldm.c | 32 ++++++++++++++++++-------- + grub-core/font/font.c | 7 +++++- + grub-core/fs/btrfs.c | 29 ++++++++++++++++-------- + grub-core/fs/ext2.c | 10 ++++++++- + grub-core/fs/iso9660.c | 51 +++++++++++++++++++++++++++++------------- + grub-core/fs/sfs.c | 27 +++++++++++++++++----- + grub-core/fs/squash4.c | 45 ++++++++++++++++++++++++++++--------- + grub-core/fs/udf.c | 41 +++++++++++++++++++++------------ + grub-core/fs/xfs.c | 11 +++++---- + grub-core/fs/zfs/zfs.c | 22 ++++++++++++------ + grub-core/fs/zfs/zfscrypt.c | 7 +++++- + grub-core/lib/arg.c | 20 +++++++++++++++-- + grub-core/loader/i386/bsd.c | 8 ++++++- + grub-core/net/dns.c | 9 +++++++- + grub-core/normal/charset.c | 10 +++++++-- + grub-core/normal/cmdline.c | 14 ++++++++++-- + grub-core/normal/menu_entry.c | 13 +++++++++-- + grub-core/script/argv.c | 16 +++++++++++-- + grub-core/script/lexer.c | 21 ++++++++++++++--- + grub-core/video/bitmap.c | 25 +++++++++++++-------- + grub-core/video/readers/png.c | 13 +++++++++-- 23 files changed, 383 insertions(+), 113 deletions(-) diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c @@ -1318,6 +1318,3 @@ index e85df3c1b04..719e647e44f 100644 #ifndef GRUB_CPU_WORDS_BIGENDIAN if (data->is_16bit || data->is_gray || data->is_palette) --- -2.26.2 - diff --git a/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch b/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch index 95fe5f1f..33896cb9 100644 --- a/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch +++ b/0210-iso9660-Don-t-leak-memory-on-realloc-failures.patch @@ -1,7 +1,7 @@ -From 5efb4029deaa8e0bfc7a4293a28e25469500ec06 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sat, 4 Jul 2020 12:25:09 -0400 -Subject: [PATCH 210/237] iso9660: Don't leak memory on realloc() failures +Subject: [PATCH] iso9660: Don't leak memory on realloc() failures Signed-off-by: Peter Jones Reviewed-by: Daniel Kiper @@ -64,6 +64,3 @@ index f45841e2b47..6fc9302bce3 100644 /* In pos + 1 the length of the `Component Record' is stored. */ pos += entry->data[pos + 1] + 2; --- -2.26.2 - diff --git a/0211-font-Do-not-load-more-than-one-NAME-section.patch b/0211-font-Do-not-load-more-than-one-NAME-section.patch index 8556448a..302e3ea8 100644 --- a/0211-font-Do-not-load-more-than-one-NAME-section.patch +++ b/0211-font-Do-not-load-more-than-one-NAME-section.patch @@ -1,7 +1,7 @@ -From 085192b4f863bdf03506c8029999361b1dd82ac0 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Kiper Date: Tue, 7 Jul 2020 15:36:26 +0200 -Subject: [PATCH 211/237] font: Do not load more than one NAME section +Subject: [PATCH] font: Do not load more than one NAME section The GRUB font file can have one NAME section only. Though if somebody crafts a broken font file with many NAME sections and loads it then the @@ -33,6 +33,3 @@ index d63354fb51b..a7b955a1a74 100644 font->name = read_section_as_string (§ion); if (!font->name) goto fail; --- -2.26.2 - diff --git a/0212-gfxmenu-Fix-double-free-in-load_image.patch b/0212-gfxmenu-Fix-double-free-in-load_image.patch index aeb027a2..97416b95 100644 --- a/0212-gfxmenu-Fix-double-free-in-load_image.patch +++ b/0212-gfxmenu-Fix-double-free-in-load_image.patch @@ -1,7 +1,7 @@ -From 356d5cc44af753218db6a9e8e49f0d0a64e287f7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Wed, 8 Jul 2020 20:41:56 +0000 -Subject: [PATCH 212/237] gfxmenu: Fix double free in load_image() +Subject: [PATCH] gfxmenu: Fix double free in load_image() self->bitmap should be zeroed after free. Otherwise, there is a chance to double free (USE_AFTER_FREE) it later in rescale_image(). @@ -31,6 +31,3 @@ index 29784ed2d9a..6b2e976f16e 100644 if (self->raw_bitmap) grub_video_bitmap_destroy (self->raw_bitmap); --- -2.26.2 - diff --git a/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch b/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch index 05109ccc..a97277cc 100644 --- a/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch +++ b/0213-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch @@ -1,8 +1,7 @@ -From 677e7108f235defb7ec6e7107963cf3576b0eab4 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Wed, 8 Jul 2020 21:30:43 +0000 -Subject: [PATCH 213/237] xnu: Fix double free in - grub_xnu_devprop_add_property() +Subject: [PATCH] xnu: Fix double free in grub_xnu_devprop_add_property() grub_xnu_devprop_add_property() should not free utf8 and utf16 as it get allocated and freed in the caller. @@ -52,6 +51,3 @@ index ee0eaadc4ee..c760db30fc0 100644 grub_list_push (GRUB_AS_LIST_P (&dev->properties), GRUB_AS_LIST (prop)); return GRUB_ERR_NONE; --- -2.26.2 - diff --git a/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch b/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch index 96794f1c..d5a31f5d 100644 --- a/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch +++ b/0214-lzma-Make-sure-we-don-t-dereference-past-array.patch @@ -1,7 +1,7 @@ -From efb9080d69c08171b5cccc202c7a1735ab85e80a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Thu, 9 Jul 2020 03:05:23 +0000 -Subject: [PATCH 214/237] lzma: Make sure we don't dereference past array +Subject: [PATCH] lzma: Make sure we don't dereference past array The two dimensional array p->posSlotEncoder[4][64] is being dereferenced using the GetLenToPosState() macro which checks if len is less than 5, @@ -47,6 +47,3 @@ index f2ec04a8c28..753e56a95e3 100644 if (posSlot >= kStartPosModelIndex) { --- -2.26.2 - diff --git a/0215-term-Fix-overflow-on-user-inputs.patch b/0215-term-Fix-overflow-on-user-inputs.patch index d44dc9d5..b381e450 100644 --- a/0215-term-Fix-overflow-on-user-inputs.patch +++ b/0215-term-Fix-overflow-on-user-inputs.patch @@ -1,7 +1,7 @@ -From d2864a6873bf3a8749d678b271c32f3a5ae0fa1e Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Tue, 7 Jul 2020 15:12:25 -0400 -Subject: [PATCH 215/237] term: Fix overflow on user inputs +Subject: [PATCH] term: Fix overflow on user inputs This requires a very weird input from the serial interface but can cause an overflow in input_buf (keys) overwriting the next variable (npending) @@ -61,6 +61,3 @@ index 537a5c0cb0b..44d0b3b19fb 100644 #if defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275) if (data->npending == 1 && data->input_buf[0] == GRUB_TERM_ESC --- -2.26.2 - diff --git a/0216-udf-Fix-memory-leak.patch b/0216-udf-Fix-memory-leak.patch index 0e2c41b3..452ff615 100644 --- a/0216-udf-Fix-memory-leak.patch +++ b/0216-udf-Fix-memory-leak.patch @@ -1,7 +1,7 @@ -From a85ad19c960f48f18bcbbeb7ef8f65ff83979608 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Tue, 7 Jul 2020 22:02:31 -0400 -Subject: [PATCH 216/237] udf: Fix memory leak +Subject: [PATCH] udf: Fix memory leak Fixes: CID 73796 @@ -51,6 +51,3 @@ index be41b48f913..6670beb5665 100644 if (filename && hook (filename, type, child, hook_data)) { --- -2.26.2 - diff --git a/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch b/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch index 2af622c2..4f474da5 100644 --- a/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch +++ b/0217-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch @@ -1,8 +1,8 @@ -From 3dff974017867a65e6aae14e14a0233ce9520cb3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Fri, 26 Jun 2020 10:51:43 -0400 -Subject: [PATCH 217/237] multiboot2: Fix memory leak if - grub_create_loader_cmdline() fails +Subject: [PATCH] multiboot2: Fix memory leak if grub_create_loader_cmdline() + fails Fixes: CID 292468 @@ -42,6 +42,3 @@ index 54078455e2f..47d4c6f0977 100644 if (modules_last) modules_last->next = newmod; --- -2.26.2 - diff --git a/0218-tftp-Do-not-use-priority-queue.patch b/0218-tftp-Do-not-use-priority-queue.patch index 2e8cd32c..59160d9a 100644 --- a/0218-tftp-Do-not-use-priority-queue.patch +++ b/0218-tftp-Do-not-use-priority-queue.patch @@ -1,7 +1,7 @@ -From 46cd356a38806ea321b4db107e73114ebf959879 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Thu, 9 Jul 2020 08:10:40 +0000 -Subject: [PATCH 218/237] tftp: Do not use priority queue +Subject: [PATCH] tftp: Do not use priority queue There is not need to reassemble the order of blocks. Per RFC 1350, server must wait for the ACK, before sending next block. Data packets @@ -31,7 +31,7 @@ Signed-off-by: Alexey Makhalov Reviewed-by: Daniel Kiper Upstream-commit-id: 8316694c4f7 --- - grub-core/net/tftp.c | 162 +++++++++++++------------------------------ + grub-core/net/tftp.c | 162 ++++++++++++++++----------------------------------- 1 file changed, 50 insertions(+), 112 deletions(-) diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c @@ -276,6 +276,3 @@ index e267af354f4..c2df3d7f6ab 100644 grub_free (data); return GRUB_ERR_NONE; } --- -2.26.2 - diff --git a/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch b/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch index 4d1bb942..49c8688d 100644 --- a/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch +++ b/0219-multiboot2-Set-min-address-for-mbi-allocation-to-0x1.patch @@ -1,8 +1,7 @@ -From 1758c2a567025aa49fd7c8ba5f3f891f7483040d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Lukasz Hawrylko Date: Mon, 16 Dec 2019 11:15:55 +0100 -Subject: [PATCH 219/237] multiboot2: Set min address for mbi allocation to - 0x1000 +Subject: [PATCH] multiboot2: Set min address for mbi allocation to 0x1000 In some cases GRUB2 allocates multiboot2 structure at 0 address, that is a confusing behavior. Consumers of that structure can have internal NULL-checks @@ -43,6 +42,3 @@ index 47d4c6f0977..797870b6138 100644 bufsize, MULTIBOOT_TAG_ALIGN, GRUB_RELOCATOR_PREFERENCE_NONE, 1); if (err) --- -2.26.2 - diff --git a/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch b/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch index a034afdf..aabb1383 100644 --- a/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch +++ b/0220-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch @@ -1,8 +1,8 @@ -From 0c7a6366d24387a2fac387374712be260694ed6c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Wed, 15 Jul 2020 06:42:37 +0000 -Subject: [PATCH 220/237] relocator: Protect grub_relocator_alloc_chunk_addr() - input args against integer underflow/overflow +Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_addr() input + args against integer underflow/overflow Use arithmetic macros from safemath.h to accomplish it. In this commit, I didn't want to be too paranoid to check every possible math equation @@ -145,6 +145,3 @@ index dc7d5409e1e..2bf02489bad 100644 grub_xnu_heap_size += size; grub_dprintf ("xnu", "val=%p\n", *src); return GRUB_ERR_NONE; --- -2.26.2 - diff --git a/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch b/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch index 98e1780f..62c15c9a 100644 --- a/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch +++ b/0221-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch @@ -1,7 +1,7 @@ -From e2d3341a2a7bd4ef68d8c6d70922732621ea6cb3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Wed, 8 Jul 2020 01:44:38 +0000 -Subject: [PATCH 221/237] relocator: Protect grub_relocator_alloc_chunk_align() +Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_align() max_addr against integer underflow This commit introduces integer underflow mitigation in max_addr calculation @@ -20,7 +20,7 @@ Signed-off-by: Alexey Makhalov Reviewed-by: Daniel Kiper Upstream-commit-id: 10498c8ba17 --- - grub-core/lib/i386/relocator.c | 28 ++++++++++---------------- + grub-core/lib/i386/relocator.c | 28 +++++++++++----------------- grub-core/lib/mips/relocator.c | 6 ++---- grub-core/lib/powerpc/relocator.c | 6 ++---- grub-core/lib/x86_64/efi/relocator.c | 7 +++---- @@ -29,10 +29,10 @@ Upstream-commit-id: 10498c8ba17 grub-core/loader/i386/pc/linux.c | 6 ++---- grub-core/loader/mips/linux.c | 9 +++------ grub-core/loader/multiboot.c | 2 +- - grub-core/loader/multiboot_elfxx.c | 10 ++++----- - grub-core/loader/multiboot_mbi2.c | 10 ++++----- + grub-core/loader/multiboot_elfxx.c | 10 +++++----- + grub-core/loader/multiboot_mbi2.c | 10 +++++----- grub-core/loader/xnu_resume.c | 2 +- - include/grub/relocator.h | 29 +++++++++++++++++++++++++++ + include/grub/relocator.h | 29 +++++++++++++++++++++++++++++ 13 files changed, 69 insertions(+), 58 deletions(-) diff --git a/grub-core/lib/i386/relocator.c b/grub-core/lib/i386/relocator.c @@ -333,6 +333,3 @@ index 24d8672d22c..1b3bdd92ac6 100644 #define GRUB_RELOCATOR_PREFERENCE_NONE 0 #define GRUB_RELOCATOR_PREFERENCE_LOW 1 #define GRUB_RELOCATOR_PREFERENCE_HIGH 2 --- -2.26.2 - diff --git a/0222-script-Remove-unused-fields-from-grub_script_functio.patch b/0222-script-Remove-unused-fields-from-grub_script_functio.patch index d31ccf04..93beaac0 100644 --- a/0222-script-Remove-unused-fields-from-grub_script_functio.patch +++ b/0222-script-Remove-unused-fields-from-grub_script_functio.patch @@ -1,8 +1,7 @@ -From a358cbbdcd0350796828904623ebcb88ca844627 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Fri, 10 Jul 2020 11:21:14 +0100 -Subject: [PATCH 222/237] script: Remove unused fields from - grub_script_function struct +Subject: [PATCH] script: Remove unused fields from grub_script_function struct Signed-off-by: Chris Coulson Reviewed-by: Daniel Kiper @@ -29,6 +28,3 @@ index 360c2be1f05..b382bcf09bc 100644 }; typedef struct grub_script_function *grub_script_function_t; --- -2.26.2 - diff --git a/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch b/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch index 1f406a70..036db396 100644 --- a/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch +++ b/0223-script-Avoid-a-use-after-free-when-redefining-a-func.patch @@ -1,8 +1,8 @@ -From f32da3dd1388e61b1f443a419e2fb1d8333bb9a3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Fri, 10 Jul 2020 14:41:45 +0100 -Subject: [PATCH 223/237] script: Avoid a use-after-free when redefining a - function during execution +Subject: [PATCH] script: Avoid a use-after-free when redefining a function + during execution Defining a new function with the same name as a previously defined function causes the grub_script and associated resources for the @@ -103,6 +103,3 @@ index 4f0ab8319e3..f80b86b6f15 100644 } state->scripts = $3; --- -2.26.2 - diff --git a/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch b/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch index 3b5f41be..850fef76 100644 --- a/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch +++ b/0224-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch @@ -1,8 +1,8 @@ -From 6915294adb87c0c85644977ede5e2e8410145e47 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Fri, 17 Jul 2020 05:17:26 +0000 -Subject: [PATCH 224/237] relocator: Fix grub_relocator_alloc_chunk_align() top - memory allocation +Subject: [PATCH] relocator: Fix grub_relocator_alloc_chunk_align() top memory + allocation Current implementation of grub_relocator_alloc_chunk_align() does not allow allocation of the top byte. @@ -41,6 +41,3 @@ index 5847aac3643..f2c1944c28d 100644 #ifdef GRUB_MACHINE_PCBIOS if (min_addr < 0x1000) --- -2.26.2 - diff --git a/0225-hfsplus-fix-two-more-overflows.patch b/0225-hfsplus-fix-two-more-overflows.patch index bdb225b2..158472e4 100644 --- a/0225-hfsplus-fix-two-more-overflows.patch +++ b/0225-hfsplus-fix-two-more-overflows.patch @@ -1,7 +1,7 @@ -From e69336cd346bcd06931e290fe059e3e749f1fe0a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 14:43:31 -0400 -Subject: [PATCH 225/237] hfsplus: fix two more overflows +Subject: [PATCH] hfsplus: fix two more overflows Both node->size and node->namelen come from the supplied filesystem, which may be user-supplied. We can't trust them for the math unless we @@ -52,6 +52,3 @@ index db8ee7afc5d..6ceea039b65 100644 if (! filename) return 0; --- -2.26.2 - diff --git a/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch b/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch index 9d1509ab..31e7f072 100644 --- a/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch +++ b/0226-lvm-fix-two-more-potential-data-dependent-alloc-over.patch @@ -1,8 +1,7 @@ -From d5bced0897b30edfbf0428e6ae57c59166b0b7b3 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 15:48:20 -0400 -Subject: [PATCH 226/237] lvm: fix two more potential data-dependent alloc - overflows +Subject: [PATCH] lvm: fix two more potential data-dependent alloc overflows It appears to be possible to make a (possibly invalid) lvm PV with a metadata size field that overflows our type when adding it to the @@ -14,7 +13,7 @@ Signed-off-by: Peter Jones Signed-off-by: Darren Kenny Upstream-commit-id: 45ec6046ea0 --- - grub-core/disk/lvm.c | 47 ++++++++++++++++++++++++++++++++++++-------- + grub-core/disk/lvm.c | 47 +++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 8 deletions(-) diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c @@ -107,6 +106,3 @@ index 8e76d1ae121..cca8ec668ba 100644 if (!lv->fullname) goto lvs_fail; --- -2.26.2 - diff --git a/0227-emu-make-grub_free-NULL-safe.patch b/0227-emu-make-grub_free-NULL-safe.patch index cd934ea6..64ecc344 100644 --- a/0227-emu-make-grub_free-NULL-safe.patch +++ b/0227-emu-make-grub_free-NULL-safe.patch @@ -1,7 +1,7 @@ -From 586555d31fc16e666aa1cb108ef4acdc4d8e280d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 16:08:08 -0400 -Subject: [PATCH 227/237] emu: make grub_free(NULL) safe +Subject: [PATCH] emu: make grub_free(NULL) safe The grub_free() implementation in kern/mm.c safely handles NULL pointers, and code at many places depends on this. We don't know that @@ -29,6 +29,3 @@ index 145b01d3719..4d1046a219e 100644 } void * --- -2.26.2 - diff --git a/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch b/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch index a5ff8c9b..0499401b 100644 --- a/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch +++ b/0228-efi-fix-some-malformed-device-path-arithmetic-errors.patch @@ -1,8 +1,7 @@ -From 44da24d70495387b459db27c22cc7aa3c28b3ef9 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 16:53:27 -0400 -Subject: [PATCH 228/237] efi: fix some malformed device path arithmetic - errors. +Subject: [PATCH] efi: fix some malformed device path arithmetic errors. Several places we take the length of a device path and subtract 4 from it, without ever checking that it's >= 4. There are also cases where @@ -19,10 +18,10 @@ code check for and return errors in these cases. Signed-off-by: Peter Jones Upstream-commit-id: 23e68a83990 --- - grub-core/kern/efi/efi.c | 67 +++++++++++++++++++++++++----- - grub-core/loader/efi/chainloader.c | 19 ++++++++- - grub-core/loader/i386/xnu.c | 9 ++-- - include/grub/efi/api.h | 14 ++++--- + grub-core/kern/efi/efi.c | 67 ++++++++++++++++++++++++++++++++------ + grub-core/loader/efi/chainloader.c | 19 +++++++++-- + grub-core/loader/i386/xnu.c | 9 ++--- + include/grub/efi/api.h | 14 +++++--- 4 files changed, 88 insertions(+), 21 deletions(-) diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c @@ -247,6 +246,3 @@ index 0c15cffa23c..3bff70d1c0e 100644 /* Hardware Device Path. */ #define GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE 1 --- -2.26.2 - diff --git a/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch b/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch index 6902f82b..1fcf5800 100644 --- a/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch +++ b/0229-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch @@ -1,8 +1,8 @@ -From bb89851e5cdcc38421550dd437cbddb60595456c Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Wed, 22 Jul 2020 17:06:04 +0100 -Subject: [PATCH 229/237] Fix a regression caused by "efi: fix some malformed - device path arithmetic errors" +Subject: [PATCH] Fix a regression caused by "efi: fix some malformed device + path arithmetic errors" This commit introduced a bogus check inside copy_file_path to determine whether the destination grub_efi_file_path_device_path_t @@ -83,6 +83,3 @@ index c2411b6dab2..8b99cf23e9d 100644 /* Fill the end of device path nodes. */ d = GRUB_EFI_NEXT_DEVICE_PATH (d); --- -2.26.2 - diff --git a/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch b/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch index e5ff1fc3..5fe19daa 100644 --- a/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch +++ b/0230-efi-Fix-use-after-free-in-halt-reboot-path.patch @@ -1,7 +1,7 @@ -From 092b0c6b0ba0cc1cfb91fe2901795ae295b77b5d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Alexey Makhalov Date: Mon, 20 Jul 2020 23:03:05 +0000 -Subject: [PATCH 230/237] efi: Fix use-after-free in halt/reboot path +Subject: [PATCH] efi: Fix use-after-free in halt/reboot path commit 92bfc33db984 ("efi: Free malloc regions on exit") introduced memory freeing in grub_efi_fini(), which is @@ -160,6 +160,3 @@ index 7f82a499fd9..b208642821b 100644 }; void EXPORT_FUNC (grub_loader_set) (grub_err_t (*boot) (void), --- -2.26.2 - diff --git a/0231-efi-dhcp-fix-some-allocation-error-checking.patch b/0231-efi-dhcp-fix-some-allocation-error-checking.patch index 751f21e0..75497338 100644 --- a/0231-efi-dhcp-fix-some-allocation-error-checking.patch +++ b/0231-efi-dhcp-fix-some-allocation-error-checking.patch @@ -1,7 +1,7 @@ -From e8d3b5faccac28f0b204fcc227a00cc83662f23b Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 