From 42637fac6e9b17c7eabb93cf596d9f1967a2f38c Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Sat, 13 Jun 2026 20:18:07 -0400 Subject: [PATCH] ciq EL8 sbat 5 --- .grub2.checksum | 2 +- .grub2.metadata | 6 - ...enerate-kernelopts-if-missing-on-ppc.patch | 36 + ...it-ppc64-Restrict-high-memory-in-pre.patch | 210 +++ ...il-Enable-default-kernel-for-updates.patch | 34 + ...g-Conservative-partial-fix-for-CVE-2.patch | 150 ++ ...g-More-complete-fix-for-CVE-2024-104.patch | 187 ++ ...g-Exit-calmly-when-not-running-as-ro.patch | 39 + ...OB-write-when-parsing-the-ATTRIBUTE_.patch | 93 + ...OB-read-when-reading-data-from-the-r.patch | 58 + ...OB-read-when-parsing-directory-entri.patch | 73 + ...OB-read-when-parsing-bitmaps-for-ind.patch | 51 + ...OOB-read-when-parsing-a-volume-label.patch | 61 + ...0590-fs-ntfs-Make-code-more-readable.patch | 159 ++ ...fig.in-turn-off-executable-owner-bit.patch | 27 + .../0592-misc-Implement-grub_strlcpy.patch | 65 + .../0593-fs-ufs-Fix-a-heap-OOB-write.patch | 31 + ...Fix-stack-OOB-write-with-grub_strcpy.patch | 31 + ...itialize-name-in-grub_cpio_find_file.patch | 40 + ...ger-overflow-leads-to-heap-OOB-write.patch | 89 + ...f2fs-Set-a-grub_errno-if-mount-fails.patch | 31 + ...plus-Set-a-grub_errno-if-mount-fails.patch | 35 + ...9660-Set-a-grub_errno-if-mount-fails.patch | 33 + .../0600-fs-iso9660-Fix-invalid-free.patch | 50 + ...01-fs-jfs-Fix-OOB-read-in-jfs_getent.patch | 63 + ...ead-caused-by-invalid-dir-slot-index.patch | 64 + ...40-bits-offset-and-address-for-a-dat.patch | 128 ++ ...ent-signed-unsigned-types-usage-in-r.patch | 85 + ...ut-of-bounds-read-for-inline-extents.patch | 46 + .../0606-fs-ntfs-Fix-out-of-bounds-read.patch | 47 + ...-the-end-of-the-MFT-attribute-buffer.patch | 141 ++ ...helper-function-to-access-attributes.patch | 183 ++ .../0610-fs-xfs-Fix-out-of-bounds-read.patch | 42 + ...g-failing-to-mount-sets-a-grub_errno.patch | 42 + ...12-kern-file-Ensure-file-data-is-set.patch | 32 + ...lement-filesystem-reference-counting.patch | 430 +++++ ...-Reference-tracking-for-the-loopback.patch | 103 + ...0615-kern-disk-Limit-recursion-depth.patch | 120 ++ ...tion-Limit-recursion-in-part_iterate.patch | 44 + ...pt-execute-Limit-the-recursion-depth.patch | 55 + ...et_default_ip-and-net_default_mac-va.patch | 29 + ...bles-hooks-when-interface-is-unregis.patch | 85 + ...write-in-grub_net_search_config_file.patch | 80 + ...x-stack-buffer-overflow-in-tftp_open.patch | 114 ++ ...eg-Do-not-permit-duplicate-SOF0-mark.patch | 33 + ...r-an-integer-overflow-in-grub_dl_ref.patch | 138 ++ ...r-the-SHF_INFO_LINK-flag-in-grub_dl_.patch | 34 + ...-Missing-check-for-failed-allocation.patch | 34 + ...626-commands-ls-Fix-NULL-dereference.patch | 32 + ...egister-the-check_signatures-hooks-o.patch | 31 + ...ove-variables-hooks-on-module-unload.patch | 37 + ...ove-variables-hooks-on-module-unload.patch | 34 + ...overflow-leads-to-heap-OOB-write-or-.patch | 35 + ...ger-overflow-leads-to-heap-OOB-write.patch | 53 + ...x-an-integer-overflow-when-supplying.patch | 69 + ...ack-overflow-due-to-unlimited-recurs.patch | 83 + ...-Block-the-dump-command-in-lockdown-.patch | 33 + ...isable-memory-reading-in-lockdown-mo.patch | 50 + ...-Disable-memory-reading-in-lockdown-.patch | 37 + .../0637-fs-bfs-Disable-under-lockdown.patch | 52 + ...able-many-filesystems-under-lockdown.patch | 391 ++++ ...afe-math-macros-to-prevent-overflows.patch | 367 ++++ ...rflows-when-allocating-memory-for-ar.patch | 38 + ...turned-pointer-for-allocated-memory-.patch | 134 ++ ...disk-Call-grub_ieee1275_close-when-g.patch | 31 + ...afe-math-macros-to-prevent-overflows.patch | 353 ++++ ...lows-when-allocating-memory-for-arra.patch | 82 + ...lows-when-assigning-returned-values-.patch | 105 ++ ...afe-math-macros-to-prevent-overflows.patch | 139 ++ ...verflows-when-allocating-memory-for-.patch | 42 + ...returned-pointer-for-allocated-memor.patch | 88 + ...ng-NULL-check-after-grub_strdup-call.patch | 24 + ...afe-math-macros-to-prevent-overflows.patch | 239 +++ ...flows-when-allocating-memory-for-arr.patch | 45 + ...urned-pointer-for-allocated-memory-i.patch | 31 + ...fs-Check-if-allocated-memory-is-NULL.patch | 32 + ...ix-potential-underflow-and-NULL-dere.patch | 32 + ...unix-getroot-Fix-potential-underflow.patch | 35 + ...e-consistent-overflow-error-messages.patch | 55 + ...ine-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch | 30 + ...safe-math-to-avoid-an-integer-overfl.patch | 41 + ...dd-sanity-check-after-grub_strtoul-c.patch | 45 + ...sanity-check-after-grub_strtoul-call.patch | 57 + ...nux-Cast-left-shift-to-grub_uint32_t.patch | 30 + ...bsd-Use-safe-math-to-avoid-underflow.patch | 56 + ...-types-Make-bool-generally-available.patch | 78 + .../0664-Remove-exttra-bool-definitions.patch | 45 + ...s-found-while-fuzzing-the-XFS-filesy.patch | 106 ++ ...ix-grub_malloc-removed-after-added-s.patch | 32 + ...Add-bigtime-incompat-feature-support.patch | 156 ++ ...needsrepair-incompat-feature-support.patch | 81 + ...adable-filesystem-with-v4-superblock.patch | 121 ++ .../0670-fs-Remove-trailing-whitespaces.patch | 1666 +++++++++++++++++ ...s-xfs-Fix-memory-leaks-in-XFS-module.patch | 50 + ...-short-form-directory-data-boundary-.patch | 51 + ...xfs-Fix-XFS-directory-extent-parsing.patch | 171 ++ ...-extent-counters-incompat-feature-su.patch | 119 ++ ...n-continuous-data-blocks-in-director.patch | 57 + ...-extent-counters-incompat-feature-su.patch | 48 + ...ut-of-bounds-read-for-inline-and-ext.patch | 65 + ...rectly-BLS-files-with-conf-extension.patch | 37 + ..._disk_get_size-to-grub_disk_native_s.patch | 399 ++++ ...ts-not-being-able-to-address-to-end-.patch | 45 + ...disk-Modify-sector-by-sysfs-as-disk-.patch | 70 + ...ncorrect-calculation-of-start-sector.patch | 67 + ...Unregister-gettext-command-on-module.patch | 62 + SOURCES/20-grub.install | 20 +- SOURCES/99-grub-mkconfig.install | 24 +- SOURCES/ciq_sb_grub2_aarch64.crt | 36 + SOURCES/ciq_sbsign.macros | 26 + SOURCES/grub.macros | 9 +- SOURCES/grub.patches | 104 + SOURCES/redhatsecureboot301.cer | Bin 0 -> 839 bytes SOURCES/redhatsecureboot502.cer | Bin 0 -> 964 bytes SOURCES/redhatsecureboot601.cer | Bin 0 -> 916 bytes SOURCES/redhatsecureboot701.cer | Bin 0 -> 916 bytes SOURCES/redhatsecurebootca3.cer | Bin 0 -> 977 bytes SOURCES/redhatsecurebootca5.cer | Bin 0 -> 920 bytes SOURCES/sbat.csv.in | 2 +- SPECS/grub2.spec | 133 +- 120 files changed, 10674 insertions(+), 37 deletions(-) create mode 100644 SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch create mode 100644 SOURCES/0580-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch create mode 100644 SOURCES/0581-util-Enable-default-kernel-for-updates.patch create mode 100644 SOURCES/0582-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch create mode 100644 SOURCES/0583-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch create mode 100644 SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch create mode 100644 SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch create mode 100644 SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch create mode 100644 SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch create mode 100644 SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch create mode 100644 SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch create mode 100644 SOURCES/0590-fs-ntfs-Make-code-more-readable.patch create mode 100644 SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch create mode 100644 SOURCES/0592-misc-Implement-grub_strlcpy.patch create mode 100644 SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch create mode 100644 SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch create mode 100644 SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch create mode 100644 SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch create mode 100644 SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch create mode 100644 SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch create mode 100644 SOURCES/0600-fs-iso9660-Fix-invalid-free.patch create mode 100644 SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch create mode 100644 SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch create mode 100644 SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch create mode 100644 SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch create mode 100644 SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch create mode 100644 SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch create mode 100644 SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch create mode 100644 SOURCES/0608-fs-ntfs-Use-a-helper-function-to-access-attributes.patch create mode 100644 SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch create mode 100644 SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch create mode 100644 SOURCES/0612-kern-file-Ensure-file-data-is-set.patch create mode 100644 SOURCES/0613-kern-file-Implement-filesystem-reference-counting.patch create mode 100644 SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch create mode 100644 SOURCES/0615-kern-disk-Limit-recursion-depth.patch create mode 100644 SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch create mode 100644 SOURCES/0617-script-execute-Limit-the-recursion-depth.patch create mode 100644 SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch create mode 100644 SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch create mode 100644 SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch create mode 100644 SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch create mode 100644 SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch create mode 100644 SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch create mode 100644 SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch create mode 100644 SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch create mode 100644 SOURCES/0626-commands-ls-Fix-NULL-dereference.patch create mode 100644 SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch create mode 100644 SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch create mode 100644 SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch create mode 100644 SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch create mode 100644 SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch create mode 100644 SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch create mode 100644 SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch create mode 100644 SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch create mode 100644 SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch create mode 100644 SOURCES/0637-fs-bfs-Disable-under-lockdown.patch create mode 100644 SOURCES/0638-fs-Disable-many-filesystems-under-lockdown.patch create mode 100644 SOURCES/0639-disk-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch create mode 100644 SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch create mode 100644 SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch create mode 100644 SOURCES/0643-fs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch create mode 100644 SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch create mode 100644 SOURCES/0646-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch create mode 100644 SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch create mode 100644 SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch create mode 100644 SOURCES/0650-net-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch create mode 100644 SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch create mode 100644 SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch create mode 100644 SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch create mode 100644 SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch create mode 100644 SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch create mode 100644 SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch create mode 100644 SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch create mode 100644 SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch create mode 100644 SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch create mode 100644 SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch create mode 100644 SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch create mode 100644 SOURCES/0663-types-Make-bool-generally-available.patch create mode 100644 SOURCES/0664-Remove-exttra-bool-definitions.patch create mode 100644 SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch create mode 100644 SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch create mode 100644 SOURCES/0667-fs-xfs-Add-bigtime-incompat-feature-support.patch create mode 100644 SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch create mode 100644 SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch create mode 100644 SOURCES/0670-fs-Remove-trailing-whitespaces.patch create mode 100644 SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch create mode 100644 SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch create mode 100644 SOURCES/0673-fs-xfs-Fix-XFS-directory-extent-parsing.patch create mode 100644 SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch create mode 100644 SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch create mode 100644 SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch create mode 100644 SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch create mode 100644 SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch create mode 100644 SOURCES/0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch create mode 100644 SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch create mode 100644 SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch create mode 100644 SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch create mode 100644 SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch mode change 100644 => 100755 SOURCES/99-grub-mkconfig.install create mode 100644 SOURCES/ciq_sb_grub2_aarch64.crt create mode 100644 SOURCES/ciq_sbsign.macros create mode 100644 SOURCES/redhatsecureboot301.cer create mode 100644 SOURCES/redhatsecureboot502.cer create mode 100644 SOURCES/redhatsecureboot601.cer create mode 100644 SOURCES/redhatsecureboot701.cer create mode 100644 SOURCES/redhatsecurebootca3.cer create mode 100644 SOURCES/redhatsecurebootca5.cer diff --git a/.grub2.checksum b/.grub2.checksum index 31ba3ff..54495ba 100644 --- a/.grub2.checksum +++ b/.grub2.checksum @@ -1 +1 @@ -8d7f5f4b18a7c50b2a4258333f144052f33f9a0502e1da1efd21f497f94074e3 +Direct Git Import diff --git a/.grub2.metadata b/.grub2.metadata index 1cf5135..de99f96 100644 --- a/.grub2.metadata +++ b/.grub2.metadata @@ -1,9 +1,3 @@ -c6d43c94bcbc73c81df3026bc201a88886b8ceebe98188cdb69bdd61bd6be287 SOURCES/redhatsecureboot701.cer -9996c73616ee42f13396c9abfb4b646b538c3c80940474b710afdbe53bf17d32 SOURCES/redhatsecurebootca3.cer 810b3798d316394f94096ec2797909dbf23c858e48f7b3830826b8daa06b7b0f SOURCES/grub-2.02.tar.xz -40175d4c7c5ab4bd753a493f47952f1d8dcf1c219b836968a693e48bd4766135 SOURCES/redhatsecurebootca5.cer 1fddd06b4854598a18ff3742c472c6a5c609929ce1ab74ec9901812aaf30be02 SOURCES/theme.tar.bz2 122b9c470f29b70223b0e07404a6dfa7f339fcfa6ae74c024f478945af7a9a63 SOURCES/unifont-5.1.20080820.pcf.gz -224f7059328df355810fee105e79af2e9fc7e520504f9f545c08ca4e32e8c200 SOURCES/redhatsecureboot301.cer -3f564ef41227562f9ea45c3fd8f96bea9ab8205247ef72dd025fdcd728373a00 SOURCES/redhatsecureboot502.cer -8f435a96261e571ed557f9243e7fe7db5b93bc8f7eefcfc5b0c154d5d29292fb SOURCES/redhatsecureboot601.cer diff --git a/SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch b/SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch new file mode 100644 index 0000000..4895dd1 --- /dev/null +++ b/SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch @@ -0,0 +1,36 @@ +From 8c74431327e0c7d7fe47462b0e69fcbe3bbac56e Mon Sep 17 00:00:00 2001 +From: Marta Lewandowska +Date: Fri, 24 Mar 2023 09:14:29 -0400 +Subject: [PATCH] Regenerate kernelopts if missing on ppc + +Signed-off-by: Marta Lewandowska +--- + util/grub.d/10_linux_bls.in | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/util/grub.d/10_linux_bls.in b/util/grub.d/10_linux_bls.in +index 855dbdd..f2281bc 100644 +--- a/util/grub.d/10_linux_bls.in ++++ b/util/grub.d/10_linux_bls.in +@@ -117,6 +117,18 @@ cat < +Date: Tue, 8 Aug 2023 12:21:55 -0400 +Subject: [PATCH] kern/ieee1275/init: ppc64: Restrict high memory in presence + of fadump + +This is a backport of the patch with the same name to grub 2.02. + +When a kernel dump is present then restrict the high memory regions to +avoid allocating memory where the kernel dump resides. Use the +ibm,kernel-dump node under /rtas to determine whether a kernel dump exists +and up to which limit grub can use available memory. Set the +upper_mem_limit to the size of the kernel dump section of type +'REAL_MODE_REGION' and therefore only allow grub's memory usage for high +addresses from 768MB to 'upper_mem_limit'. This means that grub can +use high memory in the range of 768MB to upper_mem_limit and +the kernel-dump memory regions above 'upper_mem_limit' remain untouched. +This change has no effect on memory allocations below 640MB. + +Also, fall back to allocating below 640MB in case the chunk of +memory there would be larger than the chunk of memory above 768MB. +This can for example occur if a free memory area is found starting at 300MB +extending up to 1GB but a kernel dump is located at 768MB and therefore +does not allow the allocation of the high memory area but requiring to use +the chunk starting at 300MB to avoid an unnecessary out-of-memory +condition. + +Signed-off-by: Stefan Berger +Cc: Hari Bathini +Cc: Pavithra Prakash +Cc: Michael Ellerman +Cc: Carolyn Scherrer +Cc: Mahesh Salgaonkar +Cc: Sourabh Jain +--- + grub-core/kern/ieee1275/init.c | 139 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 139 insertions(+) + +diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c +index 1fae84440403..31843ab70a62 100644 +--- a/grub-core/kern/ieee1275/init.c ++++ b/grub-core/kern/ieee1275/init.c +@@ -17,6 +17,8 @@ + * along with GRUB. If not, see . + */ + ++#include /* offsetof() */ ++ + #include + #include + #include +@@ -180,6 +182,97 @@ grub_claim_heap (void) + + GRUB_KERNEL_MACHINE_STACK_SIZE), 0x200000); + } + #else ++ ++/* ibm,kernel-dump data structures */ ++struct kd_section ++{ ++ grub_uint32_t flags; ++ grub_uint16_t src_datatype; ++#define KD_SRC_DATATYPE_REAL_MODE_REGION 0x0011 ++ grub_uint16_t error_flags; ++ grub_uint64_t src_address; ++ grub_uint64_t num_bytes; ++ grub_uint64_t act_bytes; ++ grub_uint64_t dst_address; ++} GRUB_PACKED; ++ ++#define MAX_KD_SECTIONS 10 ++ ++struct kernel_dump ++{ ++ grub_uint32_t format; ++ grub_uint16_t num_sections; ++ grub_uint16_t status_flags; ++ grub_uint32_t offset_1st_section; ++ grub_uint32_t num_blocks; ++ grub_uint64_t start_block; ++ grub_uint64_t num_blocks_avail; ++ grub_uint32_t offet_path_string; ++ grub_uint32_t max_time_allowed; ++ struct kd_section kds[MAX_KD_SECTIONS]; /* offset_1st_section should point to kds[0] */ ++} GRUB_PACKED; ++ ++/* ++ * Determine if a kernel dump exists and if it does, then determine the highest ++ * address that grub can use for memory allocations. ++ * The caller must have initialized *highest to ~0. *highest will not ++ * be modified if no kernel dump is found. ++ */ ++static int ++check_kernel_dump (grub_uint64_t *highest) ++{ ++ struct kernel_dump kernel_dump; ++ grub_ssize_t kernel_dump_size; ++ grub_ieee1275_phandle_t rtas; ++ struct kd_section *kds; ++ grub_size_t i; ++ ++ /* If there's a kernel-dump it must have at least one section */ ++ if (grub_ieee1275_finddevice ("/rtas", &rtas) || ++ grub_ieee1275_get_property (rtas, "ibm,kernel-dump", &kernel_dump, ++ sizeof (kernel_dump), &kernel_dump_size) || ++ kernel_dump_size <= (grub_ssize_t) offsetof (struct kernel_dump, kds[1])) ++ return 0; ++ ++ kernel_dump_size = grub_min (kernel_dump_size, (grub_ssize_t) sizeof (kernel_dump)); ++ ++ if (grub_be_to_cpu32 (kernel_dump.format) != 1) ++ { ++ grub_printf (_("Error: ibm,kernel-dump has an unexpected format version '%u'\n"), ++ grub_be_to_cpu32 (kernel_dump.format)); ++ return 0; ++ } ++ ++ if (grub_be_to_cpu16 (kernel_dump.num_sections) > MAX_KD_SECTIONS) ++ { ++ grub_printf (_("Error: Too many kernel dump sections: %d\n"), ++ grub_be_to_cpu32 (kernel_dump.num_sections)); ++ return 0; ++ } ++ ++ for (i = 0; i < grub_be_to_cpu16 (kernel_dump.num_sections); i++) ++ { ++ kds = (struct kd_section *) ((grub_addr_t) &kernel_dump + ++ grub_be_to_cpu32 (kernel_dump.offset_1st_section) + ++ i * sizeof (struct kd_section)); ++ /* sanity check the address is within the 'kernel_dump' struct */ ++ if ((grub_addr_t) kds > (grub_addr_t) &kernel_dump + kernel_dump_size + sizeof (*kds)) ++ { ++ grub_printf (_("Error: 'kds' address beyond last available section\n")); ++ return 0; ++ } ++ ++ if ((grub_be_to_cpu16 (kds->src_datatype) == KD_SRC_DATATYPE_REAL_MODE_REGION) && ++ (grub_be_to_cpu64 (kds->src_address) == 0)) ++ { ++ *highest = grub_min (*highest, grub_be_to_cpu64 (kds->num_bytes)); ++ break; ++ } ++ } ++ ++ return 1; ++} ++ + /* Helper for grub_claim_heap on powerpc. */ + static int + heap_size (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type, +@@ -207,7 +300,9 @@ static int + heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type, + void *data) + { ++ grub_uint64_t upper_mem_limit = ~0; + grub_uint32_t total = *(grub_uint32_t *)data; ++ int has_kernel_dump; + + if (type != GRUB_MEMORY_AVAILABLE) + return 0; +@@ -243,6 +338,50 @@ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type, + len = 0; + } + ++ has_kernel_dump = check_kernel_dump (&upper_mem_limit); ++ if (has_kernel_dump) ++ { ++ grub_uint64_t lo_len = 0, hi_len = 0; ++ ++ if (addr > upper_mem_limit || upper_mem_limit == (grub_uint64_t)~0) ++ return 0; ++ ++ /* limit len to stay below upper_mem_limit */ ++ if (addr < upper_mem_limit && (addr + len) > upper_mem_limit) ++ { ++ len = grub_min (len, upper_mem_limit - addr); ++ } ++ ++ /* We can allocate below 640MB or above 768MB. ++ * Choose the bigger chunk below 640MB or above 768MB. ++ */ ++ if (addr < 0x28000000) ++ { ++ lo_len = grub_min (len, 0x28000000 - addr); ++ } ++ if (addr + len > 0x30000000) ++ { ++ if (addr < 0x30000000) ++ hi_len = len - (0x30000000 - addr); ++ else ++ hi_len = len; ++ } ++ ++ if (hi_len > lo_len) ++ { ++ len = hi_len; ++ if (addr < 0x30000000) ++ addr = 0x30000000; ++ } ++ else ++ { ++ len = lo_len; ++ } ++ ++ if (len == 0) ++ return 0; ++ } ++ + /* If this block contains 0x30000000 (768MB), do not claim below that. + Linux likes to claim memory at min(RMO top, 768MB) and works down + without reference to /memory/available. */ diff --git a/SOURCES/0581-util-Enable-default-kernel-for-updates.patch b/SOURCES/0581-util-Enable-default-kernel-for-updates.patch new file mode 100644 index 0000000..64c5def --- /dev/null +++ b/SOURCES/0581-util-Enable-default-kernel-for-updates.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 24 May 2023 11:22:47 +0200 +Subject: [PATCH] util: Enable default kernel for updates + +Several kernel variants can be installed on a system in parallel. +In order to allow the user to choose which kernel will be set to +default after an update, re-enable grub's usage of DEFAULTKERNEL as +set in /etc/sysconfig/kernel + +Signed-off-by: Nicolas Frayer +--- + util/grub-get-kernel-settings.in | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/util/grub-get-kernel-settings.in b/util/grub-get-kernel-settings.in +index 7e87dfccc0e4..f71bc64360b0 100644 +--- a/util/grub-get-kernel-settings.in ++++ b/util/grub-get-kernel-settings.in +@@ -68,6 +68,14 @@ if test -f /etc/sysconfig/kernel ; then + . /etc/sysconfig/kernel + fi + ++GRUB_DEFAULT_KERNEL_TYPE=${DEFAULTKERNEL/-core/} ++if [ "$GRUB_DEFAULT_KERNEL_TYPE" != "kernel" ]; then ++ echo GRUB_NON_STANDARD_KERNEL=true ++ echo export GRUB_NON_STANDARD_KERNEL ++ GRUB_DEFAULT_KERNEL_TYPE=${GRUB_DEFAULT_KERNEL_TYPE/kernel-/} ++fi ++echo GRUB_DEFAULT_KERNEL_TYPE=$GRUB_DEFAULT_KERNEL_TYPE ++echo export GRUB_DEFAULT_KERNEL_TYPE + if [ "$MAKEDEBUG" = "yes" ]; then + echo GRUB_LINUX_MAKE_DEBUG=true + echo export GRUB_LINUX_MAKE_DEBUG diff --git a/SOURCES/0582-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch b/SOURCES/0582-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch new file mode 100644 index 0000000..ca9d396 --- /dev/null +++ b/SOURCES/0582-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch @@ -0,0 +1,150 @@ +From 9ca4c3fe1c7dbd62e8ad6a23cb1b1fda695fdb44 Mon Sep 17 00:00:00 2001 +From: Solar Designer +Date: Tue, 6 Feb 2024 21:39:41 +0100 +Subject: [PATCH 1/3] grub-set-bootflag: Conservative partial fix for + CVE-2024-1048 + +Following up on CVE-2019-14865 and taking a fresh look at +grub2-set-bootflag now (through my work at CIQ on Rocky Linux), I saw some +other ways in which users could still abuse this little program: + +1. After CVE-2019-14865 fix, grub2-set-bootflag no longer rewrites the +grubenv file in-place, but writes into a temporary file and renames it +over the original, checking for error returns from each call first. +This prevents the original file truncation vulnerability, but it can +leave the temporary file around if the program is killed before it can +rename or remove the file. There are still many ways to get the program +killed, such as through RLIMIT_FSIZE triggering SIGXFSZ (tested, +reliable) or by careful timing (tricky) of signals sent by process group +leader, pty, pre-scheduled timers, SIGXCPU (probably not an exhaustive +list). Invoking the program multiple times fills up /boot (or if /boot +is not separate, then it can fill up the root filesystem). Since the +files are tiny, the filesystem is likely to run out of free inodes +before it'd run out of blocks, but the effect is similar - can't create +new files after this point (but still can add data to existing files, +such as logs). + +2. After CVE-2019-14865 fix, grub2-set-bootflag naively tries to protect +itself from signals by becoming full root. (This does protect it from +signals sent by the user directly to the PID, but e.g. "kill -9 -1" by +the user still works.) A side effect of such "protection" is that it's +possible to invoke more concurrent instances of grub2-set-bootflag than +the user's RLIMIT_NPROC would normally permit (as specified e.g. in +/etc/security/limits.conf, or say in Apache httpd's RLimitNPROC if +grub2-set-bootflag would be abused by a website script), thereby +exhausting system resources (e.g., bypassing RAM usage limit if +RLIMIT_AS was also set). + +3. umask is inherited. Again, due to how the CVE-2019-14865 fix creates +a new file, and due to how mkstemp() works, this affects grubenv's new +file permissions. Luckily, mkstemp() forces them to be no more relaxed +than 0600, but the user ends up being able to set them e.g. to 0. +Luckily, at least in my testing GRUB still works fine even when the file +has such (lack of) permissions. + +This commit deals with the abuses above as follows: + +1. RLIMIT_FSIZE is pre-checked, so this specific way to get the process +killed should no longer work. However, this isn't a complete fix +because there are other ways to get the process killed after it has +created the temporary file. + +The commit also fixes bug 1975892 ("RFE: grub2-set-bootflag should not +write the grubenv when the flag being written is already set") and +similar for "menu_show_once", which further reduces the abuse potential. + +2. RLIMIT_NPROC bypass should be avoided by not becoming full root (aka +dropping the partial "kill protection"). + +3. A safe umask is set. + +This is a partial fix (temporary files can still accumulate, but this is +harder to trigger). + +While at it, this commit also fixes potential 1- or 2-byte over-read of +env[] if its content is malformed - this was not a security issue since the +grubenv file is trusted input, and the fix is just for robustness. + +Signed-off-by: Solar Designer +--- + util/grub-set-bootflag.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index a85f11fceacb..5b932f76b6f4 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -32,6 +32,8 @@ + #include + #include + #include ++#include ++#include + + #define GRUBENV "/" GRUB_BOOT_DIR_NAME "/" GRUB_DIR_NAME "/" GRUB_ENVBLK_DEFCFG + #define GRUBENV_SIZE 1024 +@@ -54,12 +56,17 @@ static void usage(void) + int main(int argc, char *argv[]) + { + /* NOTE buf must be at least the longest bootflag length + 4 bytes */ +- char env[GRUBENV_SIZE + 1], buf[64], *s; ++ char env[GRUBENV_SIZE + 1 + 2], buf[64], *s; + /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */ + char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1]; + const char *bootflag; + int i, fd, len, ret; + FILE *f; ++ struct rlimit rlim; ++ ++ if (getrlimit(RLIMIT_FSIZE, &rlim) || rlim.rlim_cur < GRUBENV_SIZE || rlim.rlim_max < GRUBENV_SIZE) ++ return 1; ++ umask(077); + + if (argc != 2) + { +@@ -81,20 +88,11 @@ int main(int argc, char *argv[]) + len = strlen (bootflag); + + /* +- * Really become root. setuid avoids an user killing us, possibly leaking +- * the tmpfile. setgid avoids the new grubenv's gid being that of the user. ++ * setegid avoids the new grubenv's gid being that of the user. + */ +- ret = setuid(0); +- if (ret) +- { +- perror ("Error setuid(0) failed"); +- return 1; +- } +- +- ret = setgid(0); +- if (ret) ++ if (setegid(0)) + { +- perror ("Error setgid(0) failed"); ++ perror ("Error setegid(0) failed"); + return 1; + } + +@@ -123,6 +121,9 @@ int main(int argc, char *argv[]) + + /* 0 terminate env */ + env[GRUBENV_SIZE] = 0; ++ /* not a valid flag value */ ++ env[GRUBENV_SIZE + 1] = 0; ++ env[GRUBENV_SIZE + 2] = 0; + + if (strncmp (env, GRUB_ENVBLK_SIGNATURE, strlen (GRUB_ENVBLK_SIGNATURE))) + { +@@ -158,6 +159,8 @@ int main(int argc, char *argv[]) + + /* The grubenv is not 0 terminated, so memcpy the name + '=' , '1', '\n' */ + snprintf(buf, sizeof(buf), "%s=1\n", bootflag); ++ if (!memcmp(s, buf, len + 3)) ++ return 0; /* nothing to do */ + memcpy(s, buf, len + 3); + + +-- +2.43.0 + diff --git a/SOURCES/0583-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch b/SOURCES/0583-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch new file mode 100644 index 0000000..a7416c1 --- /dev/null +++ b/SOURCES/0583-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch @@ -0,0 +1,187 @@ +From f4c7783c2b695794938748a6567e86456ed2314a Mon Sep 17 00:00:00 2001 +From: Solar Designer +Date: Tue, 6 Feb 2024 21:56:21 +0100 +Subject: [PATCH 2/3] grub-set-bootflag: More complete fix for CVE-2024-1048 + +Switch to per-user fixed temporary filenames along with a weird locking +mechanism, which is explained in source code comments. This is a more +complete fix than the previous commit (temporary files can't accumulate). +Unfortunately, it introduces new risks (by working on a temporary file +shared between the user's invocations), which are _hopefully_ avoided by +the patch's elaborate logic. I actually got it wrong at first, which +suggests that this logic is hard to reason about, and more errors or +omissions are possible. It also relies on the kernel's primitives' exact +semantics to a greater extent (nothing out of the ordinary, though). + +Remaining issues that I think cannot reasonably be fixed without a +redesign (e.g., having per-flag files with nothing else in them) and +without introducing new issues: + +A. A user can still revert a concurrent user's attempt of setting the +other flag - or of making other changes to grubenv by means other than +this program. + +B. One leftover temporary file per user is still possible. + +Signed-off-by: Solar Designer +--- + util/grub-set-bootflag.c | 87 ++++++++++++++++++++++++++++++++++------ + 1 file changed, 75 insertions(+), 12 deletions(-) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 5b932f76b6f4..698b55a1ab93 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -57,15 +58,12 @@ int main(int argc, char *argv[]) + { + /* NOTE buf must be at least the longest bootflag length + 4 bytes */ + char env[GRUBENV_SIZE + 1 + 2], buf[64], *s; +- /* +1 for 0 termination, +6 for "XXXXXX" in tmp filename */ +- char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 6 + 1]; ++ /* +1 for 0 termination, +11 for ".%u" in tmp filename */ ++ char env_filename[PATH_MAX + 1], tmp_filename[PATH_MAX + 11 + 1]; + const char *bootflag; + int i, fd, len, ret; + FILE *f; +- struct rlimit rlim; + +- if (getrlimit(RLIMIT_FSIZE, &rlim) || rlim.rlim_cur < GRUBENV_SIZE || rlim.rlim_max < GRUBENV_SIZE) +- return 1; + umask(077); + + if (argc != 2) +@@ -92,7 +90,7 @@ int main(int argc, char *argv[]) + */ + if (setegid(0)) + { +- perror ("Error setegid(0) failed"); ++ perror ("setegid(0) failed"); + return 1; + } + +@@ -163,19 +161,82 @@ int main(int argc, char *argv[]) + return 0; /* nothing to do */ + memcpy(s, buf, len + 3); + ++ struct rlimit rlim; ++ if (getrlimit(RLIMIT_FSIZE, &rlim) || rlim.rlim_cur < GRUBENV_SIZE || rlim.rlim_max < GRUBENV_SIZE) ++ { ++ fprintf (stderr, "Resource limits undetermined or too low\n"); ++ return 1; ++ } ++ ++ /* ++ * Here we work under the premise that we shouldn't write into the target ++ * file directly because we might not be able to have all of our changes ++ * written completely and atomically. That was CVE-2019-14865, known to ++ * have been triggerable via RLIMIT_FSIZE. While we've dealt with that ++ * specific attack via the check above, there may be other possibilities. ++ */ + + /* + * Create a tempfile for writing the new env. Use the canonicalized filename + * for the template so that the tmpfile is in the same dir / on same fs. ++ * ++ * We now use per-user fixed temporary filenames, so that a user cannot cause ++ * multiple files to accumulate. ++ * ++ * We don't use O_EXCL so that a stale temporary file doesn't prevent further ++ * usage of the program by the user. + */ +- snprintf(tmp_filename, sizeof(tmp_filename), "%sXXXXXX", env_filename); +- fd = mkstemp(tmp_filename); ++ snprintf(tmp_filename, sizeof(tmp_filename), "%s.%u", env_filename, getuid()); ++ fd = open(tmp_filename, O_CREAT | O_WRONLY, 0600); + if (fd == -1) + { + perror ("Creating tmpfile failed"); + return 1; + } + ++ /* ++ * The lock prevents the same user from reaching further steps ending in ++ * rename() concurrently, in which case the temporary file only partially ++ * written by one invocation could be renamed to the target file by another. ++ * ++ * The lock also guards the slow fsync() from concurrent calls. After the ++ * first time that and the rename() complete, further invocations for the ++ * same flag become no-ops. ++ * ++ * We lock the temporary file rather than the target file because locking the ++ * latter would allow any user having SIGSTOP'ed their process to make all ++ * other users' invocations fail (or lock up if we'd use blocking mode). ++ * ++ * We use non-blocking mode (LOCK_NB) because the lock having been taken by ++ * another process implies that the other process would normally have already ++ * renamed the file to target by the time it releases the lock (and we could ++ * acquire it), so we'd be working directly on the target if we proceeded, ++ * which is undesirable, and we'd kind of fail on the already-done rename. ++ */ ++ if (flock(fd, LOCK_EX | LOCK_NB)) ++ { ++ perror ("Locking tmpfile failed"); ++ return 1; ++ } ++ ++ /* ++ * Deal with the potential that another invocation proceeded all the way to ++ * rename() and process exit while we were between open() and flock(). ++ */ ++ { ++ struct stat st1, st2; ++ if (fstat(fd, &st1) || stat(tmp_filename, &st2)) ++ { ++ perror ("stat of tmpfile failed"); ++ return 1; ++ } ++ if (st1.st_dev != st2.st_dev || st1.st_ino != st2.st_ino) ++ { ++ fprintf (stderr, "Another invocation won race\n"); ++ return 1; ++ } ++ } ++ + f = fdopen (fd, "w"); + if (!f) + { +@@ -200,23 +261,25 @@ int main(int argc, char *argv[]) + return 1; + } + +- ret = fsync (fileno (f)); ++ ret = ftruncate (fileno (f), GRUBENV_SIZE); + if (ret) + { +- perror ("Error syncing tmpfile"); ++ perror ("Error truncating tmpfile"); + unlink(tmp_filename); + return 1; + } + +- ret = fclose (f); ++ ret = fsync (fileno (f)); + if (ret) + { +- perror ("Error closing tmpfile"); ++ perror ("Error syncing tmpfile"); + unlink(tmp_filename); + return 1; + } + + /* ++ * We must not close the file before rename() as that would remove the lock. ++ * + * And finally rename the tmpfile with the new env over the old env, the + * linux kernel guarantees that this is atomic (from a syscall pov). + */ +-- +2.43.0 + diff --git a/SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch b/SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch new file mode 100644 index 0000000..3e13dfc --- /dev/null +++ b/SOURCES/0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch @@ -0,0 +1,39 @@ +From a7192a650c1e94221a86b49f5132fb47a4dda6ea Mon Sep 17 00:00:00 2001 +From: Solar Designer +Date: Tue, 6 Feb 2024 22:05:45 +0100 +Subject: [PATCH 3/3] grub-set-bootflag: Exit calmly when not running as root + +Exit calmly when not installed SUID root and invoked by non-root. This +allows installing user/grub-boot-success.service unconditionally while +supporting non-SUID installation of the program for some limited usage. + +Signed-off-by: Solar Designer +--- + util/grub-set-bootflag.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/util/grub-set-bootflag.c b/util/grub-set-bootflag.c +index 698b55a1ab93..a51805fa8cec 100644 +--- a/util/grub-set-bootflag.c ++++ b/util/grub-set-bootflag.c +@@ -85,6 +85,17 @@ int main(int argc, char *argv[]) + bootflag = bootflags[i]; + len = strlen (bootflag); + ++ /* ++ * Exit calmly when not installed SUID root and invoked by non-root. This ++ * allows installing user/grub-boot-success.service unconditionally while ++ * supporting non-SUID installation of the program for some limited usage. ++ */ ++ if (geteuid()) ++ { ++ printf ("grub-set-bootflag not running as root, no action taken\n"); ++ return 0; ++ } ++ + /* + * setegid avoids the new grubenv's gid being that of the user. + */ +-- +2.43.0 + diff --git a/SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch b/SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch new file mode 100644 index 0000000..8234f67 --- /dev/null +++ b/SOURCES/0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch @@ -0,0 +1,93 @@ +From 43651027d24e62a7a463254165e1e46e42aecdea Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:31:57 +0300 +Subject: [PATCH 1/6] fs/ntfs: Fix an OOB write when parsing the + $ATTRIBUTE_LIST attribute for the $MFT file + +When parsing an extremely fragmented $MFT file, i.e., the file described +using the $ATTRIBUTE_LIST attribute, current NTFS code will reuse a buffer +containing bytes read from the underlying drive to store sector numbers, +which are consumed later to read data from these sectors into another buffer. + +These sectors numbers, two 32-bit integers, are always stored at predefined +offsets, 0x10 and 0x14, relative to first byte of the selected entry within +the $ATTRIBUTE_LIST attribute. Usually, this won't cause any problem. + +However, when parsing a specially-crafted file system image, this may cause +the NTFS code to write these integers beyond the buffer boundary, likely +causing the GRUB memory allocator to misbehave or fail. These integers contain +values which are controlled by on-disk structures of the NTFS file system. + +Such modification and resulting misbehavior may touch a memory range not +assigned to the GRUB and owned by firmware or another EFI application/driver. + +This fix introduces checks to ensure that these sector numbers are never +written beyond the boundary. + +Fixes: CVE-2023-4692 + +Reported-by: Maxim Suhanov +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index bbdbe24ada83..c3c4db117bba 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -184,7 +184,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + } + if (at->attr_end) + { +- grub_uint8_t *pa; ++ grub_uint8_t *pa, *pa_end; + + at->emft_buf = grub_malloc (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + if (at->emft_buf == NULL) +@@ -209,11 +209,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + } + at->attr_nxt = at->edat_buf; + at->attr_end = at->edat_buf + u32at (pa, 0x30); ++ pa_end = at->edat_buf + n; + } + else + { + at->attr_nxt = at->attr_end + u16at (pa, 0x14); + at->attr_end = at->attr_end + u32at (pa, 4); ++ pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } + at->flags |= GRUB_NTFS_AF_ALST; + while (at->attr_nxt < at->attr_end) +@@ -230,6 +232,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + at->flags |= GRUB_NTFS_AF_GPOS; + at->attr_cur = at->attr_nxt; + pa = at->attr_cur; ++ ++ if ((pa >= pa_end) || (pa_end - pa < 0x18)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse attribute list"); ++ return NULL; ++ } ++ + grub_set_unaligned32 ((char *) pa + 0x10, + grub_cpu_to_le32 (at->mft->data->mft_start)); + grub_set_unaligned32 ((char *) pa + 0x14, +@@ -240,6 +249,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + { + if (*pa != attr) + break; ++ ++ if ((pa >= pa_end) || (pa_end - pa < 0x18)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse attribute list"); ++ return NULL; ++ } ++ + if (read_attr + (at, pa + 0x10, + u32at (pa, 0x10) * (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), +-- +2.43.0 + diff --git a/SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch b/SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch new file mode 100644 index 0000000..a90e077 --- /dev/null +++ b/SOURCES/0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch @@ -0,0 +1,58 @@ +From 0ed2458cc4eff6d9a9199527e2a0b6d445802f94 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:32:33 +0300 +Subject: [PATCH 2/6] fs/ntfs: Fix an OOB read when reading data from the + resident $DATA attribute + +When reading a file containing resident data, i.e., the file data is stored in +the $DATA attribute within the NTFS file record, not in external clusters, +there are no checks that this resident data actually fits the corresponding +file record segment. + +When parsing a specially-crafted file system image, the current NTFS code will +read the file data from an arbitrary, attacker-chosen memory offset and of +arbitrary, attacker-chosen length. + +This allows an attacker to display arbitrary chunks of memory, which could +contain sensitive information like password hashes or even plain-text, +obfuscated passwords from BS EFI variables. + +This fix implements a check to ensure that resident data is read from the +corresponding file record segment only. + +Fixes: CVE-2023-4693 + +Reported-by: Maxim Suhanov +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index c3c4db117bba..a68e173d8285 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -401,7 +401,18 @@ read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, grub_uint8_t *dest, + { + if (ofs + len > u32at (pa, 0x10)) + return grub_error (GRUB_ERR_BAD_FS, "read out of range"); +- grub_memcpy (dest, pa + u32at (pa, 0x14) + ofs, len); ++ ++ if (u32at (pa, 0x10) > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute too large"); ++ ++ if (pa >= at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); ++ ++ if (u16at (pa, 0x14) + u32at (pa, 0x10) > ++ (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) pa) ++ return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); ++ ++ grub_memcpy (dest, pa + u16at (pa, 0x14) + ofs, len); + return 0; + } + +-- +2.43.0 + diff --git a/SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch b/SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch new file mode 100644 index 0000000..fb3eb31 --- /dev/null +++ b/SOURCES/0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch @@ -0,0 +1,73 @@ +From 7e5f031a6a6a3decc2360a7b0c71abbe598e7354 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:33:17 +0300 +Subject: [PATCH 3/6] fs/ntfs: Fix an OOB read when parsing directory entries + from resident and non-resident index attributes + +This fix introduces checks to ensure that index entries are never read +beyond the corresponding directory index. + +The lack of this check is a minor issue, likely not exploitable in any way. + +Reported-by: Maxim Suhanov +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index a68e173d8285..2d78b96e19fb 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -599,7 +599,7 @@ get_utf8 (grub_uint8_t *in, grub_size_t len) + } + + static int +-list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos, ++list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos, grub_uint8_t *end_pos, + grub_fshelp_iterate_dir_hook_t hook, void *hook_data) + { + grub_uint8_t *np; +@@ -610,6 +610,9 @@ list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos, + grub_uint8_t namespace; + char *ustr; + ++ if ((pos >= end_pos) || (end_pos - pos < 0x52)) ++ break; ++ + if (pos[0xC] & 2) /* end signature */ + break; + +@@ -617,6 +620,9 @@ list_file (struct grub_ntfs_file *diro, grub_uint8_t *pos, + ns = *(np++); + namespace = *(np++); + ++ if (2 * ns > end_pos - pos - 0x52) ++ break; ++ + /* + * Ignore files in DOS namespace, as they will reappear as Win32 + * names. +@@ -806,7 +812,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + } + + cur_pos += 0x10; /* Skip index root */ +- ret = list_file (mft, cur_pos + u16at (cur_pos, 0), hook, hook_data); ++ ret = list_file (mft, cur_pos + u16at (cur_pos, 0), ++ at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), ++ hook, hook_data); + if (ret) + goto done; + +@@ -893,6 +901,7 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + (const grub_uint8_t *) "INDX"))) + goto done; + ret = list_file (mft, &indx[0x18 + u16at (indx, 0x18)], ++ indx + (mft->data->idx_size << GRUB_NTFS_BLK_SHR), + hook, hook_data); + if (ret) + goto done; +-- +2.43.0 + diff --git a/SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch b/SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch new file mode 100644 index 0000000..c121cf3 --- /dev/null +++ b/SOURCES/0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch @@ -0,0 +1,51 @@ +From 7a5a116739fa6d8a625da7d6b9272c9a2462f967 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:33:44 +0300 +Subject: [PATCH 4/6] fs/ntfs: Fix an OOB read when parsing bitmaps for index + attributes + +This fix introduces checks to ensure that bitmaps for directory indices +are never read beyond their actual sizes. + +The lack of this check is a minor issue, likely not exploitable in any way. + +Reported-by: Maxim Suhanov +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 2d78b96e19fb..bb70c89fb803 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -843,6 +843,25 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + + if (is_resident) + { ++ if (bitmap_len > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "resident bitmap too large"); ++ goto done; ++ } ++ ++ if (cur_pos >= at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "resident bitmap out of range"); ++ goto done; ++ } ++ ++ if (u16at (cur_pos, 0x14) + u32at (cur_pos, 0x10) > ++ (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) cur_pos) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "resident bitmap out of range"); ++ goto done; ++ } ++ + grub_memcpy (bmp, cur_pos + u16at (cur_pos, 0x14), + bitmap_len); + } +-- +2.43.0 + diff --git a/SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch b/SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch new file mode 100644 index 0000000..efeb21d --- /dev/null +++ b/SOURCES/0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch @@ -0,0 +1,61 @@ +From 1fe82c41e070385e273d7bb1cfb482627a3c28e8 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:38:19 +0300 +Subject: [PATCH 5/6] fs/ntfs: Fix an OOB read when parsing a volume label + +This fix introduces checks to ensure that an NTFS volume label is always +read from the corresponding file record segment. + +The current NTFS code allows the volume label string to be read from an +arbitrary, attacker-chosen memory location. However, the bytes read are +always treated as UTF-16LE. So, the final string displayed is mostly +unreadable and it can't be easily converted back to raw bytes. + +The lack of this check is a minor issue, likely not causing a significant +data leak. + +Reported-by: Maxim Suhanov +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index bb70c89fb803..ff5e3740f0dd 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -1213,13 +1213,29 @@ grub_ntfs_label (grub_device_t device, char **label) + + init_attr (&mft->attr, mft); + pa = find_attr (&mft->attr, GRUB_NTFS_AT_VOLUME_NAME); ++ ++ if (pa >= mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse volume label"); ++ goto fail; ++ } ++ ++ if (mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR) - pa < 0x16) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse volume label"); ++ goto fail; ++ } ++ + if ((pa) && (pa[8] == 0) && (u32at (pa, 0x10))) + { + int len; + + len = u32at (pa, 0x10) / 2; + pa += u16at (pa, 0x14); +- *label = get_utf8 (pa, len); ++ if (mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR) - pa >= 2 * len) ++ *label = get_utf8 (pa, len); ++ else ++ grub_error (GRUB_ERR_BAD_FS, "can\'t parse volume label"); + } + + fail: +-- +2.43.0 + diff --git a/SOURCES/0590-fs-ntfs-Make-code-more-readable.patch b/SOURCES/0590-fs-ntfs-Make-code-more-readable.patch new file mode 100644 index 0000000..2f00384 --- /dev/null +++ b/SOURCES/0590-fs-ntfs-Make-code-more-readable.patch @@ -0,0 +1,159 @@ +From e58b870ff926415e23fc386af41ff81b2f588763 Mon Sep 17 00:00:00 2001 +From: Maxim Suhanov +Date: Mon, 28 Aug 2023 16:40:07 +0300 +Subject: [PATCH 6/6] fs/ntfs: Make code more readable + +Move some calls used to access NTFS attribute header fields into +functions with human-readable names. + +Suggested-by: Daniel Kiper +Signed-off-by: Maxim Suhanov +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 48 +++++++++++++++++++++++++++++++-------------- + 1 file changed, 33 insertions(+), 15 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index ff5e3740f0dd..de435aa14d85 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -52,6 +52,24 @@ u64at (void *ptr, grub_size_t ofs) + return grub_le_to_cpu64 (grub_get_unaligned64 ((char *) ptr + ofs)); + } + ++static grub_uint16_t ++first_attr_off (void *mft_buf_ptr) ++{ ++ return u16at (mft_buf_ptr, 0x14); ++} ++ ++static grub_uint16_t ++res_attr_data_off (void *res_attr_ptr) ++{ ++ return u16at (res_attr_ptr, 0x14); ++} ++ ++static grub_uint32_t ++res_attr_data_len (void *res_attr_ptr) ++{ ++ return u32at (res_attr_ptr, 0x10); ++} ++ + grub_ntfscomp_func_t grub_ntfscomp_func; + + static grub_err_t +@@ -106,7 +124,7 @@ init_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft) + { + at->mft = mft; + at->flags = (mft == &mft->data->mmft) ? GRUB_NTFS_AF_MMFT : 0; +- at->attr_nxt = mft->buf + u16at (mft->buf, 0x14); ++ at->attr_nxt = mft->buf + first_attr_off (mft->buf); + at->attr_end = at->emft_buf = at->edat_buf = at->sbuf = NULL; + } + +@@ -154,7 +172,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + +- new_pos = &at->emft_buf[u16at (at->emft_buf, 0x14)]; ++ new_pos = &at->emft_buf[first_attr_off (at->emft_buf)]; + while (*new_pos != 0xFF) + { + if ((*new_pos == *at->attr_cur) +@@ -213,7 +231,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + } + else + { +- at->attr_nxt = at->attr_end + u16at (pa, 0x14); ++ at->attr_nxt = at->attr_end + res_attr_data_off (pa); + at->attr_end = at->attr_end + u32at (pa, 4); + pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } +@@ -399,20 +417,20 @@ read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, grub_uint8_t *dest, + + if (pa[8] == 0) + { +- if (ofs + len > u32at (pa, 0x10)) ++ if (ofs + len > res_attr_data_len (pa)) + return grub_error (GRUB_ERR_BAD_FS, "read out of range"); + +- if (u32at (pa, 0x10) > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) ++ if (res_attr_data_len (pa) > (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) + return grub_error (GRUB_ERR_BAD_FS, "resident attribute too large"); + + if (pa >= at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR)) + return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); + +- if (u16at (pa, 0x14) + u32at (pa, 0x10) > ++ if (res_attr_data_off (pa) + res_attr_data_len (pa) > + (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) pa) + return grub_error (GRUB_ERR_BAD_FS, "resident attribute out of range"); + +- grub_memcpy (dest, pa + u16at (pa, 0x14) + ofs, len); ++ grub_memcpy (dest, pa + res_attr_data_off (pa) + ofs, len); + return 0; + } + +@@ -556,7 +574,7 @@ init_file (struct grub_ntfs_file *mft, grub_uint64_t mftno) + (unsigned long long) mftno); + + if (!pa[8]) +- mft->size = u32at (pa, 0x10); ++ mft->size = res_attr_data_len (pa); + else + mft->size = u64at (pa, 0x30); + +@@ -805,7 +823,7 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + (u32at (cur_pos, 0x18) != 0x490024) || + (u32at (cur_pos, 0x1C) != 0x300033)) + continue; +- cur_pos += u16at (cur_pos, 0x14); ++ cur_pos += res_attr_data_off (cur_pos); + if (*cur_pos != 0x30) /* Not filename index */ + continue; + break; +@@ -834,7 +852,7 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + { + int is_resident = (cur_pos[8] == 0); + +- bitmap_len = ((is_resident) ? u32at (cur_pos, 0x10) : ++ bitmap_len = ((is_resident) ? res_attr_data_len (cur_pos) : + u32at (cur_pos, 0x28)); + + bmp = grub_malloc (bitmap_len); +@@ -855,14 +873,14 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + goto done; + } + +- if (u16at (cur_pos, 0x14) + u32at (cur_pos, 0x10) > ++ if (res_attr_data_off (cur_pos) + res_attr_data_len (cur_pos) > + (grub_addr_t) at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR) - (grub_addr_t) cur_pos) + { + grub_error (GRUB_ERR_BAD_FS, "resident bitmap out of range"); + goto done; + } + +- grub_memcpy (bmp, cur_pos + u16at (cur_pos, 0x14), ++ grub_memcpy (bmp, cur_pos + res_attr_data_off (cur_pos), + bitmap_len); + } + else +@@ -1226,12 +1244,12 @@ grub_ntfs_label (grub_device_t device, char **label) + goto fail; + } + +- if ((pa) && (pa[8] == 0) && (u32at (pa, 0x10))) ++ if ((pa) && (pa[8] == 0) && (res_attr_data_len (pa))) + { + int len; + +- len = u32at (pa, 0x10) / 2; +- pa += u16at (pa, 0x14); ++ len = res_attr_data_len (pa) / 2; ++ pa += res_attr_data_off (pa); + if (mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR) - pa >= 2 * len) + *label = get_utf8 (pa, len); + else +-- +2.43.0 + diff --git a/SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch b/SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch new file mode 100644 index 0000000..8c7d4cf --- /dev/null +++ b/SOURCES/0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Thu, 19 Sep 2024 10:15:13 -0600 +Subject: [PATCH] grub-mkconfig.in: turn off executable owner bit + +Stricker permissions are required on the grub.cfg file, resulting in +at most 0600 owner's file permissions. This resolves conflicting +requirement permissions on grub2-pc package's grub2.cfg file. + +Signed-off-by: Leo Sandoval +--- + util/grub-mkconfig.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in +index a1c00776d..573004915 100644 +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -317,7 +317,7 @@ and /etc/grub.d/* files or please file a bug report with + exit 1 + else + # none of the children aborted with error, install the new grub.cfg +- oldumask=$(umask); umask 077 ++ oldumask=$(umask); umask 177 + cat ${grub_cfg}.new > ${grub_cfg} + umask $oldumask + rm -f ${grub_cfg}.new diff --git a/SOURCES/0592-misc-Implement-grub_strlcpy.patch b/SOURCES/0592-misc-Implement-grub_strlcpy.patch new file mode 100644 index 0000000..5a216fd --- /dev/null +++ b/SOURCES/0592-misc-Implement-grub_strlcpy.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 15 Jun 2024 02:33:08 +0100 +Subject: [PATCH] misc: Implement grub_strlcpy() + +grub_strlcpy() acts the same way as strlcpy() does on most *NIX, +returning the length of src and ensuring dest is always NUL +terminated except when size is 0. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 1b722c818..88fc2a6b0 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -72,6 +72,45 @@ grub_stpcpy (char *dest, const char *src) + return d - 1; + } + ++static inline grub_size_t ++grub_strlcpy (char *dest, const char *src, grub_size_t size) ++{ ++ char *d = dest; ++ grub_size_t res = 0; ++ /* ++ * We do not subtract one from size here to avoid dealing with underflowing ++ * the value, which is why to_copy is always checked to be greater than one ++ * throughout this function. ++ */ ++ grub_size_t to_copy = size; ++ ++ /* Copy size - 1 bytes to dest. */ ++ if (to_copy > 1) ++ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1) ++ ; ++ ++ /* ++ * NUL terminate if size != 0. The previous step may have copied a NUL byte ++ * if it reached the end of the string, but we know dest[size - 1] must always ++ * be a NUL byte. ++ */ ++ if (size != 0) ++ dest[size - 1] = '\0'; ++ ++ /* If there is still space in dest, but are here, we reached the end of src. */ ++ if (to_copy > 1) ++ return res; ++ ++ /* ++ * If we haven't reached the end of the string, iterate through to determine ++ * the strings total length. ++ */ ++ while (*src++ != '\0' && ++res) ++ ; ++ ++ return res; ++} ++ + /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */ + static inline void * + grub_memcpy (void *dest, const void *src, grub_size_t n) diff --git a/SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch b/SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch new file mode 100644 index 0000000..1785034 --- /dev/null +++ b/SOURCES/0593-fs-ufs-Fix-a-heap-OOB-write.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:03:33 +0100 +Subject: [PATCH] fs/ufs: Fix a heap OOB write + +grub_strcpy() was used to copy a symlink name from the filesystem +image to a heap allocated buffer. This led to a OOB write to adjacent +heap allocations. Fix by using grub_strlcpy(). + +Fixes: CVE-2024-45781 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ufs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index 293f027aa..0c2004fd7 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino) + /* Check against zero is paylindromic, no need to swap. */ + if (data->inode.nblocks == 0 + && INODE_SIZE (data) <= sizeof (data->inode.symlink)) +- grub_strcpy (symlink, (char *) data->inode.symlink); ++ grub_strlcpy (symlink, (char *) data->inode.symlink, sz); + else + { + if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0) diff --git a/SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch b/SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch new file mode 100644 index 0000000..581f754 --- /dev/null +++ b/SOURCES/0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:48:33 +0100 +Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy() + +Replaced with grub_strlcpy(). + +Fixes: CVE-2024-45782 +Fixes: CVE-2024-56737 +Fixes: https://savannah.gnu.org/bugs/?66599 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 49d1831c8..44859fe43 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32_compile_time (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str)); + + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, + 0, (char *) &dir, sizeof (dir)) == 0) diff --git a/SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch b/SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch new file mode 100644 index 0000000..abaa43c --- /dev/null +++ b/SOURCES/0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:47:54 +0100 +Subject: [PATCH] fs/tar: Initialize name in grub_cpio_find_file() + +It was possible to iterate through grub_cpio_find_file() without +allocating name and not setting mode to GRUB_ARCHELP_ATTR_END, which +would cause the uninitialized value for name to be used as an argument +for canonicalize() in grub_archelp_dir(). + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/tar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 4864451e1..f1e6571c2 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -78,6 +78,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + int reread = 0, have_longname = 0, have_longlink = 0; + + data->hofs = data->next_hofs; ++ *name = NULL; + + for (reread = 0; reread < 3; reread++) + { +@@ -202,6 +203,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + } + return GRUB_ERR_NONE; + } ++ ++ if (*name == NULL) ++ return grub_error (GRUB_ERR_BAD_FS, "invalid tar archive"); ++ + return GRUB_ERR_NONE; + } + diff --git a/SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch b/SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 0000000..02edb94 --- /dev/null +++ b/SOURCES/0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,89 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:58 +0000 +Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write + +Both namesize and linksize are derived from hd.size, a 12-digit octal +number parsed by read_number(). Later direct arithmetic calculation like +"namesize + 1" and "linksize + 1" may exceed the maximum value of +grub_size_t leading to heap OOB write. This patch fixes the issue by +using grub_add() and checking for an overflow. + +Fixes: CVE-2024-45780 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/tar.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index f1e6571c2..28baa5845 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + struct head hd; + int reread = 0, have_longname = 0, have_longlink = 0; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + *name = NULL; +@@ -98,7 +100,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); +- *name = grub_malloc (namesize + 1); ++ ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + err = grub_disk_read (data->disk, 0, +@@ -118,15 +124,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); +- if (data->linkname_alloc < linksize + 1) ++ ++ if (grub_add (linksize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); ++ ++ if (data->linkname_alloc < sz) + { + char *n; +- n = grub_calloc (2, linksize + 1); ++ n = grub_calloc (2, sz); + if (!n) + return grub_errno; + grub_free (data->linkname); + data->linkname = n; +- data->linkname_alloc = 2 * (linksize + 1); ++ data->linkname_alloc = 2 * (sz); + } + + err = grub_disk_read (data->disk, 0, +@@ -149,7 +159,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + while (extra_size < sizeof (hd.prefix) + && hd.prefix[extra_size]) + extra_size++; +- *name = grub_malloc (sizeof (hd.name) + extra_size + 2); ++ ++ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow")); ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + if (hd.prefix[0]) diff --git a/SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch b/SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 0000000..1388f11 --- /dev/null +++ b/SOURCES/0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:15:03 +0100 +Subject: [PATCH] fs/f2fs: Set a grub_errno if mount fails + +It was previously possible for grub_errno to not be set when +grub_f2fs_mount() failed if nat_bitmap_ptr() returned NULL. + +This issue is solved by ensuring a grub_errno is set in the fail case. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/f2fs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index 07ea34196..706e595d3 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -871,6 +871,9 @@ grub_f2fs_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a F2FS filesystem"); ++ + grub_free (data); + + return NULL; diff --git a/SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch b/SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 0000000..7f8c341 --- /dev/null +++ b/SOURCES/0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:22:51 +0100 +Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails + +It was possible for mount to fail but not set grub_errno. This led to +a possible double decrement of the module reference count if the NULL +page was mapped. + +Fixing in general as a similar bug was fixed in commit 61b13c187 +(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there +are likely more variants around. + +Fixes: CVE-2024-45783 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfsplus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index 8c0c80473..2edb1649d 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -392,7 +392,7 @@ grub_hfsplus_mount (grub_disk_t disk) + + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem"); + + grub_free (data); diff --git a/SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch b/SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 0000000..a750c0a --- /dev/null +++ b/SOURCES/0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:37:08 +0100 +Subject: [PATCH] fs/iso9660: Set a grub_errno if mount fails + +It was possible for a grub_errno to not be set if mount of an ISO 9660 +filesystem failed when set_rockridge() returned 0. + +This isn't known to be exploitable as the other filesystems due to +filesystem helper checking the requested file type. Though fixing +as a precaution. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index a4403e29d..736d56770 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -491,6 +491,9 @@ grub_iso9660_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a ISO9660 filesystem"); ++ + grub_free (data); + return 0; + } diff --git a/SOURCES/0600-fs-iso9660-Fix-invalid-free.patch b/SOURCES/0600-fs-iso9660-Fix-invalid-free.patch new file mode 100644 index 0000000..fd223b9 --- /dev/null +++ b/SOURCES/0600-fs-iso9660-Fix-invalid-free.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:42 +0800 +Subject: [PATCH] fs/iso9660: Fix invalid free + +The ctx->filename can point to either a string literal or a dynamically +allocated string. The ctx->filename_alloc field is used to indicate the +type of allocation. + +An issue has been identified where ctx->filename is reassigned to +a string literal in susp_iterate_dir() but ctx->filename_alloc is not +correctly handled. This oversight causes a memory leak and an invalid +free operation later. + +The fix involves checking ctx->filename_alloc, freeing the allocated +string if necessary and clearing ctx->filename_alloc for string literals. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 736d56770..cf17702e2 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -568,9 +568,19 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + filename type is stored. */ + /* FIXME: Fix this slightly improper cast. */ + if (entry->data[0] & GRUB_ISO9660_RR_DOT) +- ctx->filename = (char *) "."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) "."; ++ } + else if (entry->data[0] & GRUB_ISO9660_RR_DOTDOT) +- ctx->filename = (char *) ".."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) ".."; ++ } + else if (entry->len >= 5) + { + grub_size_t off = 0, csize = 1; diff --git a/SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch b/SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch new file mode 100644 index 0000000..f19cf44 --- /dev/null +++ b/SOURCES/0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch @@ -0,0 +1,63 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:59 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read in jfs_getent() + +The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash +was caused by an invalid leaf nodes count, diro->dirpage->header.count, +which was larger than the maximum number of leaf nodes allowed in an +inode. This fix is to ensure that the leaf nodes count is validated in +grub_jfs_opendir() before calling grub_jfs_getent(). + +On the occasion replace existing raw numbers with newly defined constant. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 20d966abf..d4207eb64 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -41,6 +41,12 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_JFS_TREE_LEAF 2 + ++/* ++ * Define max entries stored in-line in an inode. ++ * https://jfs.sourceforge.net/project/pub/jfslayout.pdf ++ */ ++#define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++ + struct grub_jfs_sblock + { + /* The magic for JFS. It should contain the string "JFS1". */ +@@ -203,9 +209,9 @@ struct grub_jfs_inode + grub_uint8_t freecnt; + grub_uint8_t freelist; + grub_uint32_t idotdot; +- grub_uint8_t sorted[8]; ++ grub_uint8_t sorted[GRUB_JFS_INODE_INLINE_ENTRIES]; + } header; +- struct grub_jfs_leaf_dirent dirents[8]; ++ struct grub_jfs_leaf_dirent dirents[GRUB_JFS_INODE_INLINE_ENTRIES]; + } GRUB_PACKED dir; + /* Fast symlink. */ + struct +@@ -453,6 +459,13 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + /* Check if the entire tree is contained within the inode. */ + if (inode->file.tree.flags & GRUB_JFS_TREE_LEAF) + { ++ if (inode->dir.header.count > GRUB_JFS_INODE_INLINE_ENTRIES) ++ { ++ grub_free (diro); ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid JFS inode")); ++ return 0; ++ } ++ + diro->leaf = inode->dir.dirents; + diro->next_leaf = (struct grub_jfs_leaf_next_dirent *) de; + diro->sorted = inode->dir.header.sorted; diff --git a/SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch b/SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch new file mode 100644 index 0000000..0ba88eb --- /dev/null +++ b/SOURCES/0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch @@ -0,0 +1,64 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:28:00 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read caused by invalid dir slot index + +While fuzz testing JFS with ASAN enabled an OOB read was detected in +grub_jfs_opendir(). The issue occurred due to an invalid directory slot +index in the first entry of the sorted directory slot array in the inode +directory header. The fix ensures the slot index is validated before +accessing it. Given that an internal or a leaf node in a directory B+ +tree is a 4 KiB in size and each directory slot is always 32 bytes, the +max number of slots in a node is 128. The validation ensures that the +slot index doesn't exceed this limit. + +[1] https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + JFS will allocate 4K of disk space for an internal node of the B+ tree. + An internal node looks the same as a leaf node. + - page 10 + + Fixed number of Directory Slots depending on the size of the node. These are + the slots to be used for storing the directory slot array and the directory + entries or router entries. A directory slot is always 32 bytes. + ... + A Directory Slot Array which is a sorted array of indices to the directory + slots that are currently in use. + ... + An internal or a leaf node in the directory B+ tree is a 4K page. + - page 25 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index d4207eb64..60dd62fe2 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -46,6 +46,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + * https://jfs.sourceforge.net/project/pub/jfslayout.pdf + */ + #define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++#define GRUB_JFS_DIR_MAX_SLOTS 128 + + struct grub_jfs_sblock + { +@@ -481,6 +482,14 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + ++ if (inode->dir.header.sorted[0] >= GRUB_JFS_DIR_MAX_SLOTS) ++ { ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid directory slot index")); ++ grub_free (diro->dirpage); ++ grub_free (diro); ++ return 0; ++ } ++ + blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + diff --git a/SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch b/SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch new file mode 100644 index 0000000..b99b7bf --- /dev/null +++ b/SOURCES/0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch @@ -0,0 +1,128 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:39 +0000 +Subject: [PATCH] fs/jfs: Use full 40 bits offset and address for a data extent + +An extent's logical offset and address are represented as a 40-bit value +split into two parts: the most significant 8 bits and the least +significant 32 bits. Currently the JFS code uses only the least +significant 32 bits value for offsets and addresses assuming the data +size will never exceed the 32-bit range. This approach ignores the most +significant 8 bits potentially leading to incorrect offsets and +addresses for larger values. The patch fixes it by incorporating the +most significant 8 bits into the calculation to get the full 40-bits +value for offsets and addresses. + +https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + "off1,off2 is a 40-bit field, containing the logical offset of the first + block in the extent. + ... + addr1,addr2 is a 40-bit field, containing the address of the extent." + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 41 +++++++++++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 12 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 60dd62fe2..8a908f00d 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -265,6 +265,20 @@ static grub_dl_t my_mod; + + static grub_err_t grub_jfs_lookup_symlink (struct grub_jfs_data *data, grub_uint32_t ino); + ++/* ++ * An extent's offset, physical and logical, is represented as a 40-bit value. ++ * This 40-bit value is split into two parts: ++ * - offset1: the most signficant 8 bits of the offset, ++ * - offset2: the least significant 32 bits of the offset. ++ * ++ * This function calculates and returns the 64-bit offset of an extent. ++ */ ++static grub_uint64_t ++get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) ++{ ++ return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); ++} ++ + static grub_int64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, +@@ -274,22 +288,25 @@ getblk (struct grub_jfs_treehead *treehead, + { + int found = -1; + int i; ++ grub_uint64_t ext_offset, ext_blk; + + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { ++ ext_offset = get_ext_offset (extents[i].offset1, extents[i].offset2); ++ ext_blk = get_ext_offset (extents[i].extent.blk1, extents[i].extent.blk2); ++ + if (treehead->flags & GRUB_JFS_TREE_LEAF) + { + /* Read the leafnode. */ +- if (grub_le_to_cpu32 (extents[i].offset2) <= blk ++ if (ext_offset <= blk + && ((grub_le_to_cpu16 (extents[i].extent.length)) + + (extents[i].extent.length2 << 16) +- + grub_le_to_cpu32 (extents[i].offset2)) > blk) +- return (blk - grub_le_to_cpu32 (extents[i].offset2) +- + grub_le_to_cpu32 (extents[i].extent.blk2)); ++ + ext_offset) > blk) ++ return (blk - ext_offset + ext_blk); + } + else +- if (blk >= grub_le_to_cpu32 (extents[i].offset2)) ++ if (blk >= ext_offset) + found = i; + } + +@@ -307,10 +324,9 @@ getblk (struct grub_jfs_treehead *treehead, + return -1; + + if (!grub_disk_read (data->disk, +- ((grub_disk_addr_t) grub_le_to_cpu32 (extents[found].extent.blk2)) +- << (grub_le_to_cpu16 (data->sblock.log2_blksz) +- - GRUB_DISK_SECTOR_BITS), 0, +- sizeof (*tree), (char *) tree)) ++ (grub_disk_addr_t) ext_blk ++ << (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS), ++ 0, sizeof (*tree), (char *) tree)) + { + if (grub_memcmp (&tree->treehead, treehead, sizeof (struct grub_jfs_treehead)) || + grub_memcmp (&tree->extents, extents, 254 * sizeof (struct grub_jfs_tree_extent))) +@@ -361,7 +377,7 @@ grub_jfs_read_inode (struct grub_jfs_data *data, grub_uint32_t ino, + sizeof (iag_inodes), &iag_inodes)) + return grub_errno; + +- inoblk = grub_le_to_cpu32 (iag_inodes[inoext].blk2); ++ inoblk = get_ext_offset (iag_inodes[inoext].blk1, iag_inodes[inoext].blk2); + inoblk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS); + inoblk += inonum; +@@ -490,7 +506,8 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + +- blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); ++ blk = get_ext_offset (de[inode->dir.header.sorted[0]].ex.blk1, ++ de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + + /* Read in the nodes until we are on the leaf node level. */ +@@ -508,7 +525,7 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + + de = (struct grub_jfs_internal_dirent *) diro->dirpage->dirent; + index = diro->dirpage->sorted[diro->dirpage->header.sindex * 32]; +- blk = (grub_le_to_cpu32 (de[index].ex.blk2) ++ blk = (get_ext_offset (de[index].ex.blk1, de[index].ex.blk2) + << (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS)); + } while (!