17:11:06 -0400 -Subject: [PATCH 231/237] efi+dhcp: fix some allocation error checking. +Subject: [PATCH] efi+dhcp: fix some allocation error checking. Signed-off-by: Peter Jones --- @@ -35,6 +35,3 @@ index dbef63d8c08..e5c79b748b0 100644 } if (status != GRUB_EFI_SUCCESS) --- -2.26.2 - diff --git a/0232-efi-http-fix-some-allocation-error-checking.patch b/0232-efi-http-fix-some-allocation-error-checking.patch index 192da3bf..fc1d9384 100644 --- a/0232-efi-http-fix-some-allocation-error-checking.patch +++ b/0232-efi-http-fix-some-allocation-error-checking.patch @@ -1,7 +1,7 @@ -From ffa36b5e2200a39a801fb0f660a40bcc687e0e48 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 17:14:15 -0400 -Subject: [PATCH 232/237] efi+http: fix some allocation error checking. +Subject: [PATCH] efi+http: fix some allocation error checking. Signed-off-by: Peter Jones --- @@ -37,6 +37,3 @@ index de351b2cd03..c56231105e4 100644 file->size = size; file->data = buf; --- -2.26.2 - diff --git a/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch b/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch index 79834835..1fdd020c 100644 --- a/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch +++ b/0233-efi-ip-46-_config.c-fix-some-potential-allocation-ov.patch @@ -1,8 +1,7 @@ -From c142a1f74c2c0893889b2333a0f8d03dbcea6ca5 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Sun, 19 Jul 2020 17:27:00 -0400 -Subject: [PATCH 233/237] efi/ip[46]_config.c: fix some potential allocation - overflows +Subject: [PATCH] efi/ip[46]_config.c: fix some potential allocation overflows In theory all of this data comes from the firmware stack and it should be safe, but it's better to be paranoid. @@ -126,6 +125,3 @@ index e0e00c23d21..1c5415d7185 100644 { char *gateway, *destination; grub_uint64_t u64_gateway[2]; --- -2.26.2 - diff --git a/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch b/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch index 5f34f97e..75b304c3 100644 --- a/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch +++ b/0234-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch @@ -1,7 +1,7 @@ -From 396e9868fb2c0ee18780d61ecdafec58f179b9c1 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Fri, 24 Jul 2020 17:18:09 +0100 -Subject: [PATCH 234/237] efilinux: Fix integer overflows in grub_cmd_initrd +Subject: [PATCH] efilinux: Fix integer overflows in grub_cmd_initrd These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with @@ -46,6 +46,3 @@ index 65d1b5cc034..2bd6663625d 100644 } initrd_mem = kernel_alloc(size, N_("can't allocate initrd")); --- -2.26.2 - diff --git a/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch b/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch index 3267dab3..b309aebd 100644 --- a/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch +++ b/0235-linux-loader-avoid-overflow-on-initrd-size-calculati.patch @@ -1,8 +1,7 @@ -From 764fd0b43b98476d1d37b4a6e406afb3f48e5472 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 24 Jul 2020 13:57:27 -0400 -Subject: [PATCH 235/237] linux loader: avoid overflow on initrd size - calculation +Subject: [PATCH] linux loader: avoid overflow on initrd size calculation Signed-off-by: Peter Jones --- @@ -24,6 +23,3 @@ index c2c7cfcd0fd..61a2e144db0 100644 if (!initrd_ctx->components) return grub_errno; --- -2.26.2 - diff --git a/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch b/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch index 3cbb531e..789a72d0 100644 --- a/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch +++ b/0236-linuxefi-fail-kernel-validation-without-shim-protoco.patch @@ -1,8 +1,7 @@ -From bb240087ce9ef9a62936fd6c1241df65a1e42d01 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Dimitri John Ledkov Date: Wed, 22 Jul 2020 11:31:43 +0100 -Subject: [PATCH 236/237] linuxefi: fail kernel validation without shim - protocol. +Subject: [PATCH] linuxefi: fail kernel validation without shim protocol. If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature @@ -96,6 +95,3 @@ index 2bd6663625d..cc6a503adb1 100644 } lh = (struct linux_i386_kernel_header *)kernel; --- -2.26.2 - diff --git a/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch b/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch index 19bd8192..b027ea0c 100644 --- a/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch +++ b/0237-linux-Fix-integer-overflows-in-initrd-size-handling.patch @@ -1,7 +1,7 @@ -From 4cbc5ec735e914b1f084d92a94be614ac5f9d3be Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sat, 25 Jul 2020 12:15:37 +0100 -Subject: [PATCH 237/237] linux: Fix integer overflows in initrd size handling +Subject: [PATCH] linux: Fix integer overflows in initrd size handling These could be triggered by a crafted filesystem with very large files. @@ -10,7 +10,7 @@ Fixes: CVE-2020-15707 Signed-off-by: Colin Watson Reviewed-by: Jan Setje-Eilers --- - grub-core/loader/linux.c | 75 +++++++++++++++++++++++++++++----------- + grub-core/loader/linux.c | 75 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 54 insertions(+), 21 deletions(-) diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c @@ -164,6 +164,3 @@ index 61a2e144db0..49d2948644e 100644 ptr = make_header (ptr, initrd_ctx->components[i].newc_name, grub_strlen (initrd_ctx->components[i].newc_name), 0100777, --- -2.26.2 - From a21dd5b5403e855226377865bba7a37ddc05023b Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 10 Aug 2020 17:03:55 -0400 Subject: [PATCH 16/16] Attempt to enable dual-signing in f31 Signed-off-by: Peter Jones --- grub.macros | 9 +++++++-- grub2.spec | 3 +++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/grub.macros b/grub.macros index 6b9c0052..c8f7b766 100644 --- a/grub.macros +++ b/grub.macros @@ -373,8 +373,13 @@ done \ -p /EFI/%{efi_vendor} -d grub-core ${GRUB_MODULES} \ %{4}./grub-mkimage -O %{1} -o %{3}.orig \\\ -p /EFI/BOOT -d grub-core ${GRUB_MODULES} \ -%{expand:%%{pesign -s -i %%{2}.orig -o %%{2} -a %%{5} -c %%{6} -n %%{7}}} \ -%{expand:%%{pesign -s -i %%{3}.orig -o %%{3} -a %%{5} -c %%{6} -n %%{7}}} \ +%{expand:%%define ___pesign_client_cert %{?___pesign_client_cert}%{!?___pesign_client_cert:%{__pesign_client_cert}}} \ +%{?__pesign_client_cert:%{expand:%%define __pesign_client_cert %{___pesign_client_cert}}} \ +%{expand:%%{pesign -s -i %%{2}.orig -o %%{2}.onesig -a %%{5} -c %%{6} -n %%{7}}} \ +%{expand:%%{pesign -s -i %%{3}.orig -o %%{3}.onesig -a %%{5} -c %%{6} -n %%{7}}} \ +%{expand:%%define __pesign_client_cert grub2-signer} \ +%{expand:%%{pesign -s -i %%{2}.onesig -o %%{2} -a %%{5} -c %%{6} -n %%{7}}} \ +%{expand:%%{pesign -s -i %%{3}.onesig -o %%{3} -a %%{5} -c %%{6} -n %%{7}}} \ %{nil} %else %define mkimage() \ diff --git a/grub2.spec b/grub2.spec index 05f39949..fe3ae5e4 100644 --- a/grub2.spec +++ b/grub2.spec @@ -518,6 +518,9 @@ rm -r /boot/grub2.tmp/ || : %endif %changelog +* Mon Aug 10 2020 Peter Jones - 2.02-110 +- Attempt to enable dual-signing in f31 + * Wed Jul 29 2020 Peter Jones - 2.02-110 - "Minor" bug fixes CVE-2020-10713