(diro->dirpage->header.flags & GRUB_JFS_TREE_LEAF)); diff --git a/SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch b/SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch new file mode 100644 index 0000000..366d51d --- /dev/null +++ b/SOURCES/0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:40 +0000 +Subject: [PATCH] fs/jfs: Inconsistent signed/unsigned types usage in return + values + +The getblk() returns a value of type grub_int64_t which is assigned to +iagblk and inoblk, both of type grub_uint64_t, in grub_jfs_read_inode() +via grub_jfs_blkno(). This patch fixes the type mismatch in the +functions. Additionally, the getblk() will return 0 instead of -1 on +failure cases. This change is safe because grub_errno is always set in +getblk() to indicate errors and it is later checked in the callers. + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 8a908f00d..739b3c540 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -279,7 +279,7 @@ get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) + return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); + } + +-static grub_int64_t ++static grub_uint64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, + int max_extents, +@@ -290,6 +290,8 @@ getblk (struct grub_jfs_treehead *treehead, + int i; + grub_uint64_t ext_offset, ext_blk; + ++ grub_errno = GRUB_ERR_NONE; ++ + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { +@@ -312,7 +314,7 @@ getblk (struct grub_jfs_treehead *treehead, + + if (found != -1) + { +- grub_int64_t ret = -1; ++ grub_uint64_t ret = 0; + struct + { + struct grub_jfs_treehead treehead; +@@ -321,7 +323,7 @@ getblk (struct grub_jfs_treehead *treehead, + + tree = grub_zalloc (sizeof (*tree)); + if (!tree) +- return -1; ++ return 0; + + if (!grub_disk_read (data->disk, + (grub_disk_addr_t) ext_blk +@@ -334,19 +336,20 @@ getblk (struct grub_jfs_treehead *treehead, + else + { + grub_error (GRUB_ERR_BAD_FS, "jfs: infinite recursion detected"); +- ret = -1; ++ ret = 0; + } + } + grub_free (tree); + return ret; + } + +- return -1; ++ grub_error (GRUB_ERR_READ_ERROR, "jfs: block %" PRIuGRUB_UINT64_T " not found", blk); ++ return 0; + } + + /* Get the block number for the block BLK in the node INODE in the + mounted filesystem DATA. */ +-static grub_int64_t ++static grub_uint64_t + grub_jfs_blkno (struct grub_jfs_data *data, struct grub_jfs_inode *inode, + grub_uint64_t blk) + { diff --git a/SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch b/SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch new file mode 100644 index 0000000..853b663 --- /dev/null +++ b/SOURCES/0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:23 +0800 +Subject: [PATCH] fs/ext2: Fix out-of-bounds read for inline extents + +When inline extents are used, i.e. the extent tree depth equals zero, +a maximum of four entries can fit into the inode's data block. If the +extent header states a number of entries greater than four the current +ext2 implementation causes an out-of-bounds read. Fix this issue by +capping the number of extents to four when reading inline extents. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index 3d59cf131..de5c268a9 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -473,6 +473,8 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + struct grub_ext4_extent *ext; + int i; + grub_disk_addr_t ret; ++ grub_uint16_t nent; ++ const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + leaf = grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, fileblock); + if (! leaf) +@@ -482,7 +484,13 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + } + + ext = (struct grub_ext4_extent *) (leaf + 1); +- for (i = 0; i < grub_le_to_cpu16 (leaf->entries); i++) ++ ++ nent = grub_le_to_cpu16 (leaf->entries); ++ ++ if (leaf->depth == 0) ++ nent = grub_min (nent, max_inline_ext); ++ ++ for (i = 0; i < nent; i++) + { + if (fileblock < grub_le_to_cpu32 (ext[i].block)) + break; diff --git a/SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch b/SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch new file mode 100644 index 0000000..3b50108 --- /dev/null +++ b/SOURCES/0606-fs-ntfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Mon, 3 Jun 2024 12:12:06 +0800 +Subject: [PATCH] fs/ntfs: Fix out-of-bounds read + +When parsing NTFS file records the presence of the 0xFF marker indicates +the end of the attribute list. This value signifies that there are no +more attributes to process. + +However, when the end marker is missing due to corrupted metadata the +loop continues to read beyond the attribute list resulting in out-of-bounds +reads and potentially entering an infinite loop. + +This patch adds a check to provide a stop condition for the loop ensuring +it stops at the end of the attribute list or at the end of the Master File +Table. This guards against out-of-bounds reads and prevents infinite loops. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index d3fb5b48f..9c4d9be98 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -139,6 +139,8 @@ free_attr (struct grub_ntfs_attr *at) + static grub_uint8_t * + find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + { ++ grub_uint8_t *mft_end; ++ + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +@@ -191,7 +193,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + at->attr_cur = at->attr_nxt; +- while (*at->attr_cur != 0xFF) ++ mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { + at->attr_nxt += u16at (at->attr_cur, 4); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) diff --git a/SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch b/SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch new file mode 100644 index 0000000..893bdfb --- /dev/null +++ b/SOURCES/0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch @@ -0,0 +1,141 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 7 Jan 2025 11:38:34 +0000 +Subject: [PATCH] fs/ntfs: Track the end of the MFT attribute buffer + +The end of the attribute buffer should be stored alongside the rest of +the attribute struct as right now it is not possible to implement bounds +checking when accessing attributes sequentially. + +This is done via: + - updating init_attr() to set at->end and check is is not initially out of bounds, + - implementing checks as init_attr() had its type change in its callers, + - updating the value of at->end when needed. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 34 ++++++++++++++++++++++++++++------ + include/grub/ntfs.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 9c4d9be98..699cdb3c0 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -119,13 +119,20 @@ static grub_err_t read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, + grub_disk_read_hook_t read_hook, + void *read_hook_data); + +-static void ++static grub_err_t + init_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft) + { + at->mft = mft; + at->flags = (mft == &mft->data->mmft) ? GRUB_NTFS_AF_MMFT : 0; + at->attr_nxt = mft->buf + first_attr_off (mft->buf); ++ at->end = mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ ++ if (at->attr_nxt > at->end) ++ return grub_error (GRUB_ERR_BAD_FS, "attributes start outside the MFT"); ++ + at->attr_end = at->emft_buf = at->edat_buf = at->sbuf = NULL; ++ ++ return GRUB_ERR_NONE; + } + + static void +@@ -239,6 +246,10 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } + at->flags |= GRUB_NTFS_AF_ALST; ++ ++ /* From this point on pa_end is the end of the buffer */ ++ at->end = pa_end; ++ + while (at->attr_nxt < at->attr_end) + { + if ((*at->attr_nxt == attr) || (attr == 0)) +@@ -298,7 +309,9 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + { + grub_uint8_t *pa; + +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; ++ + pa = find_attr (at, attr); + if (pa == NULL) + return NULL; +@@ -314,7 +327,8 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + } + grub_errno = GRUB_ERR_NONE; + free_attr (at); +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; + pa = find_attr (at, attr); + } + return pa; +@@ -585,7 +599,7 @@ init_file (struct grub_ntfs_file *mft, grub_uint64_t mftno) + mft->attr.attr_end = 0; /* Don't jump to attribute list */ + } + else +- init_attr (&mft->attr, mft); ++ return init_attr (&mft->attr, mft); + + return 0; + } +@@ -807,7 +821,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bmp = NULL; + + at = &attr; +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return 0; ++ + while (1) + { + cur_pos = find_attr (at, GRUB_NTFS_AT_INDEX_ROOT); +@@ -838,7 +854,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bitmap = NULL; + bitmap_len = 0; + free_attr (at); ++ /* No need to check errors here, as it will already be fine */ + init_attr (at, mft); ++ + while ((cur_pos = find_attr (at, GRUB_NTFS_AT_BITMAP)) != NULL) + { + int ofs; +@@ -1203,6 +1221,7 @@ grub_ntfs_label (grub_device_t device, char **label) + struct grub_ntfs_data *data = 0; + struct grub_fshelp_node *mft = 0; + grub_uint8_t *pa; ++ grub_err_t err; + + grub_dl_ref (my_mod); + +@@ -1228,7 +1247,10 @@ grub_ntfs_label (grub_device_t device, char **label) + goto fail; + } + +- init_attr (&mft->attr, mft); ++ err = init_attr (&mft->attr, mft); ++ if (err != GRUB_ERR_NONE) ++ return err; ++ + pa = find_attr (&mft->attr, GRUB_NTFS_AT_VOLUME_NAME); + + if (pa >= mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR)) +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index d1a6af696..ec1c4db38 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -134,6 +134,7 @@ struct grub_ntfs_attr + grub_uint8_t *attr_cur, *attr_nxt, *attr_end; + grub_uint32_t save_pos; + grub_uint8_t *sbuf; ++ grub_uint8_t *end; + struct grub_ntfs_file *mft; + }; + diff --git a/SOURCES/0608-fs-ntfs-Use-a-helper-function-to-access-attributes.patch b/SOURCES/0608-fs-ntfs-Use-a-helper-function-to-access-attributes.patch new file mode 100644 index 0000000..16029ba --- /dev/null +++ b/SOURCES/0608-fs-ntfs-Use-a-helper-function-to-access-attributes.patch @@ -0,0 +1,183 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 14 May 2024 12:39:56 +0100 +Subject: [PATCH] fs/ntfs: Use a helper function to access attributes + +Right now to access the next attribute the code reads the length of the +current attribute and adds that to the current pointer. This is error +prone as bounds checking needs to be performed all over the place. So, +implement a helper and ensure its used across find_attr() and read_attr(). + +This commit does *not* implement full bounds checking. It is just the +preparation work for this to be added into the helper. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 69 +++++++++++++++++++++++++++++++++++++++++++---------- + include/grub/ntfs.h | 2 ++ + 2 files changed, 58 insertions(+), 13 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 699cdb3c0..5b3189ab2 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -70,6 +70,25 @@ res_attr_data_len (void *res_attr_ptr) + return u32at (res_attr_ptr, 0x10); + } + ++/* Return the next attribute if it exists, otherwise return NULL. */ ++static grub_uint8_t * ++next_attribute (grub_uint8_t *curr_attribute, void *end) ++{ ++ grub_uint8_t *next = curr_attribute; ++ ++ /* ++ * Need to verify we aren't exceeding the end of the buffer by reading the ++ * header for the current attribute ++ */ ++ if (curr_attribute + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) ++ return NULL; ++ ++ next += u16at (curr_attribute, 4); ++ ++ return next; ++} ++ ++ + grub_ntfscomp_func_t grub_ntfscomp_func; + + static grub_err_t +@@ -151,13 +170,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + at->attr_cur = at->attr_nxt; +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->attr_end); + if ((*at->attr_cur == attr) || (attr == 0)) + { +- grub_uint8_t *new_pos; ++ grub_uint8_t *new_pos, *end; + + if (at->flags & GRUB_NTFS_AF_MMFT) + { +@@ -181,15 +200,36 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + ++ /* ++ * Only time emft_bufs is defined is in this function, with this ++ * size. ++ */ ++ grub_size_t emft_buf_size = ++ at->mft->data->mft_size << GRUB_NTFS_BLK_SHR; ++ ++ /* ++ * Needs to be enough space for the successful case to even ++ * bother. ++ */ ++ if (first_attr_off (at->emft_buf) >= (emft_buf_size - 0x18 - 2)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, ++ "can\'t find 0x%X in attribute list", ++ (unsigned char) *at->attr_cur); ++ return NULL; ++ } ++ + new_pos = &at->emft_buf[first_attr_off (at->emft_buf)]; +- while (*new_pos != 0xFF) ++ end = &at->emft_buf[emft_buf_size]; ++ ++ while (new_pos && *new_pos != 0xFF) + { + if ((*new_pos == *at->attr_cur) + && (u16at (new_pos, 0xE) == u16at (at->attr_cur, 0x18))) + { + return new_pos; + } +- new_pos += u16at (new_pos, 4); ++ new_pos = next_attribute (new_pos, end); + } + grub_error (GRUB_ERR_BAD_FS, + "can\'t find 0x%X in attribute list", +@@ -203,7 +243,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->end); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) + at->attr_end = at->attr_cur; + if ((*at->attr_cur == attr) || (attr == 0)) +@@ -250,13 +290,14 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + /* From this point on pa_end is the end of the buffer */ + at->end = pa_end; + +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + if ((*at->attr_nxt == attr) || (attr == 0)) + break; +- at->attr_nxt += u16at (at->attr_nxt, 4); ++ at->attr_nxt = next_attribute (at->attr_nxt, pa_end); + } +- if (at->attr_nxt >= at->attr_end) ++ ++ if (at->attr_nxt >= at->attr_end || at->attr_nxt == NULL) + return NULL; + + if ((at->flags & GRUB_NTFS_AF_MMFT) && (attr == GRUB_NTFS_AT_DATA)) +@@ -277,7 +318,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + grub_cpu_to_le32 (at->mft->data->mft_start + + 1)); + pa = at->attr_nxt + u16at (pa, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; +@@ -293,7 +335,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + u32at (pa, 0x10) * (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), + at->mft->data->mft_size << GRUB_NTFS_BLK_SHR, 0, 0, 0)) + return NULL; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, pa_end); + } + at->attr_nxt = at->attr_cur; + at->flags &= ~GRUB_NTFS_AF_GPOS; +@@ -530,14 +572,15 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, + else + vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); + pa = at->attr_nxt + u16at (at->attr_nxt, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; + if (u32at (pa, 8) > vcn) + break; + at->attr_nxt = pa; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, at->attr_end); + } + } + pp = find_attr (at, attr); +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index ec1c4db38..2c8078403 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -89,6 +89,8 @@ enum + #define GRUB_NTFS_COM_SEC (GRUB_NTFS_COM_LEN >> GRUB_NTFS_BLK_SHR) + #define GRUB_NTFS_LOG_COM_SEC (GRUB_NTFS_COM_LOG_LEN - GRUB_NTFS_BLK_SHR) + ++#define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 ++ + enum + { + GRUB_NTFS_AF_ALST = 1, diff --git a/SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch b/SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch new file mode 100644 index 0000000..9e31a92 --- /dev/null +++ b/SOURCES/0610-fs-xfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:57 +0800 +Subject: [PATCH] fs/xfs: Fix out-of-bounds read + +The number of records in the root key array read from disk was not being +validated against the size of the root node. This could lead to an +out-of-bounds read. + +This patch adds a check to ensure that the number of records in the root +key array does not exceed the expected size of a root node read from +disk. If this check detects an out-of-bounds condition the operation is +aborted to prevent random errors due to metadata corruption. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 66e66dd58..f919bfd2a 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -540,6 +540,16 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + do + { + int i; ++ grub_addr_t keys_end, data_end; ++ if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || ++ grub_add ((grub_addr_t) keys, keys_end, &keys_end) || ++ grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || ++ keys_end > data_end) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS root keys"); ++ grub_free (leaf); ++ return 0; ++ } + + for (i = 0; i < nrec; i++) + { diff --git a/SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch b/SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch new file mode 100644 index 0000000..b67077d --- /dev/null +++ b/SOURCES/0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:03:58 +0100 +Subject: [PATCH] fs/xfs: Ensuring failing to mount sets a grub_errno + +It was previously possible for grub_xfs_mount() to return NULL without +setting grub_errno if the XFS version was invalid. This resulted in it +being possible for grub_dl_unref() to be called twice allowing the XFS +module to be unloaded while there were still references to it. + +Fixing this problem in general by ensuring a grub_errno is set if the +fail label is reached. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index f919bfd2a..c9818a96a 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -297,6 +297,8 @@ static int grub_xfs_sb_valid(struct grub_xfs_data *data) + } + return 1; + } ++ ++ grub_error (GRUB_ERR_BAD_FS, "unsupported XFS filesystem version"); + return 0; + } + +@@ -952,7 +954,7 @@ grub_xfs_mount (grub_disk_t disk) + return data; + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not an XFS filesystem"); + + grub_free (data); diff --git a/SOURCES/0612-kern-file-Ensure-file-data-is-set.patch b/SOURCES/0612-kern-file-Ensure-file-data-is-set.patch new file mode 100644 index 0000000..efd3b6b --- /dev/null +++ b/SOURCES/0612-kern-file-Ensure-file-data-is-set.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 03:01:40 +0100 +Subject: [PATCH] kern/file: Ensure file->data is set + +This is to avoid a generic issue were some filesystems would not set +data and also not set a grub_errno. This meant it was possible for many +filesystems to grub_dl_unref() themselves multiple times resulting in +it being possible to unload the filesystems while there were still +references to them, e.g., via a loopback. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 5e1f29d0d..596f16ced 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -121,6 +121,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if ((file->fs->open) (file, file_name) != GRUB_ERR_NONE) + goto fail; + ++ if (file->data == NULL) ++ goto fail; ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + diff --git a/SOURCES/0613-kern-file-Implement-filesystem-reference-counting.patch b/SOURCES/0613-kern-file-Implement-filesystem-reference-counting.patch new file mode 100644 index 0000000..0e04721 --- /dev/null +++ b/SOURCES/0613-kern-file-Implement-filesystem-reference-counting.patch @@ -0,0 +1,430 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 10:15:03 +0100 +Subject: [PATCH] kern/file: Implement filesystem reference counting + +The grub_file_open() and grub_file_close() should be the only places +that allow a reference to a filesystem to stay open. So, add grub_dl_t +to grub_fs_t and set this in the GRUB_MOD_INIT() for each filesystem to +avoid issues when filesystems forget to do it themselves or do not track +their own references, e.g. squash4. + +The fs_label(), fs_uuid(), fs_mtime() and fs_read() should all ref and +unref in the same function but it is essentially redundant in GRUB +single threaded model. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 1 + + grub-core/fs/bfs.c | 1 + + grub-core/fs/btrfs.c | 1 + + grub-core/fs/cbfs.c | 1 + + grub-core/fs/cpio.c | 1 + + grub-core/fs/cpio_be.c | 1 + + grub-core/fs/ext2.c | 1 + + grub-core/fs/f2fs.c | 1 + + grub-core/fs/fat.c | 1 + + grub-core/fs/hfs.c | 1 + + grub-core/fs/hfsplus.c | 1 + + grub-core/fs/iso9660.c | 1 + + grub-core/fs/jfs.c | 1 + + grub-core/fs/minix.c | 1 + + grub-core/fs/newc.c | 1 + + grub-core/fs/nilfs2.c | 1 + + grub-core/fs/ntfs.c | 1 + + grub-core/fs/odc.c | 1 + + grub-core/fs/proc.c | 1 + + grub-core/fs/reiserfs.c | 1 + + grub-core/fs/romfs.c | 1 + + grub-core/fs/sfs.c | 1 + + grub-core/fs/squash4.c | 1 + + grub-core/fs/tar.c | 1 + + grub-core/fs/udf.c | 1 + + grub-core/fs/ufs.c | 1 + + grub-core/fs/xfs.c | 1 + + grub-core/fs/zfs/zfs.c | 1 + + grub-core/kern/file.c | 4 ++++ + include/grub/fs.h | 4 ++++ + 30 files changed, 36 insertions(+) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index e4615c743..6347ca368 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -699,6 +699,7 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { ++ grub_affs_fs.mod = mod; + grub_fs_register (&grub_affs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index d2b490bce..6afdfc987 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -1104,6 +1104,7 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); ++ grub_bfs_fs.mod = mod; + grub_fs_register (&grub_bfs_fs); + } + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 9da2952f7..65213549e 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2802,6 +2802,7 @@ subvol_get_env (struct grub_env_var *var __attribute__ ((unused)), + + GRUB_MOD_INIT (btrfs) + { ++ grub_btrfs_fs.mod = mod; + grub_fs_register (&grub_btrfs_fs); + cmd_info = grub_register_command("btrfs-info", grub_cmd_btrfs_info, + "DEVICE", +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 0842701a6..395edcbbd 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -390,6 +390,7 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif ++ grub_cbfs_fs.mod = mod; + grub_fs_register (&grub_cbfs_fs); + } + +diff --git a/grub-core/fs/cpio.c b/grub-core/fs/cpio.c +index dab5f9898..1799f7ff5 100644 +--- a/grub-core/fs/cpio.c ++++ b/grub-core/fs/cpio.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/cpio_be.c b/grub-core/fs/cpio_be.c +index 846548892..7bed1b848 100644 +--- a/grub-core/fs/cpio_be.c ++++ b/grub-core/fs/cpio_be.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio_be) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index de5c268a9..dc62a6cfe 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -1105,6 +1105,7 @@ static struct grub_fs grub_ext2_fs = + + GRUB_MOD_INIT(ext2) + { ++ grub_ext2_fs.mod = mod; + grub_fs_register (&grub_ext2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index 706e595d3..149f33695 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -1339,6 +1339,7 @@ static struct grub_fs grub_f2fs_fs = { + + GRUB_MOD_INIT (f2fs) + { ++ grub_f2fs_fs.mod = mod; + grub_fs_register (&grub_f2fs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/fat.c b/grub-core/fs/fat.c +index 8d8dc35ce..72785a798 100644 +--- a/grub-core/fs/fat.c ++++ b/grub-core/fs/fat.c +@@ -1254,6 +1254,7 @@ GRUB_MOD_INIT(fat) + #endif + { + COMPILE_TIME_ASSERT (sizeof (struct grub_fat_dir_entry) == 32); ++ grub_fat_fs.mod = mod; + grub_fs_register (&grub_fat_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 44859fe43..66b9fca83 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -1434,6 +1434,7 @@ static struct grub_fs grub_hfs_fs = + + GRUB_MOD_INIT(hfs) + { ++ grub_hfs_fs.mod = mod; + if (!grub_is_lockdown ()) + grub_fs_register (&grub_hfs_fs); + my_mod = mod; +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index 2edb1649d..a1805eed0 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -1139,6 +1139,7 @@ static struct grub_fs grub_hfsplus_fs = + + GRUB_MOD_INIT(hfsplus) + { ++ grub_hfsplus_fs.mod = mod; + grub_fs_register (&grub_hfsplus_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index cf17702e2..576505535 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -1165,6 +1165,7 @@ static struct grub_fs grub_iso9660_fs = + + GRUB_MOD_INIT(iso9660) + { ++ grub_iso9660_fs.mod = mod; + grub_fs_register (&grub_iso9660_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 739b3c540..46941248b 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -998,6 +998,7 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { ++ grub_jfs_fs.mod = mod; + grub_fs_register (&grub_jfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index d451b3426..28571c49e 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -716,6 +716,7 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { ++ grub_minix_fs.mod = mod; + grub_fs_register (&grub_minix_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/newc.c b/grub-core/fs/newc.c +index 4fb8b2e3d..43b7f8b64 100644 +--- a/grub-core/fs/newc.c ++++ b/grub-core/fs/newc.c +@@ -64,6 +64,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (newc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index c4c4610be..3c1e4d1f6 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -1231,6 +1231,7 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); ++ grub_nilfs2_fs.mod = mod; + grub_fs_register (&grub_nilfs2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 86222413c..9244e95dd 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -1537,6 +1537,7 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { ++ grub_ntfs_fs.mod = mod; + grub_fs_register (&grub_ntfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/odc.c b/grub-core/fs/odc.c +index 790000622..8e4e8aeac 100644 +--- a/grub-core/fs/odc.c ++++ b/grub-core/fs/odc.c +@@ -52,6 +52,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (odc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/proc.c b/grub-core/fs/proc.c +index 31f3aa9a4..317118b81 100644 +--- a/grub-core/fs/proc.c ++++ b/grub-core/fs/proc.c +@@ -192,6 +192,7 @@ static struct grub_fs grub_procfs_fs = + + GRUB_MOD_INIT (procfs) + { ++ grub_procfs_fs.mod = mod; + grub_disk_dev_register (&grub_procfs_dev); + grub_fs_register (&grub_procfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index 9556c15ff..e65b81467 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -1407,6 +1407,7 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { ++ grub_reiserfs_fs.mod = mod; + grub_fs_register (&grub_reiserfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index 2e3544408..f282cff86 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -475,6 +475,7 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { ++ grub_romfs_fs.mod = mod; + grub_fs_register (&grub_romfs_fs); + } + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 61d6c303c..c6b9fb49a 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -779,6 +779,7 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { ++ grub_sfs_fs.mod = mod; + grub_fs_register (&grub_sfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index f9bef38fc..1505832d5 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -1032,6 +1032,7 @@ static struct grub_fs grub_squash_fs = + + GRUB_MOD_INIT(squash4) + { ++ grub_squash_fs.mod = mod; + grub_fs_register (&grub_squash_fs); + } + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 28baa5845..01738ec55 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -354,6 +354,7 @@ static struct grub_fs grub_cpio_fs = { + + GRUB_MOD_INIT (tar) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 6670beb56..8db2b5686 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -1382,6 +1382,7 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { ++ grub_udf_fs.mod = mod; + grub_fs_register (&grub_udf_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index 0c2004fd7..a2c63d646 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -899,6 +899,7 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { ++ grub_ufs_fs.mod = mod; + grub_fs_register (&grub_ufs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index c9818a96a..5b7643eb1 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -1167,6 +1167,7 @@ static struct grub_fs grub_xfs_fs = + + GRUB_MOD_INIT(xfs) + { ++ grub_xfs_fs.mod = mod; + grub_fs_register (&grub_xfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 0d8c08eec..0c4b15f08 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -4391,6 +4391,7 @@ static struct grub_fs grub_zfs_fs = { + GRUB_MOD_INIT (zfs) + { + COMPILE_TIME_ASSERT (sizeof (zap_leaf_chunk_t) == ZAP_LEAF_CHUNKSIZE); ++ grub_zfs_fs.mod = mod; + grub_fs_register (&grub_zfs_fs); + #ifndef GRUB_UTIL + my_mod = mod; +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 596f16ced..7e64609d4 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + void (*EXPORT_VAR (grub_grubnet_fini)) (void); + +@@ -124,6 +125,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if (file->data == NULL) + goto fail; + ++ if (file->fs->mod) ++ grub_dl_ref (file->fs->mod); ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + +diff --git a/include/grub/fs.h b/include/grub/fs.h +index 5678c60c2..cb1040b50 100644 +--- a/include/grub/fs.h ++++ b/include/grub/fs.h +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + /* For embedding types. */ +@@ -57,6 +58,9 @@ struct grub_fs + /* My name. */ + const char *name; + ++ /* My module */ ++ grub_dl_t mod; ++ + /* Call HOOK with each file under DIR. */ + grub_err_t (*dir) (grub_device_t device, const char *path, + grub_fs_dir_hook_t hook, void *hook_data); diff --git a/SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch b/SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch new file mode 100644 index 0000000..8780233 --- /dev/null +++ b/SOURCES/0614-disk-loopback-Reference-tracking-for-the-loopback.patch @@ -0,0 +1,103 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 03:26:19 +0100 +Subject: [PATCH] disk/loopback: Reference tracking for the loopback + +It was possible to delete a loopback while there were still references +to it. This led to an exploitable use-after-free. + +Fixed by implementing a reference counting in the grub_loopback struct. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/disk/loopback.c | 18 ++++++++++++++++++ + include/grub/err.h | 3 ++- + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c +index 9406d931c..e7052a9cb 100644 +--- a/grub-core/disk/loopback.c ++++ b/grub-core/disk/loopback.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -33,6 +34,7 @@ struct grub_loopback + grub_file_t file; + struct grub_loopback *next; + unsigned long id; ++ grub_uint64_t refcnt; + }; + + static struct grub_loopback *loopback_list; +@@ -63,6 +65,8 @@ delete_loopback (const char *name) + if (! dev) + return grub_error (GRUB_ERR_BAD_DEVICE, "device not found"); + ++ if (dev->refcnt > 0) ++ return grub_error (GRUB_ERR_STILL_REFERENCED, "device still referenced"); + /* Remove the device from the list. */ + *prev = dev->next; + +@@ -124,6 +128,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args) + + newdev->file = file; + newdev->id = last_id++; ++ newdev->refcnt = 0; + + /* Add the new entry to the list. */ + newdev->next = loopback_list; +@@ -165,6 +170,9 @@ grub_loopback_open (const char *name, grub_disk_t disk) + if (! dev) + return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); + ++ if (grub_add (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count overflow"); ++ + /* Use the filesize for the disk size, round up to a complete sector. */ + if (dev->file->size != GRUB_FILE_SIZE_UNKNOWN) + disk->total_sectors = ((dev->file->size + GRUB_DISK_SECTOR_SIZE - 1) +@@ -182,6 +190,15 @@ grub_loopback_open (const char *name, grub_disk_t disk) + return 0; + } + ++static void ++grub_loopback_close (grub_disk_t disk) ++{ ++ struct grub_loopback *dev = disk->data; ++ ++ if (grub_sub (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count underflow"); ++} ++ + static grub_err_t + grub_loopback_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_size_t size, char *buf) +@@ -224,6 +241,7 @@ static struct grub_disk_dev grub_loopback_dev = + .id = GRUB_DISK_DEVICE_LOOPBACK_ID, + .iterate = grub_loopback_iterate, + .open = grub_loopback_open, ++ .close = grub_loopback_close, + .read = grub_loopback_read, + .write = grub_loopback_write, + .next = 0 +diff --git a/include/grub/err.h b/include/grub/err.h +index 9b830757d..1b5335610 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -71,7 +71,8 @@ typedef enum + GRUB_ERR_NET_PACKET_TOO_BIG, + GRUB_ERR_NET_NO_DOMAIN, + GRUB_ERR_EOF, +- GRUB_ERR_BAD_SIGNATURE ++ GRUB_ERR_BAD_SIGNATURE, ++ GRUB_ERR_STILL_REFERENCED + } + grub_err_t; + diff --git a/SOURCES/0615-kern-disk-Limit-recursion-depth.patch b/SOURCES/0615-kern-disk-Limit-recursion-depth.patch new file mode 100644 index 0000000..eb518e5 --- /dev/null +++ b/SOURCES/0615-kern-disk-Limit-recursion-depth.patch @@ -0,0 +1,120 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 04:09:24 +0100 +Subject: [PATCH] kern/disk: Limit recursion depth + +The grub_disk_read() may trigger other disk reads, e.g. via loopbacks. +This may lead to very deep recursion which can corrupt the heap. So, fix +the issue by limiting reads depth. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/disk.c | 27 ++++++++++++++++++++------- + include/grub/err.h | 3 ++- + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c +index 7f58c5614..62d6a85cc 100644 +--- a/grub-core/kern/disk.c ++++ b/grub-core/kern/disk.c +@@ -28,6 +28,10 @@ + + #define GRUB_CACHE_TIMEOUT 2 + ++/* Disk reads may trigger other disk reads. So, limit recursion depth. */ ++#define MAX_READ_RECURSION_DEPTH 16 ++static unsigned int read_recursion_depth = 0; ++ + /* The last time the disk was used. */ + static grub_uint64_t grub_last_time = 0; + +@@ -417,6 +421,8 @@ grub_err_t + grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_off_t offset, grub_size_t size, void *buf) + { ++ grub_err_t err = GRUB_ERR_NONE; ++ + /* First of all, check if the region is within the disk. */ + if (grub_disk_adjust_range (disk, §or, &offset, size) != GRUB_ERR_NONE) + { +@@ -427,12 +433,17 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + return grub_errno; + } + ++ if (++read_recursion_depth >= MAX_READ_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_RECURSION_DEPTH, "grub_disk_read(): Maximum recursion depth exceeded"); ++ goto error; ++ } ++ + /* First read until first cache boundary. */ + if (offset || (sector & (GRUB_DISK_CACHE_SIZE - 1))) + { + grub_disk_addr_t start_sector; + grub_size_t pos; +- grub_err_t err; + grub_size_t len; + + start_sector = sector & ~((grub_disk_addr_t) GRUB_DISK_CACHE_SIZE - 1); +@@ -444,7 +455,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + err = grub_disk_read_small (disk, start_sector, + offset + pos, len, buf); + if (err) +- return err; ++ goto error; + buf = (char *) buf + len; + size -= len; + offset += len; +@@ -457,7 +468,6 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + { + char *data = NULL; + grub_disk_addr_t agglomerate; +- grub_err_t err; + + /* agglomerate read until we find a first cached entry. */ + for (agglomerate = 0; agglomerate +@@ -493,7 +503,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + - disk->log_sector_size), + buf); + if (err) +- return err; ++ goto error; + + for (i = 0; i < agglomerate; i ++) + grub_disk_cache_store (disk->dev->id, disk->id, +@@ -527,13 +537,16 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + /* And now read the last part. */ + if (size) + { +- grub_err_t err; + err = grub_disk_read_small (disk, sector, 0, size, buf); + if (err) +- return err; ++ goto error; + } + +- return grub_errno; ++ err = grub_errno; ++ ++ error: ++ read_recursion_depth--; ++ return err; + } + + grub_uint64_t +diff --git a/include/grub/err.h b/include/grub/err.h +index 1b5335610..670d40967 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -72,7 +72,8 @@ typedef enum + GRUB_ERR_NET_NO_DOMAIN, + GRUB_ERR_EOF, + GRUB_ERR_BAD_SIGNATURE, +- GRUB_ERR_STILL_REFERENCED ++ GRUB_ERR_STILL_REFERENCED, ++ GRUB_ERR_RECURSION_DEPTH + } + grub_err_t; + diff --git a/SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch b/SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch new file mode 100644 index 0000000..60b0255 --- /dev/null +++ b/SOURCES/0616-kern-partition-Limit-recursion-in-part_iterate.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 16 Nov 2024 21:24:19 +0000 +Subject: [PATCH] kern/partition: Limit recursion in part_iterate() + +The part_iterate() is used by grub_partition_iterate() as a callback in +the partition iterate functions. However, part_iterate() may also call +the partition iterate functions which may lead to recursion. Fix potential +issue by limiting the recursion depth. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index 3068c4dca..f3f125e75 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -28,6 +28,9 @@ + + grub_partition_map_t grub_partition_map_list; + ++#define MAX_RECURSION_DEPTH 32 ++static unsigned int recursion_depth = 0; ++ + /* + * Checks that disk->partition contains part. This function assumes that the + * start of part is relative to the start of disk->partition. Returns 1 if +@@ -208,7 +211,12 @@ part_iterate (grub_disk_t dsk, const grub_partition_t partition, void *data) + FOR_PARTITION_MAPS(partmap) + { + grub_err_t err; +- err = partmap->iterate (dsk, part_iterate, ctx); ++ recursion_depth++; ++ if (recursion_depth <= MAX_RECURSION_DEPTH) ++ err = partmap->iterate (dsk, part_iterate, ctx); ++ else ++ err = grub_error (GRUB_ERR_RECURSION_DEPTH, "maximum recursion depth exceeded"); ++ recursion_depth--; + if (err) + grub_errno = GRUB_ERR_NONE; + if (ctx->ret) diff --git a/SOURCES/0617-script-execute-Limit-the-recursion-depth.patch b/SOURCES/0617-script-execute-Limit-the-recursion-depth.patch new file mode 100644 index 0000000..d4ab505 --- /dev/null +++ b/SOURCES/0617-script-execute-Limit-the-recursion-depth.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 19:04:13 +0100 +Subject: [PATCH] script/execute: Limit the recursion depth + +If unbounded recursion is allowed it becomes possible to collide the +stack with the heap. As UEFI firmware often lacks guard pages this +becomes an exploitable issue as it is possible in some cases to do +a controlled overwrite of a section of this heap region with +arbitrary data. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 266d99ed3..ef9a01642 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -36,10 +36,18 @@ + is sizeof (int) * 3, and one extra for a possible -ve sign. */ + #define ERRNO_DIGITS_MAX (sizeof (int) * 3 + 1) + ++/* ++ * A limit on recursion, to avoid colliding with the heap. UEFI defines a baseline ++ * stack size of 128 KiB. So, assuming at most 1-2 KiB per iteration this should ++ * keep us safe. ++ */ ++#define MAX_RECURSION_DEPTH 64 ++ + static unsigned long is_continue; + static unsigned long active_loops; + static unsigned long active_breaks; + static unsigned long function_return; ++static unsigned long recursion_depth; + + #define GRUB_SCRIPT_SCOPE_MALLOCED 1 + #define GRUB_SCRIPT_SCOPE_ARGS_MALLOCED 2 +@@ -850,7 +858,13 @@ grub_script_execute_cmd (struct grub_script_cmd *cmd) + if (cmd == 0) + return 0; + ++ recursion_depth++; ++ ++ if (recursion_depth >= MAX_RECURSION_DEPTH) ++ return grub_error (GRUB_ERR_RECURSION_DEPTH, N_("maximum recursion depth exceeded")); ++ + ret = cmd->exec (cmd); ++ recursion_depth--; + + grub_snprintf (errnobuf, sizeof (errnobuf), "%d", ret); + grub_env_set ("?", errnobuf); diff --git a/SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch b/SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch new file mode 100644 index 0000000..07ae790 --- /dev/null +++ b/SOURCES/0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 28 Nov 2024 04:05:04 +0000 +Subject: [PATCH] net: Unregister net_default_ip and net_default_mac variables + hooks on unload + +The net module is a dependency of normal. So, it shouldn't be possible +to unload the net. Though unregister variables hooks as a precaution. +It also gets in line with unregistering the other net module hooks. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index b9e2a4d10..c78c8694b 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -2161,6 +2161,8 @@ GRUB_MOD_FINI(net) + + grub_register_variable_hook ("net_default_server", 0, 0); + grub_register_variable_hook ("pxe_default_server", 0, 0); ++ grub_register_variable_hook ("net_default_ip", 0, 0); ++ grub_register_variable_hook ("net_default_mac", 0, 0); + + grub_bootp_fini (); + grub_dns_fini (); diff --git a/SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch b/SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch new file mode 100644 index 0000000..c93a810 --- /dev/null +++ b/SOURCES/0619-net-Remove-variables-hooks-when-interface-is-unregis.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:49:48 +0000 +Subject: [PATCH] net: Remove variables hooks when interface is unregisted + +The grub_net_network_level_interface_unregister(), previously +implemented in a header, did not remove the variables hooks that +were registered in grub_net_network_level_interface_register(). +Fix this by implementing the same logic used to register the +variables and move the function into the grub-core/net/net.c. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 34 ++++++++++++++++++++++++++++++++++ + include/grub/net.h | 11 +---------- + 2 files changed, 35 insertions(+), 10 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index c78c8694b..69223164d 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -1051,6 +1051,40 @@ grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter, + return 0; + } + ++void ++grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) ++{ ++ char *name; ++ ++ { ++ char buf[GRUB_NET_MAX_STR_HWADDR_LEN]; ++ ++ grub_net_hwaddr_to_str (&inter->hwaddress, buf); ++ name = grub_xasprintf ("net_%s_mac", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ { ++ char buf[GRUB_NET_MAX_STR_ADDR_LEN]; ++ ++ grub_net_addr_to_str (&inter->address, buf); ++ name = grub_xasprintf ("net_%s_ip", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ inter->card->num_ifaces--; ++ *inter->prev = inter->next; ++ if (inter->next) ++ inter->next->prev = inter->prev; ++ inter->next = 0; ++ inter->prev = 0; ++} ++ ++ + grub_err_t + grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter, + int mask) +diff --git a/include/grub/net.h b/include/grub/net.h +index 0d31f0066..4a815fa91 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -607,16 +607,7 @@ void grub_bootp_fini (void); + void grub_dns_init (void); + void grub_dns_fini (void); + +-static inline void +-grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) +-{ +- inter->card->num_ifaces--; +- *inter->prev = inter->next; +- if (inter->next) +- inter->next->prev = inter->prev; +- inter->next = 0; +- inter->prev = 0; +-} ++void grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter); + + void + grub_net_tcp_retransmit (void); diff --git a/SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch b/SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch new file mode 100644 index 0000000..b6afa35 --- /dev/null +++ b/SOURCES/0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch @@ -0,0 +1,80 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 15 Nov 2024 13:12:09 +0000 +Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file() + +The function included a call to grub_strcpy() which copied data from an +environment variable to a buffer allocated in grub_cmd_normal(). The +grub_cmd_normal() didn't consider the length of the environment variable. +So, the copy operation could exceed the allocation and lead to an OOB +write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and +pass the underlying buffers size to the grub_net_search_config_file(). + +Fixes: CVE-2025-0624 + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 7 ++++--- + grub-core/normal/main.c | 2 +- + include/grub/net.h | 2 +- + 3 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 69223164d..f0896979d 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -1940,9 +1940,9 @@ grub_net_restore_hw (void) + } + + grub_err_t +-grub_net_search_configfile (char *config) ++grub_net_search_configfile (char *config, grub_size_t config_buf_len) + { +- grub_size_t config_len; ++ grub_size_t config_len, suffix_len; + char *suffix; + + auto int search_through (grub_size_t num_tries, grub_size_t slice_size); +@@ -1979,6 +1979,7 @@ grub_net_search_configfile (char *config) + config_len = grub_strlen (config); + config[config_len] = '-'; + suffix = config + config_len + 1; ++ suffix_len = config_buf_len - (config_len + 1); + + struct grub_net_network_level_interface *inf; + FOR_NET_NETWORK_LEVEL_INTERFACES (inf) +@@ -2004,7 +2005,7 @@ grub_net_search_configfile (char *config) + + if (client_uuid) + { +- grub_strcpy (suffix, client_uuid); ++ grub_strlcpy (suffix, client_uuid, suffix_len); + if (search_through (1, 0) == 0) return GRUB_ERR_NONE; + } + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 93f33c167..f5e9b54f7 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -349,7 +349,7 @@ grub_try_normal_prefix (const char *prefix) + return err; + + grub_snprintf (config, config_len, "%s/grub.cfg", prefix); +- err = grub_net_search_configfile (config); ++ err = grub_net_search_configfile (config, config_len); + } + + if (err != GRUB_ERR_NONE) +diff --git a/include/grub/net.h b/include/grub/net.h +index 4a815fa91..8c8521944 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -646,6 +646,6 @@ extern char *grub_net_default_server; + #define VLANTAG_IDENTIFIER 0x8100 + + grub_err_t +-grub_net_search_configfile (char *config); ++grub_net_search_configfile (char *config, grub_size_t config_buf_len); + + #endif /* ! GRUB_NET_HEADER */ diff --git a/SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch b/SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch new file mode 100644 index 0000000..8edb2ff --- /dev/null +++ b/SOURCES/0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch @@ -0,0 +1,114 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 17:32:34 +0100 +Subject: [PATCH] net/tftp: Fix stack buffer overflow in tftp_open() + +An overly long filename can be passed to tftp_open() which would cause +grub_normalize_filename() to write out of bounds. + +Fixed by adding an extra argument to grub_normalize_filename() for the +space available, making it act closer to a strlcpy(). As several fixed +strings are strcpy()'d after into the same buffer, their total length is +checked to see if they exceed the remaining space in the buffer. If so, +return an error. + +On the occasion simplify code a bit by removing unneeded rrqlen zeroing. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/tftp.c | 40 +++++++++++++++++++++++++--------------- + 1 file changed, 25 insertions(+), 15 deletions(-) + +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index 09e1511cc..9bc8a688d 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -267,17 +267,19 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), + * forward slashes to a single forward slash. + */ + static void +-grub_normalize_filename (char *normalized, const char *filename) ++grub_normalize_filename (char *normalized, const char *filename, int c) + { + char *dest = normalized; + const char *src = filename; + +- while (*src != '\0') ++ while (*src != '\0' && c > 0) + { + if (src[0] == '/' && src[1] == '/') + src++; +- else +- *dest++ = *src++; ++ else { ++ c--; ++ *dest++ = *src++; ++ } + } + *dest = '\0'; + } +@@ -288,7 +290,7 @@ tftp_open (struct grub_file *file, const char *filename) + struct tftphdr *tftph; + char *rrq; + int i; +- int rrqlen; ++ int rrqlen, rrqsize; + int hdrlen; + grub_uint8_t open_data[1500]; + struct grub_net_buff nb; +@@ -316,35 +318,43 @@ tftp_open (struct grub_file *file, const char *filename) + + tftph = (struct tftphdr *) nb.data; + +- rrq = (char *) tftph->u.rrq; +- rrqlen = 0; +- + tftph->opcode = grub_cpu_to_be16_compile_time (TFTP_RRQ); + ++ rrq = (char *) tftph->u.rrq; ++ rrqsize = sizeof (tftph->u.rrq); ++ + /* Copy and normalize the filename to work-around issues on some tftp + servers when file names are being matched for remapping. */ +- grub_normalize_filename (rrq, filename); +- rrqlen += grub_strlen (rrq) + 1; ++ grub_normalize_filename (rrq, filename, rrqsize); ++ ++ rrqlen = grub_strlen (rrq) + 1; + rrq += grub_strlen (rrq) + 1; + +- grub_strcpy (rrq, "octet"); ++ /* Verify there is enough space for the remaining components. */ + rrqlen += grub_strlen ("octet") + 1; ++ rrqlen += grub_strlen ("blksize") + 1; ++ rrqlen += grub_strlen ("1024") + 1; ++ rrqlen += grub_strlen ("tsize") + 1; ++ rrqlen += grub_strlen ("0") + 1; ++ ++ if (rrqlen >= rrqsize) { ++ grub_free (data); ++ return grub_error (GRUB_ERR_BAD_FILENAME, N_("filename too long")); ++ } ++ ++ grub_strcpy (rrq, "octet"); + rrq += grub_strlen ("octet") + 1; + + grub_strcpy (rrq, "blksize"); +- rrqlen += grub_strlen ("blksize") + 1; + rrq += grub_strlen ("blksize") + 1; + + grub_strcpy (rrq, "1024"); +- rrqlen += grub_strlen ("1024") + 1; + rrq += grub_strlen ("1024") + 1; + + grub_strcpy (rrq, "tsize"); +- rrqlen += grub_strlen ("tsize") + 1; + rrq += grub_strlen ("tsize") + 1; + + grub_strcpy (rrq, "0"); +- rrqlen += grub_strlen ("0") + 1; + rrq += grub_strlen ("0") + 1; + hdrlen = sizeof (tftph->opcode) + rrqlen; + diff --git a/SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch b/SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch new file mode 100644 index 0000000..4c680f6 --- /dev/null +++ b/SOURCES/0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Fri, 8 Mar 2024 22:47:20 +1100 +Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in + JPEG + +Otherwise a subsequent header could change the height and width +allowing future OOB writes. + +Fixes: CVE-2024-45774 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/video/readers/jpeg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c +index 2da04094b..c7aaac362 100644 +--- a/grub-core/video/readers/jpeg.c ++++ b/grub-core/video/readers/jpeg.c +@@ -332,6 +332,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) + if (grub_errno != GRUB_ERR_NONE) + return grub_errno; + ++ if (data->image_height != 0 || data->image_width != 0) ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "jpeg: cannot have duplicate SOF0 markers"); ++ + if (grub_jpeg_get_byte (data) != 8) + return grub_error (GRUB_ERR_BAD_FILE_TYPE, + "jpeg: only 8-bit precision is supported"); diff --git a/SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch b/SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch new file mode 100644 index 0000000..0b40185 --- /dev/null +++ b/SOURCES/0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch @@ -0,0 +1,138 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 15:59:26 +0100 +Subject: [PATCH] kern/dl: Fix for an integer overflow in grub_dl_ref() + +It was possible to overflow the value of mod->ref_count, a signed +integer, by repeatedly invoking insmod on an already loaded module. +This led to a use-after-free. As once ref_count was overflowed it became +possible to unload the module while there was still references to it. + +This resolves the issue by using grub_add() to check if the ref_count +will overflow and then stops further increments. Further changes were +also made to grub_dl_unref() to check for the underflow condition and +the reference count was changed to an unsigned 64-bit integer. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 2 +- + grub-core/kern/dl.c | 17 ++++++++++++----- + include/grub/dl.h | 8 ++++---- + util/misc.c | 4 ++-- + 4 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2bd3ac76f..2001043cf 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -167,7 +167,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), + { + grub_dl_dep_t dep; + +- grub_printf ("%s\t%d\t\t", mod->name, mod->ref_count); ++ grub_printf ("%s\t%" PRIuGRUB_UINT64_T "\t\t", mod->name, mod->ref_count); + for (dep = mod->dep; dep; dep = dep->next) + { + if (dep != mod->dep) +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 68d3177f5..edbb55d7d 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + /* Platforms where modules are in a readonly area of memory. */ + #if defined(GRUB_MACHINE_QEMU) +@@ -595,7 +596,7 @@ grub_dl_resolve_dependencies (grub_dl_t mod, Elf_Ehdr *e) + return GRUB_ERR_NONE; + } + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -606,10 +607,13 @@ grub_dl_ref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_ref (dep->mod); + +- return ++mod->ref_count; ++ if (grub_add (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count overflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -620,10 +624,13 @@ grub_dl_unref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_unref (dep->mod); + +- return --mod->ref_count; ++ if (grub_sub (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count underflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_ref_count (grub_dl_t mod) + { + if (mod == NULL) +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 6f46b7e86..2e27ef596 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -177,7 +177,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t; + struct grub_dl + { + char *name; +- int ref_count; ++ grub_uint64_t ref_count; + int persistent; + grub_dl_dep_t dep; + grub_dl_segment_t segment; +@@ -207,9 +207,9 @@ grub_dl_t grub_dl_load_core (void *addr, grub_size_t size); + grub_dl_t EXPORT_FUNC(grub_dl_load_core_noinit) (void *addr, grub_size_t size); + int EXPORT_FUNC(grub_dl_unload) (grub_dl_t mod); + extern void grub_dl_unload_unneeded (void); +-extern int EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); + + extern grub_dl_t EXPORT_VAR(grub_dl_head); + +diff --git a/util/misc.c b/util/misc.c +index d545212d9..0f928e5b4 100644 +--- a/util/misc.c ++++ b/util/misc.c +@@ -190,14 +190,14 @@ grub_xputs_real (const char *str) + + void (*grub_xputs) (const char *str) = grub_xputs_real; + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + (void) mod; + return 0; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + (void) mod; diff --git a/SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch b/SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch new file mode 100644 index 0000000..9479ec8 --- /dev/null +++ b/SOURCES/0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 7 Nov 2024 06:00:36 +0000 +Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in + grub_dl_relocate_symbols() + +The grub_dl_relocate_symbols() iterates through the sections in +an ELF looking for relocation sections. According to the spec [1] +the SHF_INFO_LINK flag should be set if the sh_info field is meant +to be a section index. + +[1] https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/dl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index edbb55d7d..e93863196 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -663,6 +663,9 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + grub_dl_segment_t seg; + grub_err_t err; + ++ if (!(s->sh_flags & SHF_INFO_LINK)) ++ continue; ++ + seg = grub_dl_find_segment(mod, s->sh_info); + if (!seg) + continue; diff --git a/SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch b/SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch new file mode 100644 index 0000000..44e8c91 --- /dev/null +++ b/SOURCES/0625-commands-extcmd-Missing-check-for-failed-allocation.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:55 +0000 +Subject: [PATCH] commands/extcmd: Missing check for failed allocation + +The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate +a grub_arg_list struct but it does not verify the allocation was successful. +In case of failed allocation the NULL state pointer can be accessed in +parse_option() through grub_arg_parse() which may lead to a security issue. + +Fixes: CVE-2024-45775 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/commands/extcmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c +index 90a5ca24a..c236be13a 100644 +--- a/grub-core/commands/extcmd.c ++++ b/grub-core/commands/extcmd.c +@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args, + } + + state = grub_arg_list_alloc (ext, argc, args); ++ if (state == NULL) ++ return grub_errno; ++ + if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc)) + { + context.state = state; diff --git a/SOURCES/0626-commands-ls-Fix-NULL-dereference.patch b/SOURCES/0626-commands-ls-Fix-NULL-dereference.patch new file mode 100644 index 0000000..9cca39c --- /dev/null +++ b/SOURCES/0626-commands-ls-Fix-NULL-dereference.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 11:08:23 +0100 +Subject: [PATCH] commands/ls: Fix NULL dereference + +The grub_strrchr() may return NULL when the dirname do not contain "/". +This can happen on broken filesystems. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/ls.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c +index d4dcffd31..ac6936bc7 100644 +--- a/grub-core/commands/ls.c ++++ b/grub-core/commands/ls.c +@@ -241,7 +241,11 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human) + + grub_file_close (file); + +- p = grub_strrchr (dirname, '/') + 1; ++ p = grub_strrchr (dirname, '/'); ++ if (p == NULL) ++ goto fail; ++ ++p; ++ + dirname = grub_strndup (dirname, p - dirname); + if (! dirname) + goto fail; diff --git a/SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch b/SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch new file mode 100644 index 0000000..9db341a --- /dev/null +++ b/SOURCES/0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 19:24:29 +0000 +Subject: [PATCH] commands/pgp: Unregister the "check_signatures" hooks on + module unload + +If the hooks are not removed they can be called after the module has +been unloaded leading to an use-after-free. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/pgp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c +index 55d354be0..15e981304 100644 +--- a/grub-core/commands/pgp.c ++++ b/grub-core/commands/pgp.c +@@ -982,6 +982,8 @@ GRUB_MOD_INIT(pgp) + + GRUB_MOD_FINI(pgp) + { ++ grub_register_variable_hook ("check_signatures", NULL, NULL); ++ grub_env_unset ("check_signatures"); + grub_verifier_unregister (&grub_pubkey_verifier); + grub_unregister_extcmd (cmd); + grub_unregister_extcmd (cmd_trust); diff --git a/SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch b/SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 0000000..c2b2336 --- /dev/null +++ b/SOURCES/0628-normal-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:46:55 +0000 +Subject: [PATCH] normal: Remove variables hooks on module unload + +The normal module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload normal module now but fix the +issues for completeness. + +On the occasion replace 0s with NULLs for "pager" variable +hooks unregister. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/normal/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index f5e9b54f7..b61f01ae5 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -670,7 +670,9 @@ GRUB_MOD_FINI(normal) + grub_xputs = grub_xputs_saved; + + grub_set_history (0); +- grub_register_variable_hook ("pager", 0, 0); ++ grub_register_variable_hook ("pager", NULL, NULL); ++ grub_register_variable_hook ("color_normal", NULL, NULL); ++ grub_register_variable_hook ("color_highlight", NULL, NULL); + grub_fs_autoload_hook = 0; + grub_unregister_command (cmd_clear); + } diff --git a/SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch b/SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 0000000..58583aa --- /dev/null +++ b/SOURCES/0629-gettext-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:52:06 +0000 +Subject: [PATCH] gettext: Remove variables hooks on module unload + +The gettext module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload gettext module because normal +module depends on it. Though fix the issues for completeness. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/gettext/gettext.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 84d520cd4..1344c7c81 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -520,6 +520,10 @@ GRUB_MOD_INIT (gettext) + + GRUB_MOD_FINI (gettext) + { ++ grub_register_variable_hook ("locale_dir", NULL, NULL); ++ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); ++ grub_register_variable_hook ("lang", NULL, NULL); ++ + grub_gettext_delete_list (&main_context); + grub_gettext_delete_list (&secondary_context); + diff --git a/SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch b/SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch new file mode 100644 index 0000000..3218850 --- /dev/null +++ b/SOURCES/0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:56 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read + +Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may +overflow leading to subsequent OOB write or read. This patch fixes the +issue by replacing grub_zalloc() and explicit multiplication with +grub_calloc() which does the same thing in safe manner. + +Fixes: CVE-2024-45776 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 1344c7c81..cb304ebeb 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx, + for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log; + ctx->grub_gettext_max_log++); + +- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max +- * sizeof (ctx->grub_gettext_msg_list[0])); ++ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max, ++ sizeof (ctx->grub_gettext_msg_list[0])); + if (!ctx->grub_gettext_msg_list) + { + grub_file_close (fd); diff --git a/SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch b/SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 0000000..0cdad3c --- /dev/null +++ b/SOURCES/0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,53 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:57 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write + +The size calculation of the translation buffer in +grub_gettext_getstr_from_position() may overflow +to 0 leading to heap OOB write. This patch fixes +the issue by using grub_add() and checking for +an overflow. + +Fixes: CVE-2024-45777 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index cb304ebeb..9654bb3fd 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + char *translation; + struct string_descriptor desc; + grub_err_t err; ++ grub_size_t alloc_sz; + + internal_position = (off + position * sizeof (desc)); + +@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + length = grub_cpu_to_le32 (desc.length); + offset = grub_cpu_to_le32 (desc.offset); + +- translation = grub_malloc (length + 1); ++ if (grub_add (length, 1, &alloc_sz)) ++ return NULL; ++ ++ translation = grub_malloc (alloc_sz); + if (!translation) + return NULL; + diff --git a/SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch b/SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch new file mode 100644 index 0000000..37e352a --- /dev/null +++ b/SOURCES/0632-commands-read-Fix-an-integer-overflow-when-supplying.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jonathan Bar Or +Date: Thu, 23 Jan 2025 19:17:05 +0100 +Subject: [PATCH] commands/read: Fix an integer overflow when supplying more + than 2^31 characters + +The grub_getline() function currently has a signed integer variable "i" +that can be overflown when user supplies more than 2^31 characters. +It results in a memory corruption of the allocated line buffer as well +as supplying large negative values to grub_realloc(). + +Fixes: CVE-2025-0690 + +Reported-by: Jonathan Bar Or +Signed-off-by: Jonathan Bar Or +Reviewed-by: Daniel Kiper +--- + grub-core/commands/read.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c +index fe3e88b15..7b6735b79 100644 +--- a/grub-core/commands/read.c ++++ b/grub-core/commands/read.c +@@ -25,19 +25,21 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + + static char * + grub_getline (void) + { +- int i; ++ grub_size_t i; + char *line; + char *tmp; + char c; ++ grub_size_t alloc_size; + + i = 0; +- line = grub_malloc (1 + i + sizeof('\0')); ++ line = grub_malloc (1 + sizeof('\0')); + if (! line) + return NULL; + +@@ -50,8 +52,18 @@ grub_getline (void) + line[i] = c; + if (grub_isprint (c)) + grub_printf ("%c", c); +- i++; +- tmp = grub_realloc (line, 1 + i + sizeof('\0')); ++ if (grub_add (i, 1, &i)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ if (grub_add (i, 1 + sizeof('\0'), &alloc_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ tmp = grub_realloc (line, alloc_size); ++ + if (! tmp) + { + grub_free (line); diff --git a/SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch b/SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch new file mode 100644 index 0000000..4c932b9 --- /dev/null +++ b/SOURCES/0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:41 +0000 +Subject: [PATCH] commands/test: Stack overflow due to unlimited recursion + depth + +The test_parse() evaluates test expression recursively. Due to lack of +recursion depth check a specially crafted expression may cause a stack +overflow. The recursion is only triggered by the parentheses usage and +it can be unlimited. However, sensible expressions are unlikely to +contain more than a few parentheses. So, this patch limits the recursion +depth to 100, which should be sufficient. + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/commands/test.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/test.c b/grub-core/commands/test.c +index 13c6ed953..0a6f51bf3 100644 +--- a/grub-core/commands/test.c ++++ b/grub-core/commands/test.c +@@ -29,6 +29,9 @@ + + GRUB_MOD_LICENSE ("GPLv3+"); + ++/* Set a limit on recursion to avoid stack overflow. */ ++#define MAX_TEST_RECURSION_DEPTH 100 ++ + /* A simple implementation for signed numbers. */ + static int + grub_strtosl (char *arg, char **end, int base) +@@ -150,7 +153,7 @@ get_fileinfo (char *path, struct test_parse_ctx *ctx) + + /* Parse a test expression starting from *argn. */ + static int +-test_parse (char **args, int *argn, int argc) ++test_parse (char **args, int *argn, int argc, int *depth) + { + struct test_parse_ctx ctx = { + .and = 1, +@@ -387,13 +390,24 @@ test_parse (char **args, int *argn, int argc) + if (grub_strcmp (args[*argn], ")") == 0) + { + (*argn)++; ++ if (*depth > 0) ++ (*depth)--; ++ + return ctx.or || ctx.and; + } + /* Recursively invoke if parenthesis. */ + if (grub_strcmp (args[*argn], "(") == 0) + { + (*argn)++; +- update_val (test_parse (args, argn, argc), &ctx); ++ ++ if (++(*depth) > MAX_TEST_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("max recursion depth exceeded")); ++ depth--; ++ return ctx.or || ctx.and; ++ } ++ ++ update_val (test_parse (args, argn, argc, depth), &ctx); + continue; + } + +@@ -428,11 +442,12 @@ grub_cmd_test (grub_command_t cmd __attribute__ ((unused)), + int argc, char **args) + { + int argn = 0; ++ int depth = 0; + + if (argc >= 1 && grub_strcmp (args[argc - 1], "]") == 0) + argc--; + +- return test_parse (args, &argn, argc) ? GRUB_ERR_NONE ++ return test_parse (args, &argn, argc, &depth) ? GRUB_ERR_NONE + : grub_error (GRUB_ERR_TEST_FAILURE, N_("false")); + } + diff --git a/SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch b/SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch new file mode 100644 index 0000000..a999146 --- /dev/null +++ b/SOURCES/0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 20:29:39 +0100 +Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode + +The dump enables a user to read memory which should not be possible +in lockdown mode. + +Fixes: CVE-2025-1118 + +Reported-by: B Horn +Reported-by: Jonathan Bar Or +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2001043cf..9efb7718c 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -215,8 +215,8 @@ GRUB_MOD_INIT(minicmd) + grub_register_command ("help", grub_mini_cmd_help, + 0, N_("Show this message.")); + cmd_dump = +- grub_register_command ("dump", grub_mini_cmd_dump, +- N_("ADDR [SIZE]"), N_("Show memory contents.")); ++ grub_register_command_lockdown ("dump", grub_mini_cmd_dump, ++ N_("ADDR [SIZE]"), N_("Show memory contents.")); + cmd_rmmod = + grub_register_command ("rmmod", grub_mini_cmd_rmmod, + N_("MODULE"), N_("Remove a module.")); diff --git a/SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch b/SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch new file mode 100644 index 0000000..6e14744 --- /dev/null +++ b/SOURCES/0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 20:37:10 +0100 +Subject: [PATCH] commands/memrw: Disable memory reading in lockdown mode + +With the rest of module being blocked in lockdown mode it does not make +a lot of sense to leave memory reading enabled. This also goes in par +with disabling the dump command. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/memrw.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index d401a6db0..3542683d1 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -122,17 +122,20 @@ grub_cmd_write (grub_command_t cmd, int argc, char **argv) + GRUB_MOD_INIT(memrw) + { + cmd_read_byte = +- grub_register_extcmd ("read_byte", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 8-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_byte", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 8-bit value from ADDR."), ++ options); + cmd_read_word = +- grub_register_extcmd ("read_word", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 16-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_word", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 16-bit value from ADDR."), ++ options); + cmd_read_dword = +- grub_register_extcmd ("read_dword", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 32-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_dword", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 32-bit value from ADDR."), ++ options); + cmd_write_byte = + grub_register_command_lockdown ("write_byte", grub_cmd_write, + N_("ADDR VALUE [MASK]"), diff --git a/SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch b/SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch new file mode 100644 index 0000000..ae523f8 --- /dev/null +++ b/SOURCES/0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 19 Apr 2024 22:31:45 +0100 +Subject: [PATCH] commands/hexdump: Disable memory reading in lockdown mode + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/hexdump.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c +index eaa12465b..d6f61d98a 100644 +--- a/grub-core/commands/hexdump.c ++++ b/grub-core/commands/hexdump.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -51,7 +52,11 @@ grub_cmd_hexdump (grub_extcmd_context_t ctxt, int argc, char **args) + length = (state[1].set) ? grub_strtoul (state[1].arg, 0, 0) : 256; + + if (!grub_strcmp (args[0], "(mem)")) +- hexdump (skip, (char *) (grub_addr_t) skip, length); ++ { ++ if (grub_is_lockdown() == GRUB_LOCKDOWN_ENABLED) ++ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("memory reading is disabled in lockdown mode")); ++ hexdump (skip, (char *) (grub_addr_t) skip, length); ++ } + else if ((args[0][0] == '(') && (args[0][namelen - 1] == ')')) + { + grub_disk_t disk; diff --git a/SOURCES/0637-fs-bfs-Disable-under-lockdown.patch b/SOURCES/0637-fs-bfs-Disable-under-lockdown.patch new file mode 100644 index 0000000..ec83976 --- /dev/null +++ b/SOURCES/0637-fs-bfs-Disable-under-lockdown.patch @@ -0,0 +1,52 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 15:59:43 +1100 +Subject: [PATCH] fs/bfs: Disable under lockdown + +The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown. +This will also disable the AFS. + +Fixes: CVE-2024-45778 +Fixes: CVE-2024-45779 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/bfs.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index 6afdfc987..e70aaa448 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1104,8 +1105,11 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); +- grub_bfs_fs.mod = mod; +- grub_fs_register (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_bfs_fs.mod = mod; ++ grub_fs_register (&grub_bfs_fs); ++ } + } + + #ifdef MODE_AFS +@@ -1114,5 +1118,6 @@ GRUB_MOD_FINI (afs) + GRUB_MOD_FINI (bfs) + #endif + { +- grub_fs_unregister (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_bfs_fs); + } diff --git a/SOURCES/0638-fs-Disable-many-filesystems-under-lockdown.patch b/SOURCES/0638-fs-Disable-many-filesystems-under-lockdown.patch new file mode 100644 index 0000000..9b9ddb2 --- /dev/null +++ b/SOURCES/0638-fs-Disable-many-filesystems-under-lockdown.patch @@ -0,0 +1,391 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 16:20:45 +1100 +Subject: [PATCH] fs: Disable many filesystems under lockdown + +The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat, +hfsplus, iso9660, squash4, tar, xfs and zfs. + +The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were +reported by Jonathan Bar Or . + +Fixes: CVE-2025-0677 +Fixes: CVE-2025-0684 +Fixes: CVE-2025-0685 +Fixes: CVE-2025-0686 +Fixes: CVE-2025-0689 + +Suggested-by: Daniel Axtens +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 11 ++++++++--- + grub-core/fs/cbfs.c | 11 ++++++++--- + grub-core/fs/jfs.c | 11 ++++++++--- + grub-core/fs/minix.c | 11 ++++++++--- + grub-core/fs/nilfs2.c | 11 ++++++++--- + grub-core/fs/ntfs.c | 11 ++++++++--- + grub-core/fs/reiserfs.c | 11 ++++++++--- + grub-core/fs/romfs.c | 11 ++++++++--- + grub-core/fs/sfs.c | 11 ++++++++--- + grub-core/fs/udf.c | 11 ++++++++--- + grub-core/fs/ufs.c | 11 ++++++++--- + 11 files changed, 88 insertions(+), 33 deletions(-) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index 6347ca368..2a850632e 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -699,12 +700,16 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { +- grub_affs_fs.mod = mod; +- grub_fs_register (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_affs_fs.mod = mod; ++ grub_fs_register (&grub_affs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(affs) + { +- grub_fs_unregister (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_affs_fs); + } +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 395edcbbd..c82980375 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -390,13 +391,17 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif +- grub_cbfs_fs.mod = mod; +- grub_fs_register (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_cbfs_fs.mod = mod; ++ grub_fs_register (&grub_cbfs_fs); ++ } + } + + GRUB_MOD_FINI (cbfs) + { +- grub_fs_unregister (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_cbfs_fs); + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + fini_cbfsdisk (); + #endif +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 46941248b..e08771b44 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -998,12 +999,16 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { +- grub_jfs_fs.mod = mod; +- grub_fs_register (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_jfs_fs.mod = mod; ++ grub_fs_register (&grub_jfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(jfs) + { +- grub_fs_unregister (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_jfs_fs); + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index 28571c49e..38e658763 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -716,8 +717,11 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { +- grub_minix_fs.mod = mod; +- grub_fs_register (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_minix_fs.mod = mod; ++ grub_fs_register (&grub_minix_fs); ++ } + my_mod = mod; + } + +@@ -739,5 +743,6 @@ GRUB_MOD_FINI(minix) + #endif + #endif + { +- grub_fs_unregister (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_minix_fs); + } +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index 3c1e4d1f6..6d1e25fb6 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1231,12 +1232,16 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); +- grub_nilfs2_fs.mod = mod; +- grub_fs_register (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_nilfs2_fs.mod = mod; ++ grub_fs_register (&grub_nilfs2_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (nilfs2) + { +- grub_fs_unregister (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_nilfs2_fs); + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 9244e95dd..1ad3a2715 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1537,12 +1538,16 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { +- grub_ntfs_fs.mod = mod; +- grub_fs_register (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ntfs_fs.mod = mod; ++ grub_fs_register (&grub_ntfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (ntfs) + { +- grub_fs_unregister (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ntfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index e65b81467..72e724f4c 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1407,12 +1408,16 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { +- grub_reiserfs_fs.mod = mod; +- grub_fs_register (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_reiserfs_fs.mod = mod; ++ grub_fs_register (&grub_reiserfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(reiserfs) + { +- grub_fs_unregister (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_reiserfs_fs); + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index f282cff86..d7817cdc5 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -475,11 +476,15 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { +- grub_romfs_fs.mod = mod; +- grub_fs_register (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_romfs_fs.mod = mod; ++ grub_fs_register (&grub_romfs_fs); ++ } + } + + GRUB_MOD_FINI(romfs) + { +- grub_fs_unregister (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_romfs_fs); + } +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index c6b9fb49a..a272aea0a 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -779,12 +780,16 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { +- grub_sfs_fs.mod = mod; +- grub_fs_register (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_sfs_fs.mod = mod; ++ grub_fs_register (&grub_sfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(sfs) + { +- grub_fs_unregister (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_sfs_fs); + } +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 8db2b5686..406260901 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -1382,12 +1383,16 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { +- grub_udf_fs.mod = mod; +- grub_fs_register (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_udf_fs.mod = mod; ++ grub_fs_register (&grub_udf_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (udf) + { +- grub_fs_unregister (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_udf_fs); + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index a2c63d646..844a439f8 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -899,8 +900,11 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { +- grub_ufs_fs.mod = mod; +- grub_fs_register (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ufs_fs.mod = mod; ++ grub_fs_register (&grub_ufs_fs); ++ } + my_mod = mod; + } + +@@ -914,6 +918,7 @@ GRUB_MOD_FINI(ufs1) + #endif + #endif + { +- grub_fs_unregister (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ufs_fs); + } + diff --git a/SOURCES/0639-disk-Use-safe-math-macros-to-prevent-overflows.patch b/SOURCES/0639-disk-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 0000000..269a445 --- /dev/null +++ b/SOURCES/0639-disk-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,367 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:09 +0000 +Subject: [PATCH] disk: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/cryptodisk.c | 36 ++++++++++++++++++------ + grub-core/disk/diskfilter.c | 9 ++++-- + grub-core/disk/ieee1275/ofdisk.c | 60 ++++++++++++++++++++++++++++++++++------ + grub-core/disk/ldm.c | 37 +++++++++++++++++++++---- + grub-core/disk/memdisk.c | 7 ++++- + 5 files changed, 123 insertions(+), 26 deletions(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 78a902515..871640685 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_UTIL + #include +@@ -1039,7 +1040,7 @@ static char * + luks_script_get (grub_size_t *sz) + { + grub_cryptodisk_t i; +- grub_size_t size = 0; ++ grub_size_t size = 0, mul; + char *ptr, *ret; + + *sz = 0; +@@ -1047,16 +1048,33 @@ luks_script_get (grub_size_t *sz) + for (i = cryptodisk_list; i != NULL; i = i->next) + if (grub_strcmp (i->modname, "luks") == 0) + { +- size += sizeof ("luks_mount "); +- size += grub_strlen (i->uuid); +- size += grub_strlen (i->cipher->cipher->name); +- size += 54; +- if (i->essiv_hash) +- size += grub_strlen (i->essiv_hash->name); +- size += i->keysize * 2; ++ if (grub_add (size, grub_strlen (i->modname), &size) || ++ grub_add (size, sizeof ("_mount") + 60, &size) || ++ grub_add (size, grub_strlen (i->uuid), &size) || ++ grub_add (size, grub_strlen (i->cipher->cipher->name), &size) || ++ grub_mul (i->keysize, 2, &mul) || ++ grub_add (size, mul, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } ++ if (i->essiv_hash) ++ { ++ if (grub_add (size, grub_strlen (i->essiv_hash->name), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } ++ } + } + +- ret = grub_malloc (size + 1); ++ if (grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } ++ ++ ret = grub_malloc (size); + if (!ret) + return 0; + +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index 2be019269..a881aa2c9 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_UTIL + #include + #include +@@ -1013,7 +1014,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + { + struct grub_diskfilter_vg *array; + int i; +- grub_size_t j; ++ grub_size_t j, sz; + grub_uint64_t totsize; + struct grub_diskfilter_pv *pv; + grub_err_t err; +@@ -1107,7 +1108,11 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + } + array->lvs->vg = array; + +- array->lvs->idname = grub_malloc (sizeof ("mduuid/") + 2 * uuidlen); ++ if (grub_mul (uuidlen, 2, &sz) || ++ grub_add (sz, sizeof ("mduuid/"), &sz)) ++ goto fail; ++ ++ array->lvs->idname = grub_malloc (sz); + if (!array->lvs->idname) + goto fail; + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 98325ca98..c1b07d087 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + static char *last_devpath; + static grub_ieee1275_ihandle_t last_ihandle; +@@ -80,6 +81,7 @@ ofdisk_hash_add_real (char *devpath) + struct ofdisk_hash_ent **head = &ofdisk_hash[ofdisk_hash_fn(devpath)]; + const char *iptr; + char *optr; ++ grub_size_t sz; + + p = grub_zalloc (sizeof (*p)); + if (!p) +@@ -87,8 +89,14 @@ ofdisk_hash_add_real (char *devpath) + + p->devpath = devpath; + +- p->grub_devpath = grub_malloc (sizeof ("ieee1275/") +- + 2 * grub_strlen (p->devpath)); ++ if (grub_mul (grub_strlen (p->devpath), 2, &sz) || ++ grub_add (sz, sizeof ("ieee1275/"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ p->grub_devpath = grub_malloc (sz); + + if (!p->grub_devpath) + { +@@ -98,7 +106,13 @@ ofdisk_hash_add_real (char *devpath) + + if (! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_NO_PARTITION_0)) + { +- p->open_path = grub_malloc (grub_strlen (p->devpath) + 3); ++ if (grub_add (grub_strlen (p->devpath), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of an open path")); ++ return NULL; ++ } ++ ++ p->open_path = grub_malloc (sz); + if (!p->open_path) + { + grub_free (p->grub_devpath); +@@ -224,7 +238,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + args; + char *buf, *bufptr; + unsigned i; +- ++ grub_size_t sz; + + RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle) + if (! ihandle) +@@ -245,7 +259,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + return; + } + +- buf = grub_malloc (grub_strlen (alias->path) + 32); ++ if (grub_add (grub_strlen (alias->path), 32, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for vscsi"); ++ grub_ieee1275_close (ihandle); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -289,9 +310,15 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + grub_uint64_t *table; + grub_uint16_t table_size; + grub_ieee1275_ihandle_t ihandle; ++ grub_size_t sz; + +- buf = grub_malloc (grub_strlen (alias->path) + +- sizeof ("/disk@7766554433221100")); ++ if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for sas_ioa"); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -431,9 +458,17 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, + static char * + compute_dev_path (const char *name) + { +- char *devpath = grub_malloc (grub_strlen (name) + 3); ++ char *devpath; + char *p, c; ++ grub_size_t sz; + ++ if (grub_add (grub_strlen (name), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ devpath = grub_malloc (sz); + if (!devpath) + return NULL; + +@@ -660,6 +695,7 @@ insert_bootpath (void) + char *bootpath; + grub_ssize_t bootpath_size; + char *type; ++ grub_size_t sz; + + if (grub_ieee1275_get_property_length (grub_ieee1275_chosen, "bootpath", + &bootpath_size) +@@ -670,7 +706,13 @@ insert_bootpath (void) + return; + } + +- bootpath = (char *) grub_malloc ((grub_size_t) bootpath_size + 64); ++ if (grub_add (bootpath_size, 64, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining bootpath size")); ++ return; ++ } ++ ++ bootpath = (char *) grub_malloc (sz); + if (! bootpath) + { + grub_print_error (); +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index e82e9899f..973fbfdcb 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -220,6 +220,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -251,7 +252,13 @@ make_vg (grub_disk_t disk, + grub_free (pv); + goto fail2; + } +- pv->internal_id = grub_malloc (ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->internal_id = grub_malloc (sz); + if (!pv->internal_id) + { + grub_free (pv); +@@ -276,7 +283,15 @@ make_vg (grub_disk_t disk, + goto fail2; + } + pv->id.uuidlen = *ptr; +- pv->id.uuid = grub_malloc (pv->id.uuidlen + 1); ++ ++ if (grub_add (pv->id.uuidlen, 1, &sz)) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->id.uuid = grub_malloc (sz); + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +@@ -343,7 +358,13 @@ make_vg (grub_disk_t disk, + grub_free (lv); + goto fail2; + } +- lv->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (lv->segments); ++ grub_free (lv); ++ goto fail2; ++ } ++ lv->internal_id = grub_malloc (sz); + if (!lv->internal_id) + { + grub_free (lv); +@@ -455,6 +476,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -489,7 +511,13 @@ make_vg (grub_disk_t disk, + { + goto fail2; + } +- comp->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (comp); ++ goto fail2; ++ } ++ comp->internal_id = grub_malloc (sz); ++ + if (!comp->internal_id) + { + grub_free (comp); +@@ -639,7 +667,6 @@ make_vg (grub_disk_t disk, + if (lv->segments->node_alloc == lv->segments->node_count) + { + void *t; +- grub_size_t sz; + + if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || + grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index e5ffc01bf..18863305e 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -96,7 +97,11 @@ GRUB_MOD_INIT(memdisk) + + grub_dprintf ("memdisk", "Found memdisk image at %p\n", memdisk_orig_addr); + +- memdisk_size = header->size - sizeof (struct grub_module_header); ++ if (grub_sub (header->size, sizeof (struct grub_module_header), &memdisk_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while obtaining memdisk size"); ++ return; ++ } + memdisk_addr = grub_malloc (memdisk_size); + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); diff --git a/SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch b/SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch new file mode 100644 index 0000000..9ff3a7b --- /dev/null +++ b/SOURCES/0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:10 +0000 +Subject: [PATCH] disk: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/lvm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 7e86bb7df..47a89e6d0 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -634,8 +634,7 @@ error_parsing_metadata: + goto lvs_segment_fail; + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -723,8 +722,7 @@ error_parsing_metadata: + } + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "raids = ["); + if (p == NULL) diff --git a/SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch b/SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch new file mode 100644 index 0000000..9272cc3 --- /dev/null +++ b/SOURCES/0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch @@ -0,0 +1,134 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:11 +0000 +Subject: [PATCH] disk: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), grub_zalloc() or grub_calloc(), these functions can +fail if we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +On the occasion make a NULL check in ATA code more obvious. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ata.c | 4 ++-- + grub-core/disk/ldm.c | 6 ++++++ + grub-core/disk/lvm.c | 14 ++++++++++++++ + grub-core/disk/memdisk.c | 2 ++ + 4 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/grub-core/disk/ata.c b/grub-core/disk/ata.c +index 8ba4e5c50..65d24103e 100644 +--- a/grub-core/disk/ata.c ++++ b/grub-core/disk/ata.c +@@ -112,10 +112,10 @@ grub_ata_identify (struct grub_ata *dev) + return grub_atapi_identify (dev); + + info64 = grub_malloc (GRUB_DISK_SECTOR_SIZE); ++ if (info64 == NULL) ++ return grub_errno; + info32 = (grub_uint32_t *) info64; + info16 = (grub_uint16_t *) info64; +- if (! info16) +- return grub_errno; + + grub_memset (&parms, 0, sizeof (parms)); + parms.buffer = info16; +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 973fbfdcb..1510fb35a 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -292,6 +292,12 @@ make_vg (grub_disk_t disk, + } + + pv->id.uuid = grub_malloc (sz); ++ if (pv->id.uuid == NULL) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 47a89e6d0..4fce7f226 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -332,6 +332,8 @@ error_parsing_metadata: + break; + + pv = grub_zalloc (sizeof (*pv)); ++ if (pv == NULL) ++ goto fail4; + q = p; + while (*q != ' ' && q < mda_end) + q++; +@@ -341,6 +343,8 @@ error_parsing_metadata: + + s = q - p; + pv->name = grub_malloc (s + 1); ++ if (pv->name == NULL) ++ goto pvs_fail_noname; + grub_memcpy (pv->name, p, s); + pv->name[s] = '\0'; + +@@ -413,6 +417,8 @@ error_parsing_metadata: + break; + + lv = grub_zalloc (sizeof (*lv)); ++ if (lv == NULL) ++ goto fail4; + + q = p; + while (*q != ' ' && q < mda_end) +@@ -508,6 +514,8 @@ error_parsing_metadata: + goto lvs_fail; + } + lv->segments = grub_calloc (lv->segment_count, sizeof (*seg)); ++ if (lv->segments == NULL) ++ goto lvs_fail; + seg = lv->segments; + + for (i = 0; i < lv->segment_count; i++) +@@ -575,6 +583,8 @@ error_parsing_metadata: + + seg->nodes = grub_calloc (seg->node_count, + sizeof (*stripe)); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + stripe = seg->nodes; + + p = grub_strstr (p, "stripes = ["); +@@ -635,6 +645,8 @@ error_parsing_metadata: + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -723,6 +735,8 @@ error_parsing_metadata: + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "raids = ["); + if (p == NULL) +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index 18863305e..63fc8f1a6 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -103,6 +103,8 @@ GRUB_MOD_INIT(memdisk) + return; + } + memdisk_addr = grub_malloc (memdisk_size); ++ if (memdisk_addr == NULL) ++ return; + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); + grub_memmove (memdisk_addr, memdisk_orig_addr, memdisk_size); diff --git a/SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch b/SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch new file mode 100644 index 0000000..fb6bd65 --- /dev/null +++ b/SOURCES/0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:12 +0000 +Subject: [PATCH] disk/ieee1275/ofdisk: Call grub_ieee1275_close() when + grub_malloc() fails + +In the dev_iterate() function a handle is opened but isn't closed when +grub_malloc() returns NULL. We should fix this by closing it on error. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ieee1275/ofdisk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index c1b07d087..c50614f03 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -268,7 +268,10 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + + buf = grub_malloc (sz); + if (!buf) +- return; ++ { ++ grub_ieee1275_close (ihandle); ++ return; ++ } + bufptr = grub_stpcpy (buf, alias->path); + + for (i = 0; i < args.nentries; i++) diff --git a/SOURCES/0643-fs-Use-safe-math-macros-to-prevent-overflows.patch b/SOURCES/0643-fs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 0000000..3c47b6c --- /dev/null +++ b/SOURCES/0643-fs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,353 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:36 +0000 +Subject: [PATCH] fs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/archelp.c | 9 ++++++++- + grub-core/fs/btrfs.c | 34 ++++++++++++++++++++++++++++------ + grub-core/fs/cpio_common.c | 16 ++++++++++++++-- + grub-core/fs/f2fs.c | 17 +++++++++++++++-- + grub-core/fs/ntfscomp.c | 9 ++++++++- + grub-core/fs/squash4.c | 12 +++++++++--- + grub-core/fs/xfs.c | 17 +++++++++++++++-- + 7 files changed, 97 insertions(+), 17 deletions(-) + +diff --git a/grub-core/fs/archelp.c b/grub-core/fs/archelp.c +index 0cf544f6f..6491f74f9 100644 +--- a/grub-core/fs/archelp.c ++++ b/grub-core/fs/archelp.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -68,6 +69,7 @@ handle_symlink (struct grub_archelp_data *data, + char *rest; + char *linktarget; + grub_size_t linktarget_len; ++ grub_size_t sz; + + *restart = 0; + +@@ -98,7 +100,12 @@ handle_symlink (struct grub_archelp_data *data, + if (linktarget[0] == '\0') + return GRUB_ERR_NONE; + linktarget_len = grub_strlen (linktarget); +- target = grub_malloc (linktarget_len + grub_strlen (*name) + 2); ++ ++ if (grub_add (linktarget_len, grub_strlen (*name), &sz) || ++ grub_add (sz, 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("link target length overflow")); ++ ++ target = grub_malloc (sz); + if (!target) + return grub_errno; + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 65213549e..646543f5d 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -1500,6 +1500,7 @@ find_path (struct grub_btrfs_data *data, + char *origpath = NULL; + unsigned symlinks_max = 32; + const char *relpath = grub_env_get ("btrfs_relative_path"); ++ grub_size_t sz; + + follow_default = 0; + origpath = grub_strdup (path); +@@ -1626,9 +1627,15 @@ find_path (struct grub_btrfs_data *data, + struct grub_btrfs_dir_item *cdirel; + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory item size overflow")); ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + grub_free (path_alloc); +@@ -1692,8 +1699,16 @@ find_path (struct grub_btrfs_data *data, + grub_free (origpath); + return err; + } +- tmp = grub_malloc (grub_le_to_cpu64 (inode.size) +- + grub_strlen (path) + 1); ++ ++ if (grub_add (grub_le_to_cpu64 (inode.size), grub_strlen (path), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_free (direl); ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ } ++ tmp = grub_malloc (sz); + if (!tmp) + { + grub_free (direl); +@@ -1835,6 +1850,7 @@ grub_btrfs_dir (grub_device_t device, const char *path, + grub_uint8_t type; + char *new_path = NULL; + grub_size_t est_size = 0; ++ grub_size_t sz; + + if (!data) + return grub_errno; +@@ -1884,9 +1900,15 @@ grub_btrfs_dir (grub_device_t device, const char *path, + } + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory element size overflow")); ++ r = -grub_errno; ++ break; ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + r = -grub_errno; +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 50fea47d1..5760072c5 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -43,6 +44,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + struct head hd; + grub_size_t namesize; + grub_uint32_t modeval; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + +@@ -71,7 +73,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + + *mode = modeval; + +- *name = grub_malloc (namesize + 1); ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("file name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + +@@ -101,10 +106,17 @@ grub_cpio_get_link_target (struct grub_archelp_data *data) + { + char *ret; + grub_err_t err; ++ grub_size_t sz; + + if (data->size == 0) + return grub_strdup (""); +- ret = grub_malloc (data->size + 1); ++ ++ if (grub_add (data->size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("target data size overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (sz); + if (!ret) + return NULL; + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index 149f33695..0af62f1a1 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -953,6 +954,7 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + char *symlink; + struct grub_fshelp_node *diro = node; + grub_uint64_t filesize; ++ grub_size_t sz; + + if (!diro->inode_read) + { +@@ -963,7 +965,12 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + + filesize = grub_f2fs_file_size(&diro->inode.i); + +- symlink = grub_malloc (filesize + 1); ++ if (grub_add (filesize, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -992,6 +999,7 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + enum FILE_TYPE ftype; + int name_len; + int ret; ++ int sz; + + if (grub_f2fs_test_bit_le (i, ctx->bitmap) == 0) + { +@@ -1005,7 +1013,12 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + if (name_len >= F2FS_NAME_LEN) + return 0; + +- filename = grub_malloc (name_len + 1); ++ if (grub_add (name_len, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory entry name length overflow")); ++ return 0; ++ } ++ filename = grub_malloc (sz); + if (!filename) + return 0; + +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index 3cd97d337..4bf95c85d 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -310,6 +311,7 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + { + grub_err_t ret; + grub_disk_addr_t vcn; ++ int log_sz; + + if (ctx->attr->sbuf) + { +@@ -349,7 +351,12 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + } + + ctx->comp.comp_head = ctx->comp.comp_tail = 0; +- ctx->comp.cbuf = grub_malloc (1 << (ctx->comp.log_spc + GRUB_NTFS_BLK_SHR)); ++ if (grub_add (ctx->comp.log_spc, GRUB_NTFS_BLK_SHR, &log_sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("compression buffer size overflow")); ++ return 0; ++ } ++ ctx->comp.cbuf = grub_malloc (1 << log_sz); + if (!ctx->comp.cbuf) + return 0; + +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index 1505832d5..4fe843935 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -460,11 +460,11 @@ grub_squash_read_symlink (grub_fshelp_node_t node) + { + char *ret; + grub_err_t err; +- grub_size_t sz; ++ grub_uint32_t sz; + + if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz)) + { +- grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink name length overflow")); + return NULL; + } + +@@ -577,6 +577,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + struct grub_squash_dirent di; + struct grub_squash_inode ino; + grub_size_t sz; ++ grub_uint16_t nlen; + + err = read_chunk (dir->data, &di, sizeof (di), + grub_le_to_cpu64 (dir->data->sb.diroffset) +@@ -592,7 +593,12 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + if (err) + return 0; + +- buf = grub_malloc (grub_le_to_cpu16 (di.namelen) + 2); ++ if (grub_add (grub_le_to_cpu16 (di.namelen), 2, &nlen)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return 0; ++ } ++ buf = grub_malloc (nlen); + if (!buf) + return 0; + err = read_chunk (dir->data, buf, +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 5b7643eb1..b0d371ee1 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -647,6 +647,7 @@ static char * + grub_xfs_read_symlink (grub_fshelp_node_t node) + { + grub_ssize_t size = grub_be_to_cpu64 (node->inode.size); ++ grub_size_t sz; + + if (size < 0) + { +@@ -668,7 +669,12 @@ grub_xfs_read_symlink (grub_fshelp_node_t node) + if (node->data->hascrc) + off = 56; + +- symlink = grub_malloc (size + 1); ++ if (grub_add (size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -718,8 +724,15 @@ static int iterate_dir_call_hook (grub_uint64_t ino, const char *filename, + { + struct grub_fshelp_node *fdiro; + grub_err_t err; ++ grub_size_t sz; + +- fdiro = grub_malloc (grub_xfs_fshelp_size(ctx->diro->data) + 1); ++ if (grub_add (grub_xfs_fshelp_size(ctx->diro->data), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory data size overflow")); ++ grub_print_error (); ++ return 0; ++ } ++ fdiro = grub_malloc (sz); + if (!fdiro) + { + grub_print_error (); diff --git a/SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch b/SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch new file mode 100644 index 0000000..37b531b --- /dev/null +++ b/SOURCES/0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch @@ -0,0 +1,82 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:37 +0000 +Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +The HFS+ and squash4 security vulnerabilities were reported by +Jonathan Bar Or . + +Fixes: CVE-2025-0678 +Fixes: CVE-2025-1125 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/btrfs.c | 4 ++-- + grub-core/fs/hfspluscomp.c | 9 +++++++-- + grub-core/fs/squash4.c | 8 ++++---- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 646543f5d..83336f606 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -1015,8 +1015,8 @@ grub_btrfs_mount (grub_device_t dev) + } + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + if (!data->devices_attached) + { + grub_free (data); +diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c +index d76f3f137..4965ef19a 100644 +--- a/grub-core/fs/hfspluscomp.c ++++ b/grub-core/fs/hfspluscomp.c +@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node) + return 0; + } + node->compress_index_size = grub_le_to_cpu32 (index_size); +- node->compress_index = grub_malloc (node->compress_index_size +- * sizeof (node->compress_index[0])); ++ node->compress_index = grub_calloc (node->compress_index_size, ++ sizeof (node->compress_index[0])); + if (!node->compress_index) + { + node->compressed = 0; + grub_free (attr_node); + return grub_errno; + } ++ ++ /* ++ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here ++ * due to relevant checks done in grub_calloc() above. ++ */ + if (grub_hfsplus_read_file (node, 0, 0, + 0x104 + sizeof (index_size), + node->compress_index_size +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index 4fe843935..b145bb9cd 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -810,10 +810,10 @@ direct_read (struct grub_squash_data *data, + break; + } + total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz); +- ino->block_sizes = grub_malloc (total_blocks +- * sizeof (ino->block_sizes[0])); +- ino->cumulated_block_sizes = grub_malloc (total_blocks +- * sizeof (ino->cumulated_block_sizes[0])); ++ ino->block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->block_sizes[0])); ++ ino->cumulated_block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->cumulated_block_sizes[0])); + if (!ino->block_sizes || !ino->cumulated_block_sizes) + { + grub_free (ino->block_sizes); diff --git a/SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch b/SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch new file mode 100644 index 0000000..3c8d3e5 --- /dev/null +++ b/SOURCES/0645-fs-Prevent-overflows-when-assigning-returned-values-.patch @@ -0,0 +1,105 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:38 +0000 +Subject: [PATCH] fs: Prevent overflows when assigning returned values from + read_number() + +The direct assignment of the unsigned long long value returned by +read_number() can potentially lead to an overflow on a 32-bit systems. +The fix replaces the direct assignments with calls to grub_cast() +which detects the overflows and safely assigns the values if no +overflow is detected. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/cpio_common.c | 18 ++++++++++++++---- + grub-core/fs/tar.c | 23 ++++++++++++++++------- + 2 files changed, 30 insertions(+), 11 deletions(-) + +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 5760072c5..bcb038025 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -57,11 +57,21 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + #endif + ) + return grub_error (GRUB_ERR_BAD_FS, "invalid cpio archive"); +- data->size = read_number (hd.filesize, ARRAY_SIZE (hd.filesize)); ++ ++ if (grub_cast (read_number (hd.filesize, ARRAY_SIZE (hd.filesize)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + if (mtime) +- *mtime = read_number (hd.mtime, ARRAY_SIZE (hd.mtime)); +- modeval = read_number (hd.mode, ARRAY_SIZE (hd.mode)); +- namesize = read_number (hd.namesize, ARRAY_SIZE (hd.namesize)); ++ { ++ if (grub_cast (read_number (hd.mtime, ARRAY_SIZE (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } ++ ++ if (grub_cast (read_number (hd.mode, ARRAY_SIZE (hd.mode)), &modeval)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ ++ if (grub_cast (read_number (hd.namesize, ARRAY_SIZE (hd.namesize)), &namesize)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("namesize overflow")); + + /* Don't allow negative numbers. */ + if (namesize >= 0x80000000) +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 01738ec55..b8f121828 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -99,9 +99,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'L') + { + grub_err_t err; +- grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t namesize; + +- if (grub_add (namesize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &namesize) || ++ grub_add (namesize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); + + *name = grub_malloc (sz); +@@ -123,9 +124,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'K') + { + grub_err_t err; +- grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t linksize; + +- if (grub_add (linksize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &linksize) || ++ grub_add (linksize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); + + if (data->linkname_alloc < sz) +@@ -174,15 +176,22 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + (*name)[extra_size + sizeof (hd.name)] = 0; + } + +- data->size = read_number (hd.size, sizeof (hd.size)); ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + data->dofs = data->hofs + GRUB_DISK_SECTOR_SIZE; + data->next_hofs = data->dofs + ((data->size + GRUB_DISK_SECTOR_SIZE - 1) & + ~(GRUB_DISK_SECTOR_SIZE - 1)); + if (mtime) +- *mtime = read_number (hd.mtime, sizeof (hd.mtime)); ++ { ++ if (grub_cast (read_number (hd.mtime, sizeof (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } + if (mode) + { +- *mode = read_number (hd.mode, sizeof (hd.mode)); ++ if (grub_cast (read_number (hd.mode, sizeof (hd.mode)), mode)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ + switch (hd.typeflag) + { + /* Hardlink. */ diff --git a/SOURCES/0646-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch b/SOURCES/0646-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 0000000..a753c0d --- /dev/null +++ b/SOURCES/0646-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,139 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:02 +0000 +Subject: [PATCH] fs/zfs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 51 +++++++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 44 insertions(+), 7 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 0c4b15f08..4384d6aae 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -2380,6 +2380,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + zap_dnode->endian) << DNODE_SHIFT); + grub_err_t err; + grub_zfs_endian_t endian; ++ grub_size_t sz; + + if (zap_verify (zap, zap_dnode->endian)) + return 0; +@@ -2441,8 +2442,14 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + if (le->le_type != ZAP_CHUNK_ENTRY) + continue; + +- buf = grub_malloc (grub_zfs_to_cpu16 (le->le_name_length, endian) +- * name_elem_length + 1); ++ if (grub_mul (grub_zfs_to_cpu16 (le->le_name_length, endian), name_elem_length, &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ grub_free (l); ++ return grub_errno; ++ } ++ buf = grub_malloc (sz); + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2863,6 +2870,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + && ((grub_zfs_to_cpu64(((znode_phys_t *) DN_BONUS (&dnode_path->dn.dn))->zp_mode, dnode_path->dn.endian) >> 12) & 0xf) == 0xa) + { + char *sym_value; ++ grub_size_t sz; + grub_size_t sym_sz; + int free_symval = 0; + char *oldpath = path, *oldpathbuf = path_buf; +@@ -2914,7 +2922,17 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + break; + free_symval = 1; + } +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ if (free_symval) ++ grub_free (sym_value); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -2948,7 +2966,8 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + { + void *sahdrp; + int hdrsize; +- ++ grub_size_t sz; ++ + if (dnode_path->dn.dn.dn_bonuslen != 0) + { + sahdrp = DN_BONUS (&dnode_path->dn.dn); +@@ -2981,7 +3000,15 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + + SA_SIZE_OFFSET), + dnode_path->dn.endian); + char *oldpath = path, *oldpathbuf = path_buf; +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -3550,6 +3577,7 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + unsigned i; + grub_size_t nelm; + int elemsize = 0; ++ int sz; + + found = nvlist_find_value (nvlist, name, DATA_TYPE_NVLIST_ARRAY, &nvpair, + &size, &nelm); +@@ -3584,7 +3612,12 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + return 0; + } + +- ret = grub_zalloc (elemsize + sizeof (grub_uint32_t)); ++ if (grub_add (elemsize, sizeof (grub_uint32_t), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("elemsize overflow")); ++ return 0; ++ } ++ ret = grub_zalloc (sz); + if (!ret) + return 0; + grub_memcpy (ret, nvlist, sizeof (grub_uint32_t)); +@@ -4163,6 +4196,7 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + struct grub_dirhook_info info; + char *name2; + int ret; ++ grub_size_t sz; + + dnode_end_t mdn; + +@@ -4183,7 +4217,10 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return 0; + } + +- name2 = grub_malloc (grub_strlen (name) + 2); ++ if (grub_add (grub_strlen (name), 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ ++ name2 = grub_malloc (sz); + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch b/SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch new file mode 100644 index 0000000..ff1758f --- /dev/null +++ b/SOURCES/0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:03 +0000 +Subject: [PATCH] fs/zfs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 4384d6aae..23fe50211 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -717,9 +717,9 @@ fill_vdev_info_real (struct grub_zfs_data *data, + if (!fill->children) + { + fill->n_children = nelm; +- +- fill->children = grub_zalloc (fill->n_children +- * sizeof (fill->children[0])); ++ ++ fill->children = grub_calloc (fill->n_children, ++ sizeof (fill->children[0])); + } + + for (i = 0; i < nelm; i++) +@@ -3693,8 +3693,8 @@ zfs_mount (grub_device_t dev) + #endif + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) diff --git a/SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch b/SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch new file mode 100644 index 0000000..6ff2729 --- /dev/null +++ b/SOURCES/0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch @@ -0,0 +1,88 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:01 +0000 +Subject: [PATCH] fs/zfs: Check if returned pointer for allocated memory is + NULL + +When using grub_malloc() or grub_zalloc(), these functions can fail if +we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 23fe50211..434c3bd11 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -609,6 +609,8 @@ zfs_fetch_nvlist (struct grub_zfs_device_desc *diskdesc, char **nvlist) + return grub_error (GRUB_ERR_BUG, "member drive unknown"); + + *nvlist = grub_malloc (VDEV_PHYS_SIZE); ++ if (!*nvlist) ++ return grub_errno; + + /* Read in the vdev name-value pair list (112K). */ + err = grub_disk_read (diskdesc->dev->disk, diskdesc->vdev_phys_sector, 0, +@@ -721,6 +723,11 @@ fill_vdev_info_real (struct grub_zfs_data *data, + fill->children = grub_calloc (fill->n_children, + sizeof (fill->children[0])); + } ++ if (!fill->children) ++ { ++ grub_free (type); ++ return grub_errno; ++ } + + for (i = 0; i < nelm; i++) + { +@@ -2450,6 +2457,11 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + return grub_errno; + } + buf = grub_malloc (sz); ++ if (!buf) ++ { ++ grub_free (l); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2465,6 +2477,12 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + val_length = ((int) le->le_value_length + * (int) le->le_int_size); + val = grub_malloc (grub_zfs_to_cpu16 (val_length, endian)); ++ if (!val) ++ { ++ grub_free (l); ++ grub_free (buf); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_value_chunk, + endian), +@@ -3695,6 +3713,11 @@ zfs_mount (grub_device_t dev) + data->n_devices_allocated = 16; + data->devices_attached = grub_calloc (data->n_devices_allocated, + sizeof (data->devices_attached[0])); ++ if (!data->devices_attached) ++ { ++ grub_free (data); ++ return NULL; ++ } + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) +@@ -4221,6 +4244,9 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); + + name2 = grub_malloc (sz); ++ if (!name2) ++ return grub_errno; ++ + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch b/SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch new file mode 100644 index 0000000..d5fb7a2 --- /dev/null +++ b/SOURCES/0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:04 +0000 +Subject: [PATCH] fs/zfs: Add missing NULL check after grub_strdup() call + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 434c3bd11..5254e75e1 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -3293,6 +3293,8 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + filename = 0; + snapname = 0; + fsname = grub_strdup (fullpath); ++ if (!fsname) ++ return grub_errno; + } + else + { diff --git a/SOURCES/0650-net-Use-safe-math-macros-to-prevent-overflows.patch b/SOURCES/0650-net-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 0000000..5436623 --- /dev/null +++ b/SOURCES/0650-net-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,239 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 18:04:42 +0000 +Subject: [PATCH] net: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/bootp.c | 16 +++++++++++-- + grub-core/net/dns.c | 9 ++++++- + grub-core/net/drivers/ieee1275/ofnet.c | 20 ++++++++++++++-- + grub-core/net/net.c | 43 +++++++++++++++++++++++++++------- + 4 files changed, 75 insertions(+), 13 deletions(-) + +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index adf36fa4a..786340bf0 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + static int + dissect_url (const char *url, char **proto, char **host, char **path) +@@ -1190,6 +1191,7 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + int num; + grub_uint8_t *ptr; + grub_uint8_t taglength; ++ grub_uint8_t len; + + if (argc < 4) + return grub_error (GRUB_ERR_BAD_ARGUMENT, +@@ -1248,7 +1250,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "string") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (taglength + 1); ++ char *val; ++ ++ if (grub_add (taglength, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + if (!val) + return grub_errno; + grub_memcpy (val, ptr, taglength); +@@ -1281,7 +1288,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "hex") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (2 * taglength + 1); ++ char *val; ++ ++ if (grub_mul (taglength, 2, &len) || grub_add (len, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + int i; + if (!val) + return grub_errno; +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index 17961a9f1..64b48a31c 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -224,10 +224,17 @@ get_name (const grub_uint8_t *name_at, const grub_uint8_t *head, + { + int length; + char *ret; ++ int len; + + if (!check_name_real (name_at, head, tail, NULL, &length, NULL)) + return NULL; +- ret = grub_malloc (length + 1); ++ ++ if (grub_add (length, 1, &len)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (len); + if (!ret) + return NULL; + if (!check_name_real (name_at, head, tail, NULL, NULL, ret)) +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index ba50415f5..753d54e43 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -404,6 +405,7 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + grub_uint8_t *pprop; + char *shortname; + char need_suffix = 1; ++ grub_size_t sz; + + if (grub_strcmp (alias->type, "network") != 0) + return 0; +@@ -461,9 +463,23 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + } + + if (need_suffix) +- ofdata->path = grub_malloc (grub_strlen (alias->path) + sizeof (SUFFIX)); ++ { ++ if (grub_add (grub_strlen (alias->path), sizeof (SUFFIX), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + else +- ofdata->path = grub_malloc (grub_strlen (alias->path) + 1); ++ { ++ if (grub_add (grub_strlen (alias->path), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + if (!ofdata->path) + { + grub_print_error (); +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index f0896979d..10ea4ae71 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_MACHINE_EFI + #include + #endif +@@ -211,6 +212,7 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + { + struct grub_net_slaac_mac_list *slaac; + char *ptr; ++ grub_size_t sz; + + for (slaac = card->slaac_list; slaac; slaac = slaac->next) + if (grub_net_hwaddr_cmp (&slaac->address, hwaddr) == 0) +@@ -220,9 +222,16 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + if (!slaac) + return NULL; + +- slaac->name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":slaac")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":slaac")), &sz)) ++ { ++ grub_free (slaac); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of slaac name"); ++ return NULL; ++ } ++ ++ slaac->name = grub_malloc (sz); + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { +@@ -293,6 +302,7 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + char *name; + char *ptr; + grub_net_network_level_address_t addr; ++ grub_size_t sz; + + addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; + addr.ipv6[0] = grub_cpu_to_be64_compile_time (0xfe80ULL << 48); +@@ -306,9 +316,14 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + return inf; + } + +- name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":link")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":link")), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of link name"); ++ return NULL; ++ } ++ name = grub_malloc (sz); + if (!name) + return NULL; + +@@ -1462,8 +1477,14 @@ grub_net_open_real (const char *name) + if (grub_strchr (port_start + 1, ':')) + { + int iplen = grub_strlen (server); ++ grub_size_t sz; + /* bracket bare ipv6 addrs */ +- host = grub_malloc (iplen + 3); ++ if (grub_add (iplen, 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining length of host")); ++ return NULL; ++ } ++ host = grub_malloc (sz); + if(!host) + { + return NULL; +@@ -1723,6 +1744,7 @@ grub_env_set_net_property (const char *intername, const char *suffix, + { + char *varname, *varvalue; + char *ptr; ++ grub_size_t sz; + + varname = grub_xasprintf ("net_%s_%s", intername, suffix); + if (!varname) +@@ -1730,7 +1752,12 @@ grub_env_set_net_property (const char *intername, const char *suffix, + for (ptr = varname; *ptr; ptr++) + if (*ptr == ':') + *ptr = '_'; +- varvalue = grub_malloc (len + 1); ++ if (grub_add (len, 1, &sz)) ++ { ++ grub_free (varname); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining the size of an env variable"); ++ } ++ varvalue = grub_malloc (sz); + if (!varvalue) + { + grub_free (varname); diff --git a/SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch b/SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch new file mode 100644 index 0000000..6c6f4a6 --- /dev/null +++ b/SOURCES/0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 18:04:43 +0000 +Subject: [PATCH] net: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/net/dns.c | 4 ++-- + grub-core/net/net.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index 64b48a31c..aafd92902 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -494,8 +494,8 @@ grub_net_dns_lookup (const char *name, + && grub_get_time_ms () < dns_cache[h].limit_time) + { + grub_dprintf ("dns", "retrieved from cache\n"); +- *addresses = grub_malloc (dns_cache[h].naddresses +- * sizeof ((*addresses)[0])); ++ *addresses = grub_calloc (dns_cache[h].naddresses, ++ sizeof ((*addresses)[0])); + if (!*addresses) + return grub_errno; + *naddresses = dns_cache[h].naddresses; +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 10ea4ae71..06f4b1c9f 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -91,8 +91,8 @@ grub_net_link_layer_add_address (struct grub_net_card *card, + /* Add sender to cache table. */ + if (card->link_layer_table == NULL) + { +- card->link_layer_table = grub_zalloc (LINK_LAYER_CACHE_SIZE +- * sizeof (card->link_layer_table[0])); ++ card->link_layer_table = grub_calloc (LINK_LAYER_CACHE_SIZE, ++ sizeof (card->link_layer_table[0])); + if (card->link_layer_table == NULL) + return; + } diff --git a/SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch b/SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch new file mode 100644 index 0000000..62d3f5a --- /dev/null +++ b/SOURCES/0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 18:04:44 +0000 +Subject: [PATCH] net: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), the function can fail if we are out of memory. +After allocating memory we should check if this function returned NULL +and handle this error if it did. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 06f4b1c9f..6fcbe6fd6 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -232,6 +232,11 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + } + + slaac->name = grub_malloc (sz); ++ if (slaac->name == NULL) ++ { ++ grub_free (slaac); ++ return NULL; ++ } + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { diff --git a/SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch b/SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch new file mode 100644 index 0000000..1c0756a --- /dev/null +++ b/SOURCES/0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 28 Jan 2025 05:15:50 +0000 +Subject: [PATCH] fs/sfs: Check if allocated memory is NULL + +When using grub_zalloc(), if we are out of memory, this function can fail. +After allocating memory, we should check if grub_zalloc() returns NULL. +If so, we should handle this error. + +Fixes: CID 473856 + +Signed-off-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/sfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index a272aea0a..36c5fd656 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -429,6 +429,9 @@ grub_sfs_mount (grub_disk_t disk) + - 24 /* offsetof (struct grub_sfs_objc, objects) */ + - 25); /* offsetof (struct grub_sfs_obj, filename) */ + data->label = grub_zalloc (max_len + 1); ++ if (data->label == NULL) ++ goto fail; ++ + grub_strncpy (data->label, (char *) rootobjc->objects[0].filename, max_len); + + grub_free (rootobjc_data); diff --git a/SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch b/SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch new file mode 100644 index 0000000..1eb31c5 --- /dev/null +++ b/SOURCES/0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:37 +0000 +Subject: [PATCH] script/execute: Fix potential underflow and NULL dereference + +The result is initialized to 0 in grub_script_arglist_to_argv(). +If the for loop condition is not met both result.args and result.argc +remain 0 causing result.argc - 1 to underflow and/or result.args NULL +dereference. Fix the issues by adding relevant checks. + +Fixes: CID 473880 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index ef9a01642..961e9722c 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -794,6 +794,9 @@ cleanup: + } + } + ++ if (result.args == NULL || result.argc == 0) ++ goto fail; ++ + if (! result.args[result.argc - 1]) + result.argc--; + diff --git a/SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch b/SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch new file mode 100644 index 0000000..e9fddb1 --- /dev/null +++ b/SOURCES/0655-osdep-unix-getroot-Fix-potential-underflow.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:38 +0000 +Subject: [PATCH] osdep/unix/getroot: Fix potential underflow + +The entry_len is initialized in grub_find_root_devices_from_mountinfo() +to 0 before the while loop iterates through /proc/self/mountinfo. If the +file is empty or contains only invalid entries entry_len remains +0 causing entry_len - 1 in the subsequent for loop initialization +to underflow. To prevent this add a check to ensure entry_len > 0 before +entering the for loop. + +Fixes: CID 473877 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Ross Philipson +--- + grub-core/osdep/linux/getroot.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index e450f5f0a..27a4d7c81 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -599,6 +599,9 @@ again: + } + } + ++ if (!entry_len) ++ goto out; ++ + /* Now scan visible mounts for the ones we're interested in. */ + for (i = entry_len - 1; i >= 0; i--) + { diff --git a/SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch b/SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch new file mode 100644 index 0000000..31722be --- /dev/null +++ b/SOURCES/0656-misc-Ensure-consistent-overflow-error-messages.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:39 +0000 +Subject: [PATCH] misc: Ensure consistent overflow error messages + +Update the overflow error messages to make them consistent +across the GRUB code. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 2 +- + grub-core/fs/ntfscomp.c | 2 +- + grub-core/video/readers/png.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 1ad3a2715..f241c5237 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -574,7 +574,7 @@ retry: + goto retry; + } + } +- return grub_error (GRUB_ERR_BAD_FS, "run list overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "run list overflow"); + } + ctx->curr_vcn = ctx->next_vcn; + ctx->next_vcn += read_run_data (run, c1, 0); /* length of current VCN */ +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index 4bf95c85d..88594702e 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -30,7 +30,7 @@ static grub_err_t + decomp_nextvcn (struct grub_ntfs_comp *cc) + { + if (cc->comp_head >= cc->comp_tail) +- return grub_error (GRUB_ERR_BAD_FS, "compression block overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "compression block overflow"); + if (grub_disk_read + (cc->disk, + (cc->comp_table[cc->comp_head].next_lcn - +diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c +index 7f2ba7849..3ff215dd6 100644 +--- a/grub-core/video/readers/png.c ++++ b/grub-core/video/readers/png.c +@@ -622,7 +622,7 @@ static grub_err_t + grub_png_output_byte (struct grub_png_data *data, grub_uint8_t n) + { + if (--data->raw_bytes < 0) +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflown"); ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflow"); + + if (data->cur_column == 0) + { diff --git a/SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch b/SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch new file mode 100644 index 0000000..c919216 --- /dev/null +++ b/SOURCES/0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:10 +0000 +Subject: [PATCH] bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t + +The Coverity indicates that GRUB_EHCI_TOGGLE is an int that contains +a negative value and we are using it for the variable token which is +grub_uint32_t. To remedy this we can cast the definition to grub_uint32_t. + +Fixes: CID 473851 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/bus/usb/ehci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/bus/usb/ehci.c b/grub-core/bus/usb/ehci.c +index d966fc210..d1e8a01ca 100644 +--- a/grub-core/bus/usb/ehci.c ++++ b/grub-core/bus/usb/ehci.c +@@ -218,7 +218,7 @@ enum + + #define GRUB_EHCI_TERMINATE (1<<0) + +-#define GRUB_EHCI_TOGGLE (1<<31) ++#define GRUB_EHCI_TOGGLE ((grub_uint32_t) 1<<31) + + enum + { diff --git a/SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch b/SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch new file mode 100644 index 0000000..fbe026b --- /dev/null +++ b/SOURCES/0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:11 +0000 +Subject: [PATCH] normal/menu: Use safe math to avoid an integer overflow + +The Coverity indicates that the variable current_entry might overflow. +To prevent this use safe math when adding GRUB_MENU_PAGE_SIZE to current_entry. + +On the occasion fix limiting condition which was broken. + +Fixes: CID 473853 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/normal/menu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index 7e32c498a..ff2bebe82 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + /* Time to delay after displaying an error message about a default/fallback + entry failing to boot. */ +@@ -780,9 +781,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot) + + case GRUB_TERM_CTRL | 'c': + case GRUB_TERM_KEY_NPAGE: +- if (current_entry + GRUB_MENU_PAGE_SIZE < menu->size) +- current_entry += GRUB_MENU_PAGE_SIZE; +- else ++ if (grub_add (current_entry, GRUB_MENU_PAGE_SIZE, ¤t_entry) || current_entry >= menu->size) + current_entry = menu->size - 1; + menu_set_chosen_entry (current_entry); + break; diff --git a/SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch b/SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch new file mode 100644 index 0000000..cb29426 --- /dev/null +++ b/SOURCES/0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:56 +0000 +Subject: [PATCH] kern/partition: Add sanity check after grub_strtoul() call + +The current code incorrectly assumes that both the input and the values +returned by grub_strtoul() are always valid which can lead to potential +errors. This fix ensures proper validation to prevent any unintended issues. + +Fixes: CID 473843 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index f3f125e75..f95efe8ce 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -125,14 +125,21 @@ grub_partition_probe (struct grub_disk *disk, const char *str) + for (ptr = str; *ptr;) + { + grub_partition_map_t partmap; +- int num; ++ unsigned long num; + const char *partname, *partname_end; + + partname = ptr; + while (*ptr && grub_isalpha (*ptr)) + ptr++; + partname_end = ptr; +- num = grub_strtoul (ptr, &ptr, 0) - 1; ++ num = grub_strtoul (ptr, &ptr, 0); ++ if (*ptr != '\0' || num == 0 || num > GRUB_INT_MAX) ++ { ++ grub_error (GRUB_ERR_BAD_NUMBER, N_("invalid partition number")); ++ return 0; ++ } ++ ++ num -= 1; + + curpart = 0; + /* Use the first partition map type found. */ diff --git a/SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch b/SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch new file mode 100644 index 0000000..9d1f69c --- /dev/null +++ b/SOURCES/0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:57 +0000 +Subject: [PATCH] kern/misc: Add sanity check after grub_strtoul() call + +When the format string, fmt0, includes a positional argument +grub_strtoul() or grub_strtoull() is called to extract the argument +position. However, the returned argument position isn't fully validated. +If the format is something like "%0$x" then these functions return +0 which leads to an underflow in the calculation of the args index, curn. +The fix is to add a check to ensure the extracted argument position is +greater than 0 before computing curn. Additionally, replace one +grub_strtoull() with grub_strtoul() and change curn type to make code +more correct. + +Fixes: CID 473841 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/misc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index b375e486a..8f211e4c7 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -830,7 +830,7 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + while ((c = *fmt++) != 0) + { + int longfmt = 0; +- grub_size_t curn; ++ unsigned long curn; + const char *p; + + if (c != '%') +@@ -848,7 +848,10 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + + if (*fmt == '$') + { +- curn = grub_strtoull (p, 0, 10) - 1; ++ curn = grub_strtoul (p, 0, 10); ++ if (curn == 0) ++ continue; ++ curn--; + fmt++; + } + +@@ -1007,6 +1010,8 @@ grub_vsnprintf_real (char *str, grub_size_t max_len, const char *fmt0, + + if (*fmt == '$') + { ++ if (format1 == 0) ++ continue; + curn = format1 - 1; + fmt++; + format1 = 0; diff --git a/SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch b/SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch new file mode 100644 index 0000000..5d042cb --- /dev/null +++ b/SOURCES/0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Fri, 7 Feb 2025 01:47:57 +0000 +Subject: [PATCH] loader/i386/linux: Cast left shift to grub_uint32_t + +The Coverity complains that we might overflow into a negative value when +setting linux_params.kernel_alignment to (1 << align). We can remedy +this by casting it to grub_uint32_t. + +Fixes: CID 473876 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/linux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index c160ddb0e..b72b7d591 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -837,7 +837,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, GRUB_MEM_ATTR_X); + + linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; +- linux_params.kernel_alignment = (1 << align); ++ linux_params.kernel_alignment = ((grub_uint32_t) 1 << align); + linux_params.ps_mouse = linux_params.padding10 = 0; + + len = sizeof (linux_params) - sizeof (lh); diff --git a/SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch b/SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch new file mode 100644 index 0000000..304f96c --- /dev/null +++ b/SOURCES/0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 5 Feb 2025 22:04:08 +0000 +Subject: [PATCH] loader/i386/bsd: Use safe math to avoid underflow + +The operation kern_end - kern_start may underflow when we input it into +grub_relocator_alloc_chunk_addr() call. To avoid this we can use safe +math for this subtraction. + +Fixes: CID 73845 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/bsd.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index b5ab848ee..ff1658503 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -1341,6 +1341,7 @@ static grub_err_t + grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_err_t err; ++ grub_size_t sz; + + kern_end = 0; + kern_start = ~0; +@@ -1371,8 +1372,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + + if (grub_errno) + return grub_errno; +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, +- kern_start, kern_end - kern_start); ++ ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + +@@ -1432,8 +1436,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, +- kern_end - kern_start); ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + kern_chunk_src = get_virtual_current_address (ch); diff --git a/SOURCES/0663-types-Make-bool-generally-available.patch b/SOURCES/0663-types-Make-bool-generally-available.patch new file mode 100644 index 0000000..a2bcd5f --- /dev/null +++ b/SOURCES/0663-types-Make-bool-generally-available.patch @@ -0,0 +1,78 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Fri, 4 Nov 2022 12:13:34 -0400 +Subject: [PATCH] types: Make bool generally available + +Add an include on stdbool.h, making the bool type generally available +within the GRUB without needing to add a file-specific include every +time it would be used. + +Signed-off-by: Robbie Harwood +Reviewed-by: Daniel Kiper +--- + grub-core/commands/parttool.c | 2 +- + grub-core/parttool/msdospart.c | 4 ++-- + include/grub/parttool.h | 2 +- + include/grub/types.h | 1 + + 4 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c +index 051e31320..ff45c65e6 100644 +--- a/grub-core/commands/parttool.c ++++ b/grub-core/commands/parttool.c +@@ -315,7 +315,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)), + switch (curarg->type) + { + case GRUB_PARTTOOL_ARG_BOOL: +- pargs[curarg - ptool->args].bool ++ pargs[curarg - ptool->args].b + = (args[j][grub_strlen (curarg->name)] != '-'); + break; + +diff --git a/grub-core/parttool/msdospart.c b/grub-core/parttool/msdospart.c +index dcbf74e3b..a92669e5a 100644 +--- a/grub-core/parttool/msdospart.c ++++ b/grub-core/parttool/msdospart.c +@@ -61,7 +61,7 @@ static grub_err_t grub_pcpart_boot (const grub_device_t dev, + return grub_errno; + } + +- if (args[0].set && args[0].bool) ++ if (args[0].set && args[0].b) + { + for (i = 0; i < 4; i++) + mbr.entries[i].flag = 0x0; +@@ -116,7 +116,7 @@ static grub_err_t grub_pcpart_type (const grub_device_t dev, + + if (args[1].set) + { +- if (args[1].bool) ++ if (args[1].b) + type |= GRUB_PC_PARTITION_TYPE_HIDDEN_FLAG; + else + type &= ~GRUB_PC_PARTITION_TYPE_HIDDEN_FLAG; +diff --git a/include/grub/parttool.h b/include/grub/parttool.h +index 4e8f8d5e5..4799a22c5 100644 +--- a/include/grub/parttool.h ++++ b/include/grub/parttool.h +@@ -32,7 +32,7 @@ struct grub_parttool_args + int set; + union + { +- int bool; ++ int b; + char *str; + }; + }; +diff --git a/include/grub/types.h b/include/grub/types.h +index f6a972397..7a66af768 100644 +--- a/include/grub/types.h ++++ b/include/grub/types.h +@@ -20,6 +20,7 @@ + #define GRUB_TYPES_HEADER 1 + + #include ++#include + #ifndef GRUB_UTIL + #include + #endif diff --git a/SOURCES/0664-Remove-exttra-bool-definitions.patch b/SOURCES/0664-Remove-exttra-bool-definitions.patch new file mode 100644 index 0000000..9b42d9c --- /dev/null +++ b/SOURCES/0664-Remove-exttra-bool-definitions.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Sat, 15 Feb 2025 20:11:42 -0600 +Subject: [PATCH] Remove exttra bool definitions + +Previous commit 'types: Make bool generally available' make this type available +so no need to redefined it. + +Signed-off-by: Leo Sandoval +--- + grub-core/lib/posix_wrap/sys/types.h | 5 ----- + grub-core/lib/xzembed/xz.h | 4 ---- + 2 files changed, 9 deletions(-) + +diff --git a/grub-core/lib/posix_wrap/sys/types.h b/grub-core/lib/posix_wrap/sys/types.h +index f63412c8d..2cd36d081 100644 +--- a/grub-core/lib/posix_wrap/sys/types.h ++++ b/grub-core/lib/posix_wrap/sys/types.h +@@ -24,11 +24,6 @@ + #include + + typedef grub_ssize_t ssize_t; +-#ifndef GRUB_POSIX_BOOL_DEFINED +-typedef enum { false = 0, true = 1 } bool; +-#define GRUB_POSIX_BOOL_DEFINED 1 +-#endif +- + typedef grub_uint8_t uint8_t; + typedef grub_uint16_t uint16_t; + typedef grub_uint32_t uint32_t; +diff --git a/grub-core/lib/xzembed/xz.h b/grub-core/lib/xzembed/xz.h +index fe7158bb2..0265c4a6d 100644 +--- a/grub-core/lib/xzembed/xz.h ++++ b/grub-core/lib/xzembed/xz.h +@@ -29,10 +29,6 @@ + #include + #include + +-#ifndef GRUB_POSIX_BOOL_DEFINED +-typedef enum { false = 0, true = 1 } bool; +-#endif +- + /** + * enum xz_ret - Return codes + * @XZ_OK: Everything is OK so far. More input or more output diff --git a/SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch b/SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch new file mode 100644 index 0000000..31b0df9 --- /dev/null +++ b/SOURCES/0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch @@ -0,0 +1,106 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Darren Kenny +Date: Fri, 2 Jun 2023 18:08:44 +0000 +Subject: [PATCH] fs/xfs: Fix issues found while fuzzing the XFS filesystem + +While performing fuzz testing with XFS filesystem images with ASAN +enabled, several issues were found where the memory accesses are made +beyond the data that is allocated into the struct grub_xfs_data +structure's data field. + +The existing structure didn't store the size of the memory allocated into +the buffer in the data field and had no way to check it. To resolve these +issues, the data size is stored to enable checks into the data buffer. + +With these checks in place, the fuzzing corpus no longer cause any crashes. + +Signed-off-by: Darren Kenny +Signed-off-by: Robbie Harwood +Signed-off-by: Marta Lewandowska +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index b0d371ee1..7076192c1 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -221,6 +221,7 @@ struct grub_fshelp_node + + struct grub_xfs_data + { ++ grub_size_t data_size; + struct grub_xfs_sblock sblock; + grub_disk_t disk; + int pos; +@@ -592,8 +593,20 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + } + else if (node->inode.format == XFS_INODE_FORMAT_EXT) + { ++ grub_addr_t exts_end = 0; ++ grub_addr_t data_end = 0; ++ + nrec = grub_be_to_cpu32 (node->inode.nextents); + exts = (struct grub_xfs_extent *) grub_xfs_inode_data(&node->inode); ++ ++ if (grub_mul (sizeof (struct grub_xfs_extent), nrec, &exts_end) || ++ grub_add ((grub_addr_t) node->data, exts_end, &exts_end) || ++ grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || ++ exts_end > data_end) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS extents"); ++ return 0; ++ } + } + else + { +@@ -796,6 +809,9 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + grub_uint8_t *inopos = grub_xfs_inline_de_inopos(dir->data, de); + grub_uint8_t c; + ++ if ((inopos + (smallino ? 4 : 8)) > (grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data)) ++ return grub_error (GRUB_ERR_BAD_FS, "not a correct XFS inode"); ++ + /* inopos might be unaligned. */ + if (smallino) + ino = (((grub_uint32_t) inopos[0]) << 24) +@@ -822,6 +838,10 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + de->name[de->len] = c; + + de = grub_xfs_inline_next_de(dir->data, head, de); ++ ++ if ((grub_uint8_t *) de >= (grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data)) ++ return grub_error (GRUB_ERR_BAD_FS, "invalid XFS directory entry"); ++ + } + break; + } +@@ -887,6 +907,9 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + } + + filename = (char *)(direntry + 1); ++ if (filename + direntry->len - 1 > (char *) tail) ++ return grub_error (GRUB_ERR_BAD_FS, "invalid XFS directory entry"); ++ + /* The byte after the filename is for the filetype, padding, or + tag, which is not used by GRUB. So it can be overwritten. */ + filename[direntry->len] = '\0'; +@@ -931,6 +954,8 @@ grub_xfs_mount (grub_disk_t disk) + if (!data) + return 0; + ++ data->data_size = sizeof (struct grub_xfs_data); ++ + grub_dprintf("xfs", "Reading sb\n"); + /* Read the superblock. */ + if (grub_disk_read (disk, 0, 0, +@@ -949,6 +974,7 @@ grub_xfs_mount (grub_disk_t disk) + if (! data) + goto fail; + ++ data->data_size = sz; + data->diropen.data = data; + data->diropen.ino = grub_be_to_cpu64(data->sblock.rootino); + data->diropen.inode_read = 1; diff --git a/SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch b/SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch new file mode 100644 index 0000000..92da026 --- /dev/null +++ b/SOURCES/0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 19 Mar 2025 17:39:41 +0100 +Subject: [PATCH] ieee1275/ofnet: Fix grub_malloc() removed after added safe + math functions + +grub_malloc() has been inadvertently removed from the ieee1275/ofnet +code after it has been modified to use safe match function. + +Fixes: 4beeff8a (net: Use safe math macros to prevent overflows) + +Tested-by: Marta Lewandowska +Reviewed-by: Daniel Kiper +Signed-off-by: Nicolas Frayer +--- + grub-core/net/drivers/ieee1275/ofnet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index 3e1b9094e2ab..37bc82467f60 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -463,6 +463,9 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + return 0; + } + } ++ ++ ofdata->path = grub_malloc(sz); ++ + if (!ofdata->path) + { + grub_print_error (); diff --git a/SOURCES/0667-fs-xfs-Add-bigtime-incompat-feature-support.patch b/SOURCES/0667-fs-xfs-Add-bigtime-incompat-feature-support.patch new file mode 100644 index 0000000..c1814eb --- /dev/null +++ b/SOURCES/0667-fs-xfs-Add-bigtime-incompat-feature-support.patch @@ -0,0 +1,156 @@ +From 631bfec4c070c220e86d2e2d8e6d6aa38c130ef1 Mon Sep 17 00:00:00 2001 +From: Carlos Maiolino +Date: Mon, 24 May 2021 19:40:06 +0200 +Subject: [PATCH 667/668] fs/xfs: Add bigtime incompat feature support + +The XFS filesystem supports a bigtime feature to overcome y2038 problem. +This patch makes the GRUB able to support the XFS filesystems with this +feature enabled. + +The XFS counter for the bigtime enabled timestamps starts at 0, which +translates to GRUB_INT32_MIN (Dec 31 20:45:52 UTC 1901) in the legacy +timestamps. The conversion to Unix timestamps is made before passing the +value to other GRUB functions. + +For this to work properly, GRUB requires an access to flags2 field in the +XFS ondisk inode. So, the grub_xfs_inode structure has been updated to +cover full ondisk inode. + +Signed-off-by: Carlos Maiolino +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 49 ++++++++++++++++++++++++++++++++++++--------- + include/grub/time.h | 2 ++ + 2 files changed, 42 insertions(+), 9 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 887392c..8c23944 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -75,10 +76,15 @@ GRUB_MOD_LICENSE ("GPLv3+"); + XFS_SB_VERSION2_PROJID32BIT | \ + XFS_SB_VERSION2_FTYPE) + ++/* Inode flags2 flags */ ++#define XFS_DIFLAG2_BIGTIME_BIT 3 ++#define XFS_DIFLAG2_BIGTIME (1 << XFS_DIFLAG2_BIGTIME_BIT) ++ + /* incompat feature flags */ + #define XFS_SB_FEAT_INCOMPAT_FTYPE (1 << 0) /* filetype in dirent */ + #define XFS_SB_FEAT_INCOMPAT_SPINODES (1 << 1) /* sparse inode chunks */ + #define XFS_SB_FEAT_INCOMPAT_META_UUID (1 << 2) /* metadata UUID */ ++#define XFS_SB_FEAT_INCOMPAT_BIGTIME (1 << 3) /* large timestamps */ + + /* + * Directory entries with ftype are explicitly handled by GRUB code. +@@ -92,7 +98,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #define XFS_SB_FEAT_INCOMPAT_SUPPORTED \ + (XFS_SB_FEAT_INCOMPAT_FTYPE | \ + XFS_SB_FEAT_INCOMPAT_SPINODES | \ +- XFS_SB_FEAT_INCOMPAT_META_UUID) ++ XFS_SB_FEAT_INCOMPAT_META_UUID | \ ++ XFS_SB_FEAT_INCOMPAT_BIGTIME) + + struct grub_xfs_sblock + { +@@ -177,7 +184,7 @@ struct grub_xfs_btree_root + grub_uint64_t keys[1]; + } GRUB_PACKED; + +-struct grub_xfs_time ++struct grub_xfs_time_legacy + { + grub_uint32_t sec; + grub_uint32_t nanosec; +@@ -190,20 +197,23 @@ struct grub_xfs_inode + grub_uint8_t version; + grub_uint8_t format; + grub_uint8_t unused2[26]; +- struct grub_xfs_time atime; +- struct grub_xfs_time mtime; +- struct grub_xfs_time ctime; ++ grub_uint64_t atime; ++ grub_uint64_t mtime; ++ grub_uint64_t ctime; + grub_uint64_t size; + grub_uint64_t nblocks; + grub_uint32_t extsize; + grub_uint32_t nextents; + grub_uint16_t unused3; + grub_uint8_t fork_offset; +- grub_uint8_t unused4[17]; ++ grub_uint8_t unused4[37]; ++ grub_uint64_t flags2; ++ grub_uint8_t unused5[48]; + } GRUB_PACKED; + +-#define XFS_V2_INODE_SIZE sizeof(struct grub_xfs_inode) +-#define XFS_V3_INODE_SIZE (XFS_V2_INODE_SIZE + 76) ++#define XFS_V3_INODE_SIZE sizeof(struct grub_xfs_inode) ++/* Size of struct grub_xfs_inode until fork_offset (included). */ ++#define XFS_V2_INODE_SIZE (XFS_V3_INODE_SIZE - 92) + + struct grub_xfs_dirblock_tail + { +@@ -1009,6 +1019,27 @@ struct grub_xfs_dir_ctx + void *hook_data; + }; + ++/* Bigtime inodes helpers. */ ++#define XFS_BIGTIME_EPOCH_OFFSET (-(grub_int64_t) GRUB_INT32_MIN) ++ ++static int grub_xfs_inode_has_bigtime (const struct grub_xfs_inode *inode) ++{ ++ return inode->version >= 3 && ++ (inode->flags2 & grub_cpu_to_be64_compile_time (XFS_DIFLAG2_BIGTIME)); ++} ++ ++static grub_int64_t ++grub_xfs_get_inode_time (struct grub_xfs_inode *inode) ++{ ++ struct grub_xfs_time_legacy *lts; ++ ++ if (grub_xfs_inode_has_bigtime (inode)) ++ return grub_divmod64 (grub_be_to_cpu64 (inode->mtime), NSEC_PER_SEC, NULL) - XFS_BIGTIME_EPOCH_OFFSET; ++ ++ lts = (struct grub_xfs_time_legacy *) &inode->mtime; ++ return grub_be_to_cpu32 (lts->sec); ++} ++ + /* Helper for grub_xfs_dir. */ + static int + grub_xfs_dir_iter (const char *filename, enum grub_fshelp_filetype filetype, +@@ -1021,7 +1052,7 @@ grub_xfs_dir_iter (const char *filename, enum grub_fshelp_filetype filetype, + if (node->inode_read) + { + info.mtimeset = 1; +- info.mtime = grub_be_to_cpu32 (node->inode.mtime.sec); ++ info.mtime = grub_xfs_get_inode_time (&node->inode); + } + info.dir = ((filetype & GRUB_FSHELP_TYPE_MASK) == GRUB_FSHELP_DIR); + grub_free (node); +diff --git a/include/grub/time.h b/include/grub/time.h +index c919c1f..32f0afa 100644 +--- a/include/grub/time.h ++++ b/include/grub/time.h +@@ -30,6 +30,8 @@ grub_cpu_idle(void) + } + #endif + ++#define NSEC_PER_SEC ((grub_int64_t) 1000000000) ++ + void EXPORT_FUNC(grub_millisleep) (grub_uint32_t ms); + grub_uint64_t EXPORT_FUNC(grub_get_time_ms) (void); + +-- +2.43.5 + diff --git a/SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch b/SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch new file mode 100644 index 0000000..57bdbb4 --- /dev/null +++ b/SOURCES/0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch @@ -0,0 +1,81 @@ +From b03ffdb85eca0a5a632c6c5bbeea52373d2fea69 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 24 May 2021 19:40:07 +0200 +Subject: [PATCH 668/668] fs/xfs: Add needsrepair incompat feature support + +The XFS now has an incompat feature flag to indicate that a filesystem +needs to be repaired. The Linux kernel refuses to mount the filesystem +that has it set and only the xfs_repair tool is able to clear that flag. + +The GRUB doesn't have the concept of mounting filesystems and just +attempts to read the files. But it does some sanity checking before +attempting to read from the filesystem. Among the things which are tested, +is if the super block only has set of incompatible features flags that +are supported by GRUB. If it contains any flags that are not listed as +supported, reading the XFS filesystem fails. + +Since the GRUB doesn't attempt to detect if the filesystem is inconsistent +nor replays the journal, the filesystem access is a best effort. For this +reason, ignore if the filesystem needs to be repaired and just print a debug +message. That way, if reading or booting fails later, the user is able to +figure out that the failures can be related to broken XFS filesystem. + +Suggested-by: Eric Sandeen +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 8c23944..f113216 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -85,6 +85,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #define XFS_SB_FEAT_INCOMPAT_SPINODES (1 << 1) /* sparse inode chunks */ + #define XFS_SB_FEAT_INCOMPAT_META_UUID (1 << 2) /* metadata UUID */ + #define XFS_SB_FEAT_INCOMPAT_BIGTIME (1 << 3) /* large timestamps */ ++#define XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR (1 << 4) /* needs xfs_repair */ + + /* + * Directory entries with ftype are explicitly handled by GRUB code. +@@ -99,7 +100,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); + (XFS_SB_FEAT_INCOMPAT_FTYPE | \ + XFS_SB_FEAT_INCOMPAT_SPINODES | \ + XFS_SB_FEAT_INCOMPAT_META_UUID | \ +- XFS_SB_FEAT_INCOMPAT_BIGTIME) ++ XFS_SB_FEAT_INCOMPAT_BIGTIME | \ ++ XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR) + + struct grub_xfs_sblock + { +@@ -313,6 +315,16 @@ static int grub_xfs_sb_valid(struct grub_xfs_data *data) + return 0; + } + ++static int ++grub_xfs_sb_needs_repair (struct grub_xfs_data *data) ++{ ++ return ((data->sblock.version & ++ grub_cpu_to_be16_compile_time (XFS_SB_VERSION_NUMBITS)) == ++ grub_cpu_to_be16_compile_time (XFS_SB_VERSION_5) && ++ (data->sblock.sb_features_incompat & ++ grub_cpu_to_be32_compile_time (XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR))); ++} ++ + /* Filetype information as used in inodes. */ + #define FILETYPE_INO_MASK 0170000 + #define FILETYPE_INO_REG 0100000 +@@ -975,6 +987,9 @@ grub_xfs_mount (grub_disk_t disk) + if (!grub_xfs_sb_valid(data)) + goto fail; + ++ if (grub_xfs_sb_needs_repair (data)) ++ grub_dprintf ("xfs", "XFS filesystem needs repair, boot may fail\n"); ++ + if (grub_add (grub_xfs_inode_size (data), + sizeof (struct grub_xfs_data) - sizeof (struct grub_xfs_inode) + 1, &sz)) + goto fail; +-- +2.43.5 + diff --git a/SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch b/SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch new file mode 100644 index 0000000..dab9126 --- /dev/null +++ b/SOURCES/0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch @@ -0,0 +1,121 @@ +From e89ae8eac88f240d757f812bebac1b46e62222bc Mon Sep 17 00:00:00 2001 +From: Erwan Velu +Date: Wed, 25 Aug 2021 15:31:52 +0200 +Subject: [PATCH 669/676] fs/xfs: Fix unreadable filesystem with v4 superblock + +The commit 8b1e5d193 (fs/xfs: Add bigtime incompat feature support) +introduced the bigtime support by adding some features in v3 inodes. +This change extended grub_xfs_inode struct by 76 bytes but also changed +the computation of XFS_V2_INODE_SIZE and XFS_V3_INODE_SIZE. Prior this +commit, XFS_V2_INODE_SIZE was 100 bytes. After the commit it's 84 bytes +XFS_V2_INODE_SIZE becomes 16 bytes too small. + +As a result, the data structures aren't properly aligned and the GRUB +generates "attempt to read or write outside of partition" errors when +trying to read the XFS filesystem: + + GNU GRUB version 2.11 + .... + grub> set debug=efi,gpt,xfs + grub> insmod part_gpt + grub> ls (hd0,gpt1)/ + partmap/gpt.c:93: Read a valid GPT header + partmap/gpt.c:115: GPT entry 0: start=4096, length=1953125 + fs/xfs.c:931: Reading sb + fs/xfs.c:270: Validating superblock + fs/xfs.c:295: XFS v4 superblock detected + fs/xfs.c:962: Reading root ino 128 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:515: Reading inode (739521961424144223) - 344365866970255880, 3840 + error: attempt to read or write outside of partition. + +This commit change the XFS_V2_INODE_SIZE computation by subtracting 76 +bytes instead of 92 bytes from the actual size of grub_xfs_inode struct. +This 76 bytes value comes from added members: + 20 grub_uint8_t unused5 + 1 grub_uint64_t flags2 + 48 grub_uint8_t unused6 + +This patch explicitly splits the v2 and v3 parts of the structure. +The unused4 is still ending of the v2 structures and the v3 starts +at unused5. Thanks to this we will avoid future corruptions of v2 +or v3 inodes. + +The XFS_V2_INODE_SIZE is returning to its expected size and the +filesystem is back to a readable state: + + GNU GRUB version 2.11 + .... + grub> set debug=efi,gpt,xfs + grub> insmod part_gpt + grub> ls (hd0,gpt1)/ + partmap/gpt.c:93: Read a valid GPT header + partmap/gpt.c:115: GPT entry 0: start=4096, length=1953125 + fs/xfs.c:931: Reading sb + fs/xfs.c:270: Validating superblock + fs/xfs.c:295: XFS v4 superblock detected + fs/xfs.c:962: Reading root ino 128 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:931: Reading sb + fs/xfs.c:270: Validating superblock + fs/xfs.c:295: XFS v4 superblock detected + fs/xfs.c:962: Reading root ino 128 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:515: Reading inode (128) - 64, 0 + fs/xfs.c:515: Reading inode (131) - 64, 768 + efi/ fs/xfs.c:515: Reading inode (3145856) - 1464904, 0 + grub2/ fs/xfs.c:515: Reading inode (132) - 64, 1024 + grub/ fs/xfs.c:515: Reading inode (139) - 64, 2816 + grub> + +Fixes: 8b1e5d193 (fs/xfs: Add bigtime incompat feature support) + +Signed-off-by: Erwan Velu +Tested-by: Carlos Maiolino +Reviewed-by: Daniel Kiper +(cherry picked from commit a4b495520e4dc41a896a8b916a64eda9970c50ea) +--- + grub-core/fs/xfs.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 7d4e632..7d15add 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -192,6 +192,11 @@ struct grub_xfs_time_legacy + grub_uint32_t nanosec; + } GRUB_PACKED; + ++/* ++ * The struct grub_xfs_inode layout was taken from the ++ * struct xfs_dinode_core which is described here: ++ * https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/docs/xfs_filesystem_structure.pdf ++ */ + struct grub_xfs_inode + { + grub_uint8_t magic[2]; +@@ -208,14 +213,15 @@ struct grub_xfs_inode + grub_uint32_t nextents; + grub_uint16_t unused3; + grub_uint8_t fork_offset; +- grub_uint8_t unused4[37]; ++ grub_uint8_t unused4[17]; /* Last member of inode v2. */ ++ grub_uint8_t unused5[20]; /* First member of inode v3. */ + grub_uint64_t flags2; +- grub_uint8_t unused5[48]; ++ grub_uint8_t unused6[48]; /* Last member of inode v3. */ + } GRUB_PACKED; + + #define XFS_V3_INODE_SIZE sizeof(struct grub_xfs_inode) +-/* Size of struct grub_xfs_inode until fork_offset (included). */ +-#define XFS_V2_INODE_SIZE (XFS_V3_INODE_SIZE - 92) ++/* Size of struct grub_xfs_inode v2, up to unused4 member included. */ ++#define XFS_V2_INODE_SIZE (XFS_V3_INODE_SIZE - 76) + + struct grub_xfs_dirblock_tail + { +-- +2.43.5 + diff --git a/SOURCES/0670-fs-Remove-trailing-whitespaces.patch b/SOURCES/0670-fs-Remove-trailing-whitespaces.patch new file mode 100644 index 0000000..802636f --- /dev/null +++ b/SOURCES/0670-fs-Remove-trailing-whitespaces.patch @@ -0,0 +1,1666 @@ +From a39c28f730a954bdee34b93587a4b3bc29fb1d53 Mon Sep 17 00:00:00 2001 +From: Elyes Haouas +Date: Fri, 4 Mar 2022 07:41:59 +0100 +Subject: [PATCH 670/676] fs: Remove trailing whitespaces + +Signed-off-by: Elyes Haouas +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 4 +- + grub-core/fs/archelp.c | 4 +- + grub-core/fs/bfs.c | 10 +- + grub-core/fs/cpio_common.c | 2 +- + grub-core/fs/fat.c | 6 +- + grub-core/fs/fshelp.c | 6 +- + grub-core/fs/hfs.c | 14 +- + grub-core/fs/hfsplus.c | 8 +- + grub-core/fs/hfspluscomp.c | 6 +- + grub-core/fs/iso9660.c | 12 +- + grub-core/fs/minix.c | 6 +- + grub-core/fs/nilfs2.c | 8 +- + grub-core/fs/ntfs.c | 8 +- + grub-core/fs/reiserfs.c | 2 +- + grub-core/fs/romfs.c | 8 +- + grub-core/fs/squash4.c | 26 ++-- + grub-core/fs/udf.c | 2 +- + grub-core/fs/ufs.c | 4 +- + grub-core/fs/xfs.c | 2 +- + grub-core/fs/zfs/zfs.c | 220 ++++++++++++++++---------------- + grub-core/fs/zfs/zfs_fletcher.c | 12 +- + grub-core/fs/zfs/zfs_sha256.c | 14 +- + grub-core/fs/zfs/zfscrypt.c | 14 +- + 23 files changed, 199 insertions(+), 199 deletions(-) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index 2a85063..6ed6ee1 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -346,7 +346,7 @@ grub_affs_create_node (grub_fshelp_node_t dir, + if (len > sizeof (fil->name)) + len = sizeof (fil->name); + *grub_latin1_to_utf8 (name_u8, fil->name, len) = '\0'; +- ++ + (*node)->di = *fil; + for (nest = 0; nest < 8; nest++) + { +@@ -409,7 +409,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir, + node = orig_node = grub_zalloc (sizeof (*node)); + if (!node) + return 1; +- ++ + *node = *dir; + if (hook (".", GRUB_FSHELP_DIR, node, hook_data)) + return 1; +diff --git a/grub-core/fs/archelp.c b/grub-core/fs/archelp.c +index 6491f74..ab63430 100644 +--- a/grub-core/fs/archelp.c ++++ b/grub-core/fs/archelp.c +@@ -77,7 +77,7 @@ handle_symlink (struct grub_archelp_data *data, + || !arcops->get_link_target) + return GRUB_ERR_NONE; + flen = grub_strlen (fn); +- if (grub_memcmp (*name, fn, flen) != 0 ++ if (grub_memcmp (*name, fn, flen) != 0 + || ((*name)[flen] != 0 && (*name)[flen] != '/')) + return GRUB_ERR_NONE; + rest = *name + flen; +@@ -258,7 +258,7 @@ grub_archelp_open (struct grub_archelp_data *data, + grub_uint32_t mode; + grub_int32_t mtime; + int restart; +- ++ + if (arcops->find_file (data, &fn, &mtime, &mode)) + goto fail; + +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index e70aaa4..2de6445 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -531,13 +531,13 @@ iterate_in_b_tree (grub_disk_t disk, + err = read_b_node (disk, sb, ino, + node_off, + &node, +- &key_data, ++ &key_data, + &keylen_idx, + &key_values); + + if (err) + return 0; +- ++ + for (i = 0; i < grub_bfs_to_cpu_treehead (node->count_keys); i++) + { + char c; +@@ -683,7 +683,7 @@ find_in_b_tree (grub_disk_t disk, + level--; + grub_free (node); + continue; +- } ++ } + } + else if (level != 0 + && i + 1 < grub_bfs_to_cpu_treehead (node->count_keys)) +@@ -828,7 +828,7 @@ mount (grub_disk_t disk, struct grub_bfs_superblock *sb) + grub_err_t err; + err = grub_disk_read (disk, SUPERBLOCK, 0, sizeof (*sb), sb); + if (err == GRUB_ERR_OUT_OF_RANGE) +- return grub_error (GRUB_ERR_BAD_FS, ++ return grub_error (GRUB_ERR_BAD_FS, + #ifdef MODE_AFS + "not an AFS filesystem" + #else +@@ -844,7 +844,7 @@ mount (grub_disk_t disk, struct grub_bfs_superblock *sb) + || (grub_bfs_to_cpu32 (sb->bsize) + != (1U << grub_bfs_to_cpu32 (sb->log2_bsize))) + || grub_bfs_to_cpu32 (sb->log2_bsize) < GRUB_DISK_SECTOR_BITS) +- return grub_error (GRUB_ERR_BAD_FS, ++ return grub_error (GRUB_ERR_BAD_FS, + #ifdef MODE_AFS + "not an AFS filesystem" + #else +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index bcb0380..b7d8aa8 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -130,7 +130,7 @@ grub_cpio_get_link_target (struct grub_archelp_data *data) + if (!ret) + return NULL; + +- err = grub_disk_read (data->disk, 0, data->dofs, data->size, ++ err = grub_disk_read (data->disk, 0, data->dofs, data->size, + ret); + if (err) + { +diff --git a/grub-core/fs/fat.c b/grub-core/fs/fat.c +index 72785a7..760927c 100644 +--- a/grub-core/fs/fat.c ++++ b/grub-core/fs/fat.c +@@ -245,7 +245,7 @@ grub_fat_mount (grub_disk_t disk) + #ifdef MODE_EXFAT + if (grub_memcmp ((const char *) bpb.oem_name, "EXFAT ", + sizeof (bpb.oem_name)) != 0) +- goto fail; ++ goto fail; + #endif + + /* Get the sizes of logical sectors and clusters. */ +@@ -320,7 +320,7 @@ grub_fat_mount (grub_disk_t disk) + #endif + + #ifdef MODE_EXFAT +- data->cluster_sector = (grub_le_to_cpu32 (bpb.cluster_offset) ++ data->cluster_sector = (grub_le_to_cpu32 (bpb.cluster_offset) + << data->logical_sector_bits); + data->num_clusters = (grub_le_to_cpu32 (bpb.cluster_count) + << data->logical_sector_bits); +@@ -692,7 +692,7 @@ grub_fat_iterate_dir_next (grub_fshelp_node_t node, + { + int j; + for (j = 0; j < 15; j++) +- ctxt->unibuf[slots * 15 + j] ++ ctxt->unibuf[slots * 15 + j] + = grub_le_to_cpu16 (sec.type_specific.file_name.str[j]); + slots++; + } +diff --git a/grub-core/fs/fshelp.c b/grub-core/fs/fshelp.c +index a2d0d29..cb41934 100644 +--- a/grub-core/fs/fshelp.c ++++ b/grub-core/fs/fshelp.c +@@ -215,7 +215,7 @@ find_file (char *currpath, + break; + + push_node (ctx, foundnode, foundtype); +- ++ + /* Read in the symlink and follow it. */ + if (ctx->currnode->type == GRUB_FSHELP_SYMLINK) + { +@@ -326,7 +326,7 @@ grub_fshelp_find_file (const char *path, grub_fshelp_node_t rootnode, + enum grub_fshelp_filetype expecttype) + { + return grub_fshelp_find_file_real (path, rootnode, foundnode, +- iterate_dir, NULL, ++ iterate_dir, NULL, + read_symlink, expecttype); + + } +@@ -339,7 +339,7 @@ grub_fshelp_find_file_lookup (const char *path, grub_fshelp_node_t rootnode, + enum grub_fshelp_filetype expecttype) + { + return grub_fshelp_find_file_real (path, rootnode, foundnode, +- NULL, lookup_file, ++ NULL, lookup_file, + read_symlink, expecttype); + + } +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 66b9fca..f23d10f 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -883,7 +883,7 @@ grub_hfs_iterate_dir_it_dir (struct grub_hfs_node *hnd __attribute ((unused)), + { + struct grub_hfs_catalog_key *ckey = rec->key; + struct grub_hfs_iterate_dir_node_found_ctx *ctx = hook_arg; +- ++ + /* Stop when the entries do not match anymore. */ + if (ckey->parent_dir != ctx->dir_be) + return 1; +@@ -1077,7 +1077,7 @@ macroman_to_utf8 (char *to, const grub_uint8_t *from, grub_size_t len, + { + *optr++ = ':'; + continue; +- } ++ } + if (!(*iptr & 0x80)) + { + *optr++ = *iptr; +@@ -1094,7 +1094,7 @@ utf8_to_macroman (grub_uint8_t *to, const char *from) + grub_uint8_t *end = to + 31; + grub_uint8_t *optr = to; + const char *iptr = from; +- ++ + while (*iptr && optr < end) + { + int i, clen; +@@ -1104,7 +1104,7 @@ utf8_to_macroman (grub_uint8_t *to, const char *from) + *optr++ = '/'; + iptr++; + continue; +- } ++ } + if (!(*iptr & 0x80)) + { + *optr++ = *iptr++; +@@ -1165,7 +1165,7 @@ lookup_file (grub_fshelp_node_t dir, + *foundnode = grub_malloc (sizeof (struct grub_fshelp_node)); + if (!*foundnode) + return grub_errno; +- ++ + (*foundnode)->inode = grub_be_to_cpu32 (fdrec.dir.dirid); + (*foundnode)->fdrec = fdrec; + (*foundnode)->data = dir->data; +@@ -1266,7 +1266,7 @@ grub_hfs_dir (grub_device_t device, const char *path, grub_fs_dir_hook_t hook, + .hook_data = hook_data + }; + grub_fshelp_node_t found = NULL; +- ++ + grub_dl_ref (my_mod); + + data = grub_hfs_mount (device->disk); +@@ -1295,7 +1295,7 @@ grub_hfs_open (struct grub_file *file, const char *name) + { + struct grub_hfs_data *data; + grub_fshelp_node_t found = NULL; +- ++ + grub_dl_ref (my_mod); + + data = grub_hfs_mount (file->device->disk); +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index a1805ee..da829f9 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -19,7 +19,7 @@ + + /* HFS+ is documented at http://developer.apple.com/technotes/tn/tn1150.html */ + +-#define grub_fshelp_node grub_hfsplus_file ++#define grub_fshelp_node grub_hfsplus_file + #include + #include + #include +@@ -146,7 +146,7 @@ grub_hfsplus_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + { + struct grub_hfsplus_btnode *nnode = 0; + grub_disk_addr_t blksleft = fileblock; +- struct grub_hfsplus_extent *extents = node->compressed ++ struct grub_hfsplus_extent *extents = node->compressed + ? &node->resource_extents[0] : &node->extents[0]; + + while (1) +@@ -476,7 +476,7 @@ grub_hfsplus_cmp_extkey (struct grub_hfsplus_key *keya, + + if (extkey_a->type < extkey_b->type) + return -1; +- ++ + akey = grub_be_to_cpu32 (extkey_a->start); + if (akey > extkey_b->start) + return 1; +@@ -567,7 +567,7 @@ grub_hfsplus_btree_search (struct grub_hfsplus_btree *btree, + struct grub_hfsplus_key_internal *key, + int (*compare_keys) (struct grub_hfsplus_key *keya, + struct grub_hfsplus_key_internal *keyb), +- struct grub_hfsplus_btnode **matchnode, ++ struct grub_hfsplus_btnode **matchnode, + grub_off_t *keyoffset) + { + grub_uint64_t currnode; +diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c +index 4965ef1..b3240a0 100644 +--- a/grub-core/fs/hfspluscomp.c ++++ b/grub-core/fs/hfspluscomp.c +@@ -179,7 +179,7 @@ hfsplus_read_compressed_real (struct grub_hfsplus_file *node, + return len0; + } + +-static grub_err_t ++static grub_err_t + hfsplus_open_compressed_real (struct grub_hfsplus_file *node) + { + grub_err_t err; +@@ -311,8 +311,8 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node) + + GRUB_MOD_INIT(hfspluscomp) + { +- grub_hfsplus_open_compressed = hfsplus_open_compressed_real; +- grub_hfsplus_read_compressed = hfsplus_read_compressed_real; ++ grub_hfsplus_open_compressed = hfsplus_open_compressed_real; ++ grub_hfsplus_read_compressed = hfsplus_read_compressed_real; + } + + GRUB_MOD_FINI(hfspluscomp) +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 5765055..29ab60f 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -181,7 +181,7 @@ static grub_err_t + iso9660_to_unixtime (const struct grub_iso9660_date *i, grub_int32_t *nix) + { + struct grub_datetime datetime; +- ++ + if (! i->year[0] && ! i->year[1] + && ! i->year[2] && ! i->year[3] + && ! i->month[0] && ! i->month[1] +@@ -198,7 +198,7 @@ iso9660_to_unixtime (const struct grub_iso9660_date *i, grub_int32_t *nix) + datetime.hour = (i->hour[0] - '0') * 10 + (i->hour[1] - '0'); + datetime.minute = (i->minute[0] - '0') * 10 + (i->minute[1] - '0'); + datetime.second = (i->second[0] - '0') * 10 + (i->second[1] - '0'); +- ++ + if (!grub_datetime2unixtime (&datetime, nix)) + return grub_error (GRUB_ERR_BAD_NUMBER, "incorrect date"); + *nix -= i->offset * 60 * 15; +@@ -216,7 +216,7 @@ iso9660_to_unixtime2 (const struct grub_iso9660_date2 *i, grub_int32_t *nix) + datetime.hour = i->hour; + datetime.minute = i->minute; + datetime.second = i->second; +- ++ + if (!grub_datetime2unixtime (&datetime, nix)) + return 0; + *nix -= i->offset * 60 * 15; +@@ -502,7 +502,7 @@ grub_iso9660_mount (grub_disk_t disk) + static char * + grub_iso9660_read_symlink (grub_fshelp_node_t node) + { +- return node->have_symlink ++ return node->have_symlink + ? grub_strdup (node->symlink + + (node->have_dirents) * sizeof (node->dirents[0]) + - sizeof (node->dirents)) : grub_strdup (""); +@@ -552,7 +552,7 @@ add_part (struct iterate_dir_ctx *ctx, + ctx->symlink = new; + + grub_memcpy (ctx->symlink + size, part, len2); +- ctx->symlink[size + len2] = 0; ++ ctx->symlink[size + len2] = 0; + } + + static grub_err_t +@@ -1119,7 +1119,7 @@ grub_iso9660_uuid (grub_device_t device, char **uuid) + } + + /* Get writing time of filesystem. */ +-static grub_err_t ++static grub_err_t + grub_iso9660_mtime (grub_device_t device, grub_int32_t *timebuf) + { + struct grub_iso9660_data *data; +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index 38e6587..f31909d 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -97,10 +97,10 @@ struct grub_minix_sblock + grub_uint32_t max_file_size; + grub_uint32_t zones; + grub_uint16_t magic; +- ++ + grub_uint16_t pad2; + grub_uint16_t block_size; +- grub_uint8_t disk_version; ++ grub_uint8_t disk_version; + }; + #else + struct grub_minix_sblock +@@ -350,7 +350,7 @@ grub_minix_read_inode (struct grub_minix_data *data, grub_minix_ino_t ino) + int offs = (ino % (GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_minix_inode)) + * sizeof (struct grub_minix_inode)); +- ++ + grub_disk_read (data->disk, block, offs, + sizeof (struct grub_minix_inode), &data->inode); + +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index 6d1e25f..6aaa5b9 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -1,5 +1,5 @@ +-/* +- * nilfs2.c - New Implementation of Log filesystem ++/* ++ * nilfs2.c - New Implementation of Log filesystem + * + * Written by Jiro SEKIBA + * +@@ -681,12 +681,12 @@ grub_nilfs2_read_checkpoint (struct grub_nilfs2_data *data, + grub_disk_t disk = data->disk; + unsigned int nilfs2_block_count = (1 << LOG2_NILFS2_BLOCK_SIZE (data)); + +- /* Assume sizeof(struct grub_nilfs2_cpfile_header) < ++ /* Assume sizeof(struct grub_nilfs2_cpfile_header) < + sizeof(struct grub_nilfs2_checkpoint). + */ + blockno = grub_divmod64 (cpno, NILFS2_BLOCK_SIZE (data) / + sizeof (struct grub_nilfs2_checkpoint), &offset); +- ++ + pptr = grub_nilfs2_bmap_lookup (data, &data->sroot.sr_cpfile, blockno, 1); + if (pptr == (grub_uint64_t) - 1) + { +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index e9d30f0..8c331b5 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -17,7 +17,7 @@ + * along with this program. If not, see . + */ + +-#define grub_fshelp_node grub_ntfs_file ++#define grub_fshelp_node grub_ntfs_file + + #include + #include +@@ -33,7 +33,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + static grub_dl_t my_mod; + +-#define grub_fshelp_node grub_ntfs_file ++#define grub_fshelp_node grub_ntfs_file + + static inline grub_uint16_t + u16at (void *ptr, grub_size_t ofs) +@@ -837,7 +837,7 @@ grub_ntfs_read_symlink (grub_fshelp_node_t node) + && grub_isalpha (buf[4])) + { + grub_memmove (buf, buf + 6, end - buf + 1 - 6); +- end -= 6; ++ end -= 6; + } + return buf; + } +@@ -1130,7 +1130,7 @@ grub_ntfs_dir_iter (const char *filename, enum grub_fshelp_filetype filetype, + grub_memset (&info, 0, sizeof (info)); + info.dir = ((filetype & GRUB_FSHELP_TYPE_MASK) == GRUB_FSHELP_DIR); + info.mtimeset = 1; +- info.mtime = grub_divmod64 (node->mtime, 10000000, 0) ++ info.mtime = grub_divmod64 (node->mtime, 10000000, 0) + - 86400ULL * 365 * (1970 - 1601) + - 86400ULL * ((1970 - 1601) / 4) + 86400ULL * ((1970 - 1601) / 100); + grub_free (node); +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index 72e724f..612d9ed 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -776,7 +776,7 @@ grub_reiserfs_iterate_dir (grub_fshelp_node_t item, + char *entry_name; + char *entry_name_end = 0; + char c; +- ++ + if (!(entry_state & GRUB_REISERFS_VISIBLE_MASK)) + continue; + +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index d7817cd..b9f2650 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -113,7 +113,7 @@ grub_romfs_mount (grub_device_t dev) + { + grub_error (GRUB_ERR_BAD_FS, "not romfs"); + return NULL; +- } ++ } + err = do_checksum (&sb, sizeof (sb) < grub_be_to_cpu32 (sb.sb.total_size) ? + sizeof (sb) : grub_be_to_cpu32 (sb.sb.total_size)); + if (err) +@@ -272,7 +272,7 @@ grub_romfs_iterate_dir (grub_fshelp_node_t dir, + while (1) + { + char buf[16]; +- err = grub_disk_read (dir->data->disk, ++ err = grub_disk_read (dir->data->disk, + laddr >> GRUB_DISK_SECTOR_BITS, + laddr & (GRUB_DISK_SECTOR_SIZE - 1), + 16, buf); +@@ -299,7 +299,7 @@ grub_romfs_iterate_dir (grub_fshelp_node_t dir, + node->data_addr = grub_be_to_cpu32 (node->file.spec); + filetype = GRUB_FSHELP_DIR; + } +- ++ + break; + } + } +@@ -403,7 +403,7 @@ grub_romfs_read (grub_file_t file, char *buf, grub_size_t len) + data->data->disk->read_hook_data = file->read_hook_data; + grub_disk_read (data->data->disk, + (data->data_addr + file->offset) >> GRUB_DISK_SECTOR_BITS, +- (data->data_addr + file->offset) & (GRUB_DISK_SECTOR_SIZE - 1), ++ (data->data_addr + file->offset) & (GRUB_DISK_SECTOR_SIZE - 1), + len, buf); + data->data->disk->read_hook = NULL; + +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index b145bb9..a09cae4 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -210,7 +210,7 @@ struct grub_fshelp_node + struct grub_squash_data *data; + struct grub_squash_inode ino; + grub_size_t stsize; +- struct ++ struct + { + grub_disk_addr_t ino_chunk; + grub_uint16_t ino_offset; +@@ -243,7 +243,7 @@ read_chunk (struct grub_squash_data *data, void *buf, grub_size_t len, + csize = SQUASH_CHUNK_SIZE - offset; + if (csize > len) + csize = len; +- ++ + if (grub_le_to_cpu16 (d) & SQUASH_CHUNK_UNCOMPRESSED) + { + grub_disk_addr_t a = chunk_start + 2 + offset; +@@ -256,7 +256,7 @@ read_chunk (struct grub_squash_data *data, void *buf, grub_size_t len, + else + { + char *tmp; +- grub_size_t bsize = grub_le_to_cpu16 (d) & ~SQUASH_CHUNK_FLAGS; ++ grub_size_t bsize = grub_le_to_cpu16 (d) & ~SQUASH_CHUNK_FLAGS; + grub_disk_addr_t a = chunk_start + 2; + tmp = grub_malloc (bsize); + if (!tmp) +@@ -339,7 +339,7 @@ xz_decompress (char *inbuf, grub_size_t insize, grub_off_t off, + while (len) + { + enum xz_ret xzret; +- ++ + buf.out_pos = 0; + + xzret = xz_dec_run (data->xzdec, &buf); +@@ -399,9 +399,9 @@ squash_mount (grub_disk_t disk) + return NULL; + } + +- err = grub_disk_read (disk, ++ err = grub_disk_read (disk, + grub_le_to_cpu64 (sb.unk1offset) +- >> GRUB_DISK_SECTOR_BITS, ++ >> GRUB_DISK_SECTOR_BITS, + grub_le_to_cpu64 (sb.unk1offset) + & (GRUB_DISK_SECTOR_SIZE - 1), sizeof (frag), &frag); + if (grub_errno == GRUB_ERR_OUT_OF_RANGE) +@@ -448,7 +448,7 @@ squash_mount (grub_disk_t disk) + } + + data->blksz = grub_le_to_cpu32 (data->sb.block_size); +- for (data->log2_blksz = 0; ++ for (data->log2_blksz = 0; + (1U << data->log2_blksz) < data->blksz; + data->log2_blksz++); + +@@ -649,7 +649,7 @@ make_root_node (struct grub_squash_data *data, struct grub_fshelp_node *root) + root->stack[0].ino_chunk = grub_le_to_cpu32 (data->sb.root_ino_chunk); + root->stack[0].ino_offset = grub_cpu_to_le16 (data->sb.root_ino_offset); + return read_chunk (data, &root->ino, sizeof (root->ino), +- grub_le_to_cpu64 (data->sb.inodeoffset) ++ grub_le_to_cpu64 (data->sb.inodeoffset) + + root->stack[0].ino_chunk, + root->stack[0].ino_offset); + } +@@ -771,7 +771,7 @@ grub_squash_open (struct grub_file *file, const char *name) + } + + static grub_ssize_t +-direct_read (struct grub_squash_data *data, ++direct_read (struct grub_squash_data *data, + struct grub_squash_cache_inode *ino, + grub_off_t off, char *buf, grub_size_t len) + { +@@ -888,7 +888,7 @@ direct_read (struct grub_squash_data *data, + grub_free (block); + } + else +- err = grub_disk_read (data->disk, ++ err = grub_disk_read (data->disk, + (ino->cumulated_block_sizes[i] + a + boff) + >> GRUB_DISK_SECTOR_BITS, + (ino->cumulated_block_sizes[i] + a + boff) +@@ -952,7 +952,7 @@ grub_squash_read (grub_file_t file, char *buf, grub_size_t len) + } + else + off -= direct_len; +- ++ + err = read_chunk (data, &frag, sizeof (frag), + data->fragments, sizeof (frag) * fragment); + if (err) +@@ -963,7 +963,7 @@ grub_squash_read (grub_file_t file, char *buf, grub_size_t len) + b = grub_le_to_cpu32 (ino->ino.long_file.offset) + off; + else + b = grub_le_to_cpu32 (ino->ino.file.offset) + off; +- ++ + /* FIXME: cache uncompressed chunks. */ + if (compressed) + { +@@ -1019,7 +1019,7 @@ grub_squash_mtime (grub_device_t dev, grub_int32_t *tm) + *tm = grub_le_to_cpu32 (data->sb.creation_time); + squash_unmount (data); + return GRUB_ERR_NONE; +-} ++} + + static struct grub_fs grub_squash_fs = + { +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 4062609..734af09 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -568,7 +568,7 @@ grub_udf_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + (buf + sizeof (struct grub_udf_aed)); + continue; + } +- ++ + if (filebytes < adlen) + { + grub_uint32_t ad_block_num = ad->block.block_num; +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index 844a439..df5db80 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -569,7 +569,7 @@ grub_ufs_find_file (struct grub_ufs_data *data, const char *path) + { + dirino = data->ino; + grub_ufs_read_inode (data, grub_ufs_to_cpu32 (dirent.ino), 0); +- ++ + if ((INODE_MODE(data) & GRUB_UFS_ATTR_TYPE) + == GRUB_UFS_ATTR_LNK) + { +@@ -614,7 +614,7 @@ grub_ufs_mount (grub_disk_t disk) + && ((data->sblock.bsize & (data->sblock.bsize - 1)) == 0) + && data->sblock.ino_per_group != 0) + { +- for (data->log2_blksz = 0; ++ for (data->log2_blksz = 0; + (1U << data->log2_blksz) < grub_ufs_to_cpu32 (data->sblock.bsize); + data->log2_blksz++); + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 7d15add..4caf29f 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -942,7 +942,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + tag, which is not used by GRUB. So it can be overwritten. */ + filename[direntry->len] = '\0'; + +- if (iterate_dir_call_hook (grub_be_to_cpu64(direntry->inode), ++ if (iterate_dir_call_hook (grub_be_to_cpu64(direntry->inode), + filename, &ctx)) + { + grub_free (dirblock); +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 5254e75..de6e26f 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -173,7 +173,7 @@ typedef struct decomp_entry + /* + * Signature for checksum functions. + */ +-typedef void zio_checksum_t(const void *data, grub_uint64_t size, ++typedef void zio_checksum_t(const void *data, grub_uint64_t size, + grub_zfs_endian_t endian, zio_cksum_t *zcp); + + /* +@@ -294,7 +294,7 @@ check_feature(const char *name, grub_uint64_t val, struct grub_zfs_dir_ctx *ctx) + static grub_err_t + check_mos_features(dnode_phys_t *mosmdn_phys,grub_zfs_endian_t endian,struct grub_zfs_data* data ); + +-static grub_err_t ++static grub_err_t + zlib_decompress (void *s, void *d, + grub_size_t slen, grub_size_t dlen) + { +@@ -307,7 +307,7 @@ zlib_decompress (void *s, void *d, + return grub_errno; + } + +-static grub_err_t ++static grub_err_t + zle_decompress (void *s, void *d, + grub_size_t slen, grub_size_t dlen) + { +@@ -412,7 +412,7 @@ static zio_checksum_info_t zio_checksum_table[ZIO_CHECKSUM_FUNCTIONS] = { + */ + static grub_err_t + zio_checksum_verify (zio_cksum_t zc, grub_uint32_t checksum, +- grub_zfs_endian_t endian, ++ grub_zfs_endian_t endian, + char *buf, grub_size_t size) + { + zio_eck_t *zec = (zio_eck_t *) (buf + size) - 1; +@@ -422,14 +422,14 @@ zio_checksum_verify (zio_cksum_t zc, grub_uint32_t checksum, + if (checksum >= ZIO_CHECKSUM_FUNCTIONS || ci->ci_func == NULL) + { + grub_dprintf ("zfs", "unknown checksum function %d\n", checksum); +- return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, ++ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, + "unknown checksum function %d", checksum); + } + + if (ci->ci_eck) + { +- expected_cksum = zec->zec_cksum; +- zec->zec_cksum = zc; ++ expected_cksum = zec->zec_cksum; ++ zec->zec_cksum = zc; + ci->ci_func (buf, size, endian, &actual_cksum); + zec->zec_cksum = expected_cksum; + zc = expected_cksum; +@@ -442,14 +442,14 @@ zio_checksum_verify (zio_cksum_t zc, grub_uint32_t checksum, + { + grub_dprintf ("zfs", "checksum %s verification failed\n", ci->ci_name); + grub_dprintf ("zfs", "actual checksum %016llx %016llx %016llx %016llx\n", +- (unsigned long long) actual_cksum.zc_word[0], ++ (unsigned long long) actual_cksum.zc_word[0], + (unsigned long long) actual_cksum.zc_word[1], +- (unsigned long long) actual_cksum.zc_word[2], ++ (unsigned long long) actual_cksum.zc_word[2], + (unsigned long long) actual_cksum.zc_word[3]); + grub_dprintf ("zfs", "expected checksum %016llx %016llx %016llx %016llx\n", +- (unsigned long long) zc.zc_word[0], ++ (unsigned long long) zc.zc_word[0], + (unsigned long long) zc.zc_word[1], +- (unsigned long long) zc.zc_word[2], ++ (unsigned long long) zc.zc_word[2], + (unsigned long long) zc.zc_word[3]); + return grub_error (GRUB_ERR_BAD_FS, N_("checksum verification failed")); + } +@@ -482,17 +482,17 @@ vdev_uberblock_compare (uberblock_t * ub1, uberblock_t * ub2) + else + ub2_endian = GRUB_ZFS_BIG_ENDIAN; + +- if (grub_zfs_to_cpu64 (ub1->ub_txg, ub1_endian) ++ if (grub_zfs_to_cpu64 (ub1->ub_txg, ub1_endian) + < grub_zfs_to_cpu64 (ub2->ub_txg, ub2_endian)) + return -1; +- if (grub_zfs_to_cpu64 (ub1->ub_txg, ub1_endian) ++ if (grub_zfs_to_cpu64 (ub1->ub_txg, ub1_endian) + > grub_zfs_to_cpu64 (ub2->ub_txg, ub2_endian)) + return 1; + +- if (grub_zfs_to_cpu64 (ub1->ub_timestamp, ub1_endian) ++ if (grub_zfs_to_cpu64 (ub1->ub_timestamp, ub1_endian) + < grub_zfs_to_cpu64 (ub2->ub_timestamp, ub2_endian)) + return -1; +- if (grub_zfs_to_cpu64 (ub1->ub_timestamp, ub1_endian) ++ if (grub_zfs_to_cpu64 (ub1->ub_timestamp, ub1_endian) + > grub_zfs_to_cpu64 (ub2->ub_timestamp, ub2_endian)) + return 1; + +@@ -570,7 +570,7 @@ find_bestub (uberblock_phys_t * ub_array, + grub_errno = GRUB_ERR_NONE; + continue; + } +- if (ubbest == NULL ++ if (ubbest == NULL + || vdev_uberblock_compare (&(ubptr->ubp_uberblock), + &(ubbest->ubp_uberblock)) > 0) + ubbest = ubptr; +@@ -591,10 +591,10 @@ get_psize (blkptr_t * bp, grub_zfs_endian_t endian) + static grub_uint64_t + dva_get_offset (const dva_t *dva, grub_zfs_endian_t endian) + { +- grub_dprintf ("zfs", "dva=%llx, %llx\n", +- (unsigned long long) dva->dva_word[0], ++ grub_dprintf ("zfs", "dva=%llx, %llx\n", ++ (unsigned long long) dva->dva_word[0], + (unsigned long long) dva->dva_word[1]); +- return grub_zfs_to_cpu64 ((dva)->dva_word[1], ++ return grub_zfs_to_cpu64 ((dva)->dva_word[1], + endian) << SPA_MINBLOCKSHIFT; + } + +@@ -843,7 +843,7 @@ nvlist_next_nvpair (const char *nvl, const char *nvpair) + { + /* skip over header, nvl_version and nvl_nvflag */ + nvpair = nvl + 4 * 3; +- } ++ } + else + { + /* skip to the next nvpair */ +@@ -877,10 +877,10 @@ nvlist_next_nvpair (const char *nvl, const char *nvpair) + name_len = grub_be_to_cpu32 (grub_get_unaligned32 (nvp)); + nvp += 4; + +- nvp = nvp + ((name_len + 3) & ~3); // align +- if (nvp + 4 >= nvl + VDEV_PHYS_SIZE ++ nvp = nvp + ((name_len + 3) & ~3); // align ++ if (nvp + 4 >= nvl + VDEV_PHYS_SIZE + || encode_size < 0 +- || nvp + 4 + encode_size > nvl + VDEV_PHYS_SIZE) ++ || nvp + 4 + encode_size > nvl + VDEV_PHYS_SIZE) + { + grub_dprintf ("zfs", "nvlist overflow\n"); + grub_error (GRUB_ERR_BAD_FS, "incorrect nvlist"); +@@ -900,7 +900,7 @@ nvpair_name (const char *nvp, char **buf, grub_size_t *buflen) + { + /* skip over encode/decode size */ + nvp += 4 * 2; +- ++ + *buf = (char *) (nvp + 4); + *buflen = grub_be_to_cpu32 (grub_get_unaligned32 (nvp)); + +@@ -947,7 +947,7 @@ nvpair_value (const char *nvp,char **val, + + /* skip over name */ + nvp = nvp + ((name_len + 3) & ~3); /* align */ +- ++ + /* skip over type */ + nvp += 4; + nelm = grub_be_to_cpu32 (grub_get_unaligned32 (nvp)); +@@ -961,7 +961,7 @@ nvpair_value (const char *nvp,char **val, + *size_out = encode_size; + if (nelm_out) + *nelm_out = nelm; +- ++ + return 1; + } + +@@ -1187,7 +1187,7 @@ scan_disk (grub_device_t dev, struct grub_zfs_data *data, + desc.vdev_phys_sector + = label * (sizeof (vdev_label_t) >> SPA_MINBLOCKSHIFT) + + ((VDEV_SKIP_SIZE + VDEV_BOOT_HEADER_SIZE) >> SPA_MINBLOCKSHIFT) +- + (label < VDEV_LABELS / 2 ? 0 : ++ + (label < VDEV_LABELS / 2 ? 0 : + ALIGN_DOWN (grub_disk_get_size (dev->disk), sizeof (vdev_label_t)) + - VDEV_LABELS * (sizeof (vdev_label_t) >> SPA_MINBLOCKSHIFT)); + +@@ -1233,7 +1233,7 @@ scan_disk (grub_device_t dev, struct grub_zfs_data *data, + grub_free (bh); + return GRUB_ERR_NONE; + } +- ++ + grub_free (ub_array); + grub_free (bh); + +@@ -1273,7 +1273,7 @@ scan_devices_iter (const char *name, void *hook_data) + + if (!inserted) + grub_device_close (dev); +- ++ + return 0; + } + +@@ -1390,7 +1390,7 @@ recovery (grub_uint8_t *bufs[4], grub_size_t s, const int nbufs, + for (i = 0; i < nbufs; i++) + { + grub_uint8_t mul; +- for (j = i; j < nbufs; j++) ++ for (j = i; j < nbufs; j++) + if (matrix1[i][j]) + break; + if (j == nbufs) +@@ -1457,7 +1457,7 @@ recovery (grub_uint8_t *bufs[4], grub_size_t s, const int nbufs, + } + default: + return grub_error (GRUB_ERR_BUG, "too big matrix"); +- } ++ } + } + + static grub_err_t +@@ -1514,7 +1514,7 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc, + int idx, orig_idx; + + if (desc->nparity < 1 || desc->nparity > 3) +- return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, ++ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, + "raidz%d is not supported", desc->nparity); + + if (desc->n_children <= desc->nparity || desc->n_children < 1) +@@ -1663,7 +1663,7 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc, + len -= csize; + idx--; + } +- for (i = 0; i < failed_devices ++ for (i = 0; i < failed_devices + && recovery_len[i] == recovery_len[0]; + i++); + /* Since the chunks have variable length handle the last block +@@ -1786,7 +1786,7 @@ zio_read_gang (blkptr_t * bp, grub_zfs_endian_t endian, dva_t * dva, void *buf, + * Read in a block of raw data to buf. + */ + static grub_err_t +-zio_read_data (blkptr_t * bp, grub_zfs_endian_t endian, void *buf, ++zio_read_data (blkptr_t * bp, grub_zfs_endian_t endian, void *buf, + struct grub_zfs_data *data) + { + int i, psize; +@@ -1854,7 +1854,7 @@ decode_embedded_bp_compressed(const blkptr_t *bp, void *buf) + * and put the uncompressed data in buf. + */ + static grub_err_t +-zio_read (blkptr_t *bp, grub_zfs_endian_t endian, void **buf, ++zio_read (blkptr_t *bp, grub_zfs_endian_t endian, void **buf, + grub_size_t *size, struct grub_zfs_data *data) + { + grub_size_t lsize, psize; +@@ -1940,7 +1940,7 @@ zio_read (blkptr_t *bp, grub_zfs_endian_t endian, void **buf, + if (encrypted) + { + if (!grub_zfs_decrypt) +- err = grub_error (GRUB_ERR_BAD_FS, ++ err = grub_error (GRUB_ERR_BAD_FS, + N_("module `%s' isn't loaded"), + "zfscrypt"); + else +@@ -1964,7 +1964,7 @@ zio_read (blkptr_t *bp, grub_zfs_endian_t endian, void **buf, + endian)); + return grub_error (GRUB_ERR_BAD_FS, "no key found in keychain"); + } +- grub_dprintf ("zfs", "using key %u (%" PRIxGRUB_UINT64_T ++ grub_dprintf ("zfs", "using key %u (%" PRIxGRUB_UINT64_T + ", %p) for txg %" PRIxGRUB_UINT64_T "\n", + besti, data->subvol.keyring[besti].txg, + data->subvol.keyring[besti].cipher, +@@ -2012,7 +2012,7 @@ zio_read (blkptr_t *bp, grub_zfs_endian_t endian, void **buf, + * + */ + static grub_err_t +-dmu_read (dnode_end_t * dn, grub_uint64_t blkid, void **buf, ++dmu_read (dnode_end_t * dn, grub_uint64_t blkid, void **buf, + grub_zfs_endian_t *endian_out, struct grub_zfs_data *data) + { + int level; +@@ -2042,8 +2042,8 @@ dmu_read (dnode_end_t * dn, grub_uint64_t blkid, void **buf, + + if (BP_IS_HOLE (bp)) + { +- grub_size_t size = grub_zfs_to_cpu16 (dn->dn.dn_datablkszsec, +- dn->endian) ++ grub_size_t size = grub_zfs_to_cpu16 (dn->dn.dn_datablkszsec, ++ dn->endian) + << SPA_MINBLOCKSHIFT; + *buf = grub_malloc (size); + if (!*buf) +@@ -2107,7 +2107,7 @@ mzap_lookup (mzap_phys_t * zapobj, grub_zfs_endian_t endian, + } + + static int +-mzap_iterate (mzap_phys_t * zapobj, grub_zfs_endian_t endian, int objsize, ++mzap_iterate (mzap_phys_t * zapobj, grub_zfs_endian_t endian, int objsize, + int (*hook) (const char *name, grub_uint64_t val, + struct grub_zfs_dir_ctx *ctx), + struct grub_zfs_dir_ctx *ctx) +@@ -2121,7 +2121,7 @@ mzap_iterate (mzap_phys_t * zapobj, grub_zfs_endian_t endian, int objsize, + grub_dprintf ("zfs", "zap: name = %s, value = %llx, cd = %x\n", + mzap_ent[i].mze_name, (long long)mzap_ent[i].mze_value, + (int)mzap_ent[i].mze_cd); +- if (hook (mzap_ent[i].mze_name, ++ if (hook (mzap_ent[i].mze_name, + grub_zfs_to_cpu64 (mzap_ent[i].mze_value, endian), ctx)) + return 1; + } +@@ -2182,12 +2182,12 @@ name_cmp (const char *s1, const char *s2, grub_size_t n, + + if (!case_insensitive) + return grub_memcmp (t1, t2, n); +- ++ + while (n--) + { + if (grub_toupper (*t1) != grub_toupper (*t2)) + return (int) grub_toupper (*t1) - (int) grub_toupper (*t2); +- ++ + t1++; + t2++; + } +@@ -2225,7 +2225,7 @@ zap_leaf_array_equal (zap_leaf_phys_t * l, grub_zfs_endian_t endian, + + /* XXX */ + static grub_err_t +-zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft, ++zap_leaf_array_get (zap_leaf_phys_t * l, grub_zfs_endian_t endian, int blksft, + int chunk, grub_size_t array_len, char *buf) + { + grub_size_t bseen = 0; +@@ -2289,7 +2289,7 @@ zap_leaf_lookup (zap_leaf_phys_t * l, grub_zfs_endian_t endian, + + grub_dprintf ("zfs", "fzap: length %d\n", (int) le->le_name_length); + +- if (zap_leaf_array_equal (l, endian, blksft, ++ if (zap_leaf_array_equal (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk,endian), + grub_zfs_to_cpu16 (le->le_name_length, endian), + name, case_insensitive)) +@@ -2338,7 +2338,7 @@ fzap_lookup (dnode_end_t * zap_dnode, zap_phys_t * zap, + { + void *l; + grub_uint64_t hash, idx, blkid; +- int blksft = zfs_log2 (grub_zfs_to_cpu16 (zap_dnode->dn.dn_datablkszsec, ++ int blksft = zfs_log2 (grub_zfs_to_cpu16 (zap_dnode->dn.dn_datablkszsec, + zap_dnode->endian) << DNODE_SHIFT); + grub_err_t err; + grub_zfs_endian_t leafendian; +@@ -2351,7 +2351,7 @@ fzap_lookup (dnode_end_t * zap_dnode, zap_phys_t * zap, + + /* get block id from index */ + if (zap->zap_ptrtbl.zt_numblks != 0) +- return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, ++ return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, + "external pointer tables not supported"); + idx = ZAP_HASH_IDX (hash, zap->zap_ptrtbl.zt_shift); + blkid = grub_zfs_to_cpu64 (((grub_uint64_t *) zap)[idx + (1 << (blksft - 3 - 1))], zap_dnode->endian); +@@ -2383,7 +2383,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + void *l_in; + grub_uint64_t idx, idx2, blkid; + grub_uint16_t chunk; +- int blksft = zfs_log2 (grub_zfs_to_cpu16 (zap_dnode->dn.dn_datablkszsec, ++ int blksft = zfs_log2 (grub_zfs_to_cpu16 (zap_dnode->dn.dn_datablkszsec, + zap_dnode->endian) << DNODE_SHIFT); + grub_err_t err; + grub_zfs_endian_t endian; +@@ -2395,7 +2395,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + /* get block id from index */ + if (zap->zap_ptrtbl.zt_numblks != 0) + { +- grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, ++ grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET, + "external pointer tables not supported"); + return 0; + } +@@ -2539,7 +2539,7 @@ zap_lookup (dnode_end_t * zap_dnode, const char *name, grub_uint64_t *val, + grub_dprintf ("zfs", "micro zap\n"); + err = mzap_lookup (zapbuf, endian, size, name, val, + case_insensitive); +- grub_dprintf ("zfs", "returned %d\n", err); ++ grub_dprintf ("zfs", "returned %d\n", err); + grub_free (zapbuf); + return err; + } +@@ -2549,7 +2549,7 @@ zap_lookup (dnode_end_t * zap_dnode, const char *name, grub_uint64_t *val, + /* this is a fat zap */ + err = fzap_lookup (zap_dnode, zapbuf, name, val, data, + case_insensitive); +- grub_dprintf ("zfs", "returned %d\n", err); ++ grub_dprintf ("zfs", "returned %d\n", err); + grub_free (zapbuf); + return err; + } +@@ -2582,7 +2582,7 @@ zap_iterate_u64_transform (const void *name, + } + + static int +-zap_iterate_u64 (dnode_end_t * zap_dnode, ++zap_iterate_u64 (dnode_end_t * zap_dnode, + int (*hook) (const char *name, grub_uint64_t val, + struct grub_zfs_dir_ctx *ctx), + struct grub_zfs_data *data, struct grub_zfs_dir_ctx *ctx) +@@ -2629,7 +2629,7 @@ zap_iterate_u64 (dnode_end_t * zap_dnode, + } + + static int +-zap_iterate (dnode_end_t * zap_dnode, ++zap_iterate (dnode_end_t * zap_dnode, + grub_size_t nameelemlen, + int (*hook) (const void *name, grub_size_t namelen, + const void *val_in, +@@ -2689,7 +2689,7 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type, + grub_err_t err; + grub_zfs_endian_t endian; + +- blksz = grub_zfs_to_cpu16 (mdn->dn.dn_datablkszsec, ++ blksz = grub_zfs_to_cpu16 (mdn->dn.dn_datablkszsec, + mdn->endian) << SPA_MINBLOCKSHIFT; + epbs = zfs_log2 (blksz) - DNODE_SHIFT; + +@@ -2700,18 +2700,18 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type, + blkid = objnum >> epbs; + idx = objnum & ((1 << epbs) - 1); + +- if (data->dnode_buf != NULL && grub_memcmp (data->dnode_mdn, mdn, +- sizeof (*mdn)) == 0 ++ if (data->dnode_buf != NULL && grub_memcmp (data->dnode_mdn, mdn, ++ sizeof (*mdn)) == 0 + && objnum >= data->dnode_start && objnum < data->dnode_end) + { + grub_memmove (&(buf->dn), &(data->dnode_buf)[idx], DNODE_SIZE); + buf->endian = data->dnode_endian; +- if (type && buf->dn.dn_type != type) +- return grub_error(GRUB_ERR_BAD_FS, "incorrect dnode type"); ++ if (type && buf->dn.dn_type != type) ++ return grub_error(GRUB_ERR_BAD_FS, "incorrect dnode type"); + return GRUB_ERR_NONE; + } + +- grub_dprintf ("zfs", "endian = %d, blkid=%llx\n", mdn->endian, ++ grub_dprintf ("zfs", "endian = %d, blkid=%llx\n", mdn->endian, + (unsigned long long) blkid); + err = dmu_read (mdn, blkid, &dnbuf, &endian, data); + if (err) +@@ -2737,8 +2737,8 @@ dnode_get (dnode_end_t * mdn, grub_uint64_t objnum, grub_uint8_t type, + + grub_memmove (&(buf->dn), (dnode_phys_t *) dnbuf + idx, DNODE_SIZE); + buf->endian = endian; +- if (type && buf->dn.dn_type != type) +- return grub_error(GRUB_ERR_BAD_FS, "incorrect dnode type"); ++ if (type && buf->dn.dn_type != type) ++ return grub_error(GRUB_ERR_BAD_FS, "incorrect dnode type"); + + return GRUB_ERR_NONE; + } +@@ -2762,7 +2762,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + struct dnode_chain + { + struct dnode_chain *next; +- dnode_end_t dn; ++ dnode_end_t dn; + }; + struct dnode_chain *dnode_path = 0, *dn_new, *root; + +@@ -2772,7 +2772,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + dn_new->next = 0; + dnode_path = root = dn_new; + +- err = dnode_get (&subvol->mdn, MASTER_NODE_OBJ, DMU_OT_MASTER_NODE, ++ err = dnode_get (&subvol->mdn, MASTER_NODE_OBJ, DMU_OT_MASTER_NODE, + &(dnode_path->dn), data); + if (err) + { +@@ -2823,7 +2823,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + grub_free (dn_new); + return grub_errno; + } +- ++ + while (1) + { + /* skip leading slashes */ +@@ -2849,7 +2849,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + } + else + { +- err = grub_error (GRUB_ERR_FILE_NOT_FOUND, ++ err = grub_error (GRUB_ERR_FILE_NOT_FOUND, + "can't resolve .."); + break; + } +@@ -2900,7 +2900,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + { + grub_size_t block; + grub_size_t blksz; +- blksz = (grub_zfs_to_cpu16 (dnode_path->dn.dn.dn_datablkszsec, ++ blksz = (grub_zfs_to_cpu16 (dnode_path->dn.dn.dn_datablkszsec, + dnode_path->dn.endian) + << SPA_MINBLOCKSHIFT); + +@@ -2939,7 +2939,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + if (err) + break; + free_symval = 1; +- } ++ } + if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || + grub_add (sz, 1, &sz)) + { +@@ -2963,9 +2963,9 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + if (free_symval) + grub_free (sym_value); + path [sym_sz] = 0; +- grub_memcpy (path + grub_strlen (path), oldpath, ++ grub_memcpy (path + grub_strlen (path), oldpath, + grub_strlen (oldpath) + 1); +- ++ + grub_free (oldpathbuf); + if (path[0] != '/') + { +@@ -2993,7 +2993,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + else if (dnode_path->dn.dn.dn_flags & DNODE_FLAG_SPILL_BLKPTR) + { + blkptr_t *bp = &dnode_path->dn.dn.dn_spill; +- ++ + err = zio_read (bp, dnode_path->dn.endian, &sahdrp, NULL, data); + if (err) + break; +@@ -3012,7 +3012,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + dnode_path->dn.endian) >> 12) & 0xf) == 0xa) + { + char *sym_value = (char *) sahdrp + hdrsize + SA_SYMLINK_OFFSET; +- grub_size_t sym_sz = ++ grub_size_t sym_sz = + grub_zfs_to_cpu64 (grub_get_unaligned64 ((char *) sahdrp + + hdrsize + + SA_SIZE_OFFSET), +@@ -3035,9 +3035,9 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + } + grub_memcpy (path, sym_value, sym_sz); + path [sym_sz] = 0; +- grub_memcpy (path + grub_strlen (path), oldpath, ++ grub_memcpy (path + grub_strlen (path), oldpath, + grub_strlen (oldpath) + 1); +- ++ + grub_free (oldpathbuf); + if (path[0] != '/') + { +@@ -3138,7 +3138,7 @@ get_filesystem_dnode (dnode_end_t * mosmdn, char *fsname, + + grub_dprintf ("zfs", "endian = %d\n", mosmdn->endian); + +- err = dnode_get (mosmdn, DMU_POOL_DIRECTORY_OBJECT, ++ err = dnode_get (mosmdn, DMU_POOL_DIRECTORY_OBJECT, + DMU_OT_OBJECT_DIRECTORY, mdn, data); + if (err) + return err; +@@ -3161,7 +3161,7 @@ get_filesystem_dnode (dnode_end_t * mosmdn, char *fsname, + { + grub_uint64_t childobj; + char *cname, ch; +- ++ + while (*fsname == '/') + fsname++; + +@@ -3323,7 +3323,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + filename = ptr_slash; + else + filename = "/"; +- grub_dprintf ("zfs", "fsname = '%s' snapname='%s' filename = '%s'\n", ++ grub_dprintf ("zfs", "fsname = '%s' snapname='%s' filename = '%s'\n", + fsname, snapname, filename); + } + grub_dprintf ("zfs", "alive\n"); +@@ -3409,7 +3409,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + + snapobj = grub_zfs_to_cpu64 (((dsl_dataset_phys_t *) DN_BONUS (&subvol->mdn.dn))->ds_snapnames_zapobj, subvol->mdn.endian); + +- err = dnode_get (&(data->mos), snapobj, ++ err = dnode_get (&(data->mos), snapobj, + DMU_OT_DSL_DS_SNAP_MAP, &subvol->mdn, data); + if (!err) + err = zap_lookup (&subvol->mdn, snapname, &headobj, data, 0); +@@ -3427,13 +3427,13 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + subvol->obj = headobj; + + make_mdn (&subvol->mdn, data); +- ++ + grub_dprintf ("zfs", "endian = %d\n", subvol->mdn.endian); + + if (*isfs) + { + grub_free (fsname); +- grub_free (snapname); ++ grub_free (snapname); + return GRUB_ERR_NONE; + } + err = dnode_get_path (subvol, filename, dn, data); +@@ -3453,9 +3453,9 @@ nvlist_find_value (const char *nvlist_in, const char *name, + char *nvp_name; + + /* Verify if the 1st and 2nd byte in the nvlist are valid. */ +- /* NOTE: independently of what endianness header announces all ++ /* NOTE: independently of what endianness header announces all + subsequent values are big-endian. */ +- if (nvlist[0] != NV_ENCODE_XDR || (nvlist[1] != NV_LITTLE_ENDIAN ++ if (nvlist[0] != NV_ENCODE_XDR || (nvlist[1] != NV_LITTLE_ENDIAN + && nvlist[1] != NV_BIG_ENDIAN)) + { + grub_dprintf ("zfs", "incorrect nvlist header\n"); +@@ -3576,13 +3576,13 @@ get_nvlist_size (const char *beg, const char *limit) + { + const char *ptr; + grub_uint32_t encode_size; +- ++ + ptr = beg + 8; + + while (ptr < limit + && (encode_size = grub_be_to_cpu32 (grub_get_unaligned32 (ptr)))) + ptr += encode_size; /* goto the next nvpair */ +- ptr += 8; ++ ptr += 8; + return (ptr > limit) ? -1 : (ptr - beg); + } + +@@ -3729,8 +3729,8 @@ zfs_mount (grub_device_t dev) + } + + ub = &(data->current_uberblock); +- ub_endian = (grub_zfs_to_cpu64 (ub->ub_magic, +- GRUB_ZFS_LITTLE_ENDIAN) == UBERBLOCK_MAGIC ++ ub_endian = (grub_zfs_to_cpu64 (ub->ub_magic, ++ GRUB_ZFS_LITTLE_ENDIAN) == UBERBLOCK_MAGIC + ? GRUB_ZFS_LITTLE_ENDIAN : GRUB_ZFS_BIG_ENDIAN); + + err = zio_read (&ub->ub_rootbp, ub_endian, +@@ -3783,7 +3783,7 @@ grub_zfs_fetch_nvlist (grub_device_t dev, char **nvlist) + return err; + } + +-static grub_err_t ++static grub_err_t + zfs_label (grub_device_t device, char **label) + { + char *nvlist; +@@ -3795,7 +3795,7 @@ zfs_label (grub_device_t device, char **label) + return grub_errno; + + err = zfs_fetch_nvlist (data->device_original, &nvlist); +- if (err) ++ if (err) + { + zfs_unmount (data); + return err; +@@ -3807,7 +3807,7 @@ zfs_label (grub_device_t device, char **label) + return grub_errno; + } + +-static grub_err_t ++static grub_err_t + zfs_uuid (grub_device_t device, char **uuid) + { + struct grub_zfs_data *data; +@@ -3825,7 +3825,7 @@ zfs_uuid (grub_device_t device, char **uuid) + return GRUB_ERR_NONE; + } + +-static grub_err_t ++static grub_err_t + zfs_mtime (grub_device_t device, grub_int32_t *mt) + { + struct grub_zfs_data *data; +@@ -3839,8 +3839,8 @@ zfs_mtime (grub_device_t device, grub_int32_t *mt) + return grub_errno; + + ub = &(data->current_uberblock); +- ub_endian = (grub_zfs_to_cpu64 (ub->ub_magic, +- GRUB_ZFS_LITTLE_ENDIAN) == UBERBLOCK_MAGIC ++ ub_endian = (grub_zfs_to_cpu64 (ub->ub_magic, ++ GRUB_ZFS_LITTLE_ENDIAN) == UBERBLOCK_MAGIC + ? GRUB_ZFS_LITTLE_ENDIAN : GRUB_ZFS_BIG_ENDIAN); + + *mt = grub_zfs_to_cpu64 (ub->ub_timestamp, ub_endian); +@@ -3878,7 +3878,7 @@ grub_zfs_open (struct grub_file *file, const char *fsfilename) + } + + /* We found the dnode for this file. Verify if it is a plain file. */ +- if (data->dnode.dn.dn_type != DMU_OT_PLAIN_FILE_CONTENTS) ++ if (data->dnode.dn.dn_type != DMU_OT_PLAIN_FILE_CONTENTS) + { + zfs_unmount (data); + return grub_error (GRUB_ERR_BAD_FILE_TYPE, N_("not a regular file")); +@@ -3953,7 +3953,7 @@ grub_zfs_read (grub_file_t file, char *buf, grub_size_t len) + return len; + } + +- blksz = grub_zfs_to_cpu16 (data->dnode.dn.dn_datablkszsec, ++ blksz = grub_zfs_to_cpu16 (data->dnode.dn.dn_datablkszsec, + data->dnode.endian) << SPA_MINBLOCKSHIFT; + + if (blksz == 0) +@@ -4046,11 +4046,11 @@ fill_fs_info (struct grub_dirhook_info *info, + dnode_end_t dn; + grub_uint64_t objnum; + grub_uint64_t headobj; +- ++ + grub_memset (info, 0, sizeof (*info)); +- ++ + info->dir = 1; +- ++ + if (mdn.dn.dn_type == DMU_OT_DSL_DIR) + { + headobj = grub_zfs_to_cpu64 (((dsl_dir_phys_t *) DN_BONUS (&mdn.dn))->dd_head_dataset_obj, mdn.endian); +@@ -4065,28 +4065,28 @@ fill_fs_info (struct grub_dirhook_info *info, + err = make_mdn (&mdn, data); + if (err) + return err; +- err = dnode_get (&mdn, MASTER_NODE_OBJ, DMU_OT_MASTER_NODE, ++ err = dnode_get (&mdn, MASTER_NODE_OBJ, DMU_OT_MASTER_NODE, + &dn, data); + if (err) + { + grub_dprintf ("zfs", "failed here\n"); + return err; + } +- ++ + err = zap_lookup (&dn, ZFS_ROOT_OBJ, &objnum, data, 0); + if (err) + { + grub_dprintf ("zfs", "failed here\n"); + return err; + } +- ++ + err = dnode_get (&mdn, objnum, 0, &dn, data); + if (err) + { + grub_dprintf ("zfs", "failed here\n"); + return err; + } +- ++ + if (dn.dn.dn_bonustype == DMU_OT_SA) + { + void *sahdrp; +@@ -4172,15 +4172,15 @@ iterate_zap (const char *name, grub_uint64_t val, struct grub_zfs_dir_ctx *ctx) + info.mtime = grub_zfs_to_cpu64 (grub_get_unaligned64 ((char *) sahdrp + hdrsize + SA_MTIME_OFFSET), dn.endian); + info.case_insensitive = ctx->data->subvol.case_insensitive; + } +- ++ + if (dn.dn.dn_bonustype == DMU_OT_ZNODE) +- { ++ { + info.mtimeset = 1; + info.mtime = grub_zfs_to_cpu64 (((znode_phys_t *) DN_BONUS (&dn.dn))->zp_mtime[0], + dn.endian); + } + info.dir = (dn.dn.dn_type == DMU_OT_DIRECTORY_CONTENTS); +- grub_dprintf ("zfs", "type=%d, name=%s\n", ++ grub_dprintf ("zfs", "type=%d, name=%s\n", + (int)dn.dn.dn_type, (char *)name); + return ctx->hook (name, &info, ctx->hook_data); + } +@@ -4281,7 +4281,7 @@ grub_zfs_dir (grub_device_t device, const char *path, + + if (isfs) + { +- grub_uint64_t childobj, headobj; ++ grub_uint64_t childobj, headobj; + grub_uint64_t snapobj; + dnode_end_t dn; + struct grub_dirhook_info info; +@@ -4309,7 +4309,7 @@ grub_zfs_dir (grub_device_t device, const char *path, + } + + zap_iterate_u64 (&dn, iterate_zap_fs, data, &ctx); +- ++ + err = dnode_get (&(data->mos), headobj, DMU_OT_DSL_DATASET, &dn, data); + if (err) + { +@@ -4351,8 +4351,8 @@ check_feature (const char *name, grub_uint64_t val, + return 0; + if (name[0] == 0) + return 0; +- for (i = 0; spa_feature_names[i] != NULL; i++) +- if (grub_strcmp (name, spa_feature_names[i]) == 0) ++ for (i = 0; spa_feature_names[i] != NULL; i++) ++ if (grub_strcmp (name, spa_feature_names[i]) == 0) + return 0; + return 1; + } +@@ -4365,7 +4365,7 @@ check_feature (const char *name, grub_uint64_t val, + * 0: Success. + * errnum: Failure. + */ +- ++ + static grub_err_t + check_mos_features(dnode_phys_t *mosmdn_phys,grub_zfs_endian_t endian,struct grub_zfs_data* data ) + { +@@ -4390,7 +4390,7 @@ check_mos_features(dnode_phys_t *mosmdn_phys,grub_zfs_endian_t endian,struct gru + errnum = zap_lookup(&dn, DMU_POOL_FEATURES_FOR_READ, &objnum, data,0); + if (errnum != 0) + return errnum; +- ++ + errnum = dnode_get(&mosmdn, objnum, DMU_OTN_ZAP_METADATA, &dn, data); + if (errnum != 0) + return errnum; +diff --git a/grub-core/fs/zfs/zfs_fletcher.c b/grub-core/fs/zfs/zfs_fletcher.c +index 7d27b05..ad3be67 100644 +--- a/grub-core/fs/zfs/zfs_fletcher.c ++++ b/grub-core/fs/zfs/zfs_fletcher.c +@@ -39,14 +39,14 @@ + #include + + void +-fletcher_2(const void *buf, grub_uint64_t size, grub_zfs_endian_t endian, ++fletcher_2(const void *buf, grub_uint64_t size, grub_zfs_endian_t endian, + zio_cksum_t *zcp) + { + const grub_uint64_t *ip = buf; + const grub_uint64_t *ipend = ip + (size / sizeof (grub_uint64_t)); + grub_uint64_t a0, b0, a1, b1; +- +- for (a0 = b0 = a1 = b1 = 0; ip < ipend; ip += 2) ++ ++ for (a0 = b0 = a1 = b1 = 0; ip < ipend; ip += 2) + { + a0 += grub_zfs_to_cpu64 (ip[0], endian); + a1 += grub_zfs_to_cpu64 (ip[1], endian); +@@ -61,14 +61,14 @@ fletcher_2(const void *buf, grub_uint64_t size, grub_zfs_endian_t endian, + } + + void +-fletcher_4 (const void *buf, grub_uint64_t size, grub_zfs_endian_t endian, ++fletcher_4 (const void *buf, grub_uint64_t size, grub_zfs_endian_t endian, + zio_cksum_t *zcp) + { + const grub_uint32_t *ip = buf; + const grub_uint32_t *ipend = ip + (size / sizeof (grub_uint32_t)); + grub_uint64_t a, b, c, d; +- +- for (a = b = c = d = 0; ip < ipend; ip++) ++ ++ for (a = b = c = d = 0; ip < ipend; ip++) + { + a += grub_zfs_to_cpu32 (ip[0], endian);; + b += a; +diff --git a/grub-core/fs/zfs/zfs_sha256.c b/grub-core/fs/zfs/zfs_sha256.c +index a181f07..f042fa6 100644 +--- a/grub-core/fs/zfs/zfs_sha256.c ++++ b/grub-core/fs/zfs/zfs_sha256.c +@@ -116,23 +116,23 @@ zio_checksum_SHA256(const void *buf, grub_uint64_t size, + grub_uint8_t pad[128]; + unsigned padsize = size & 63; + unsigned i; +- ++ + for (i = 0; i < size - padsize; i += 64) + SHA256Transform(H, (grub_uint8_t *)buf + i); +- ++ + for (i = 0; i < padsize; i++) + pad[i] = ((grub_uint8_t *)buf)[i]; +- ++ + for (pad[padsize++] = 0x80; (padsize & 63) != 56; padsize++) + pad[padsize] = 0; +- ++ + for (i = 0; i < 8; i++) + pad[padsize++] = (size << 3) >> (56 - 8 * i); +- ++ + for (i = 0; i < padsize && i <= 64; i += 64) + SHA256Transform(H, pad + i); +- +- zcp->zc_word[0] = grub_cpu_to_zfs64 ((grub_uint64_t)H[0] << 32 | H[1], ++ ++ zcp->zc_word[0] = grub_cpu_to_zfs64 ((grub_uint64_t)H[0] << 32 | H[1], + endian); + zcp->zc_word[1] = grub_cpu_to_zfs64 ((grub_uint64_t)H[2] << 32 | H[3], + endian); +diff --git a/grub-core/fs/zfs/zfscrypt.c b/grub-core/fs/zfs/zfscrypt.c +index de3b015..da30e9a 100644 +--- a/grub-core/fs/zfs/zfscrypt.c ++++ b/grub-core/fs/zfs/zfscrypt.c +@@ -46,7 +46,7 @@ + GRUB_MOD_LICENSE ("GPLv3+"); + + /* +- Mostly based on following article: ++ Mostly based on following article: + https://blogs.oracle.com/darren/entry/zfs_encryption_what_is_on + */ + +@@ -179,7 +179,7 @@ grub_gcm_mul (grub_uint8_t *a, const grub_uint8_t *b) + grub_crypto_xor (res, res, bs, 16); + grub_gcm_mul_x (bs); + } +- ++ + grub_memcpy (a, res, 16); + } + +@@ -275,7 +275,7 @@ algo_decrypt (grub_crypto_cipher_handle_t cipher, grub_uint64_t algo, + } + + static grub_err_t +-grub_zfs_decrypt_real (grub_crypto_cipher_handle_t cipher, ++grub_zfs_decrypt_real (grub_crypto_cipher_handle_t cipher, + grub_uint64_t algo, + void *nonce, + char *buf, grub_size_t size, +@@ -286,7 +286,7 @@ grub_zfs_decrypt_real (grub_crypto_cipher_handle_t cipher, + unsigned i; + grub_uint32_t sw[4]; + gcry_err_code_t err; +- ++ + grub_memcpy (sw, nonce, 16); + if (endian != GRUB_ZFS_BIG_ENDIAN) + for (i = 0; i < 4; i++) +@@ -302,7 +302,7 @@ grub_zfs_decrypt_real (grub_crypto_cipher_handle_t cipher, + sw + 1, 3, 12); + if (err) + return grub_crypto_gcry_error (err); +- ++ + for (i = 0; i < 3; i++) + if (grub_zfs_to_cpu32 (expected_mac[i], endian) + != grub_be_to_cpu32 (mac[i])) +@@ -362,7 +362,7 @@ grub_zfs_load_key_real (const struct grub_zfs_key *key, + grub_crypto_cipher_close (cipher); + continue; + } +- ++ + err = grub_crypto_cipher_set_key (cipher, wrap_key_real, + keylen); + if (err) +@@ -371,7 +371,7 @@ grub_zfs_load_key_real (const struct grub_zfs_key *key, + grub_crypto_cipher_close (cipher); + continue; + } +- ++ + err = algo_decrypt (cipher, algo, decrypted, key->unknown_purpose_key, 32, + mac, key->unknown_purpose_nonce, 2, 16); + if (err || (grub_crypto_memcmp (mac, key->unknown_purpose_key + 32, 16) +-- +2.43.5 + diff --git a/SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch b/SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch new file mode 100644 index 0000000..dc718c7 --- /dev/null +++ b/SOURCES/0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch @@ -0,0 +1,50 @@ +From a6405bff7be8359a790f536a3fe2b84b96cfeccd Mon Sep 17 00:00:00 2001 +From: "t.feng" +Date: Tue, 29 Nov 2022 17:14:15 +0800 +Subject: [PATCH 671/676] fs/xfs: Fix memory leaks in XFS module + +Signed-off-by: t.feng +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 4caf29f..171417d 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -598,7 +598,10 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + if (grub_disk_read (node->data->disk, + GRUB_XFS_FSB_TO_BLOCK (node->data, get_fsb (keys, i - 1 + recoffset)) << (node->data->sblock.log2_bsize - GRUB_DISK_SECTOR_BITS), + 0, node->data->bsize, leaf)) +- return 0; ++ { ++ grub_free (leaf); ++ return 0; ++ } + + if ((!node->data->hascrc && + grub_strncmp ((char *) leaf->magic, "BMAP", 4)) || +@@ -789,6 +792,7 @@ static int iterate_dir_call_hook (grub_uint64_t ino, const char *filename, + if (err) + { + grub_print_error (); ++ grub_free (fdiro); + return 0; + } + +@@ -906,7 +910,10 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + blk << dirblk_log2, + dirblk_size, dirblock, 0); + if (numread != dirblk_size) +- return 0; ++ { ++ grub_free (dirblock); ++ return 0; ++ } + + entries = (grub_be_to_cpu32 (tail->leaf_count) + - grub_be_to_cpu32 (tail->leaf_stale)); +-- +2.43.5 + diff --git a/SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch b/SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch new file mode 100644 index 0000000..56f1a0e --- /dev/null +++ b/SOURCES/0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch @@ -0,0 +1,51 @@ +From df644ea62c0c0c029ee05d298dc1c61b967bc9c9 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 28 Sep 2023 22:33:44 +0000 +Subject: [PATCH 672/676] fs/xfs: Incorrect short form directory data boundary + check + +After parsing of the current entry, the entry pointer is advanced +to the next entry at the end of the "for" loop. In case where the +last entry is at the end of the data boundary, the advanced entry +pointer can point off the data boundary. The subsequent boundary +check for the advanced entry pointer can cause a failure. + +The fix is to include the boundary check into the "for" loop +condition. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Tested-by: Sebastian Andrzej Siewior +Tested-by: Marta Lewandowska +--- + grub-core/fs/xfs.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 171417d..a79d805 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -835,7 +835,8 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + if (iterate_dir_call_hook (parent, "..", &ctx)) + return 1; + +- for (i = 0; i < head->count; i++) ++ for (i = 0; i < head->count && ++ (grub_uint8_t *) de < ((grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data)); i++) + { + grub_uint64_t ino; + grub_uint8_t *inopos = grub_xfs_inline_de_inopos(dir->data, de); +@@ -870,10 +871,6 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + de->name[de->len] = c; + + de = grub_xfs_inline_next_de(dir->data, head, de); +- +- if ((grub_uint8_t *) de >= (grub_uint8_t *) dir + grub_xfs_fshelp_size (dir->data)) +- return grub_error (GRUB_ERR_BAD_FS, "invalid XFS directory entry"); +- + } + break; + } +-- +2.43.5 + diff --git a/SOURCES/0673-fs-xfs-Fix-XFS-directory-extent-parsing.patch b/SOURCES/0673-fs-xfs-Fix-XFS-directory-extent-parsing.patch new file mode 100644 index 0000000..793d6f9 --- /dev/null +++ b/SOURCES/0673-fs-xfs-Fix-XFS-directory-extent-parsing.patch @@ -0,0 +1,171 @@ +From e6845e0ad12d7f0a584e2a34da47a9d836efb0ad Mon Sep 17 00:00:00 2001 +From: Jon DeVree +Date: Tue, 17 Oct 2023 23:03:47 -0400 +Subject: [PATCH 673/676] fs/xfs: Fix XFS directory extent parsing + +The XFS directory entry parsing code has never been completely correct +for extent based directories. The parser correctly handles the case +where the directory is contained in a single extent, but then mistakenly +assumes the data blocks for the multiple extent case are each identical +to the single extent case. The difference in the format of the data +blocks between the two cases is tiny enough that its gone unnoticed for +a very long time. + +A recent change introduced some additional bounds checking into the XFS +parser. Like GRUB's existing parser, it is correct for the single extent +case but incorrect for the multiple extent case. When parsing a directory +with multiple extents, this new bounds checking is sometimes (but not +always) tripped and triggers an "invalid XFS directory entry" error. This +probably would have continued to go unnoticed but the /boot/grub/ +directory is large enough that it often has multiple extents. + +The difference between the two cases is that when there are multiple +extents, the data blocks do not contain a trailer nor do they contain +any leaf information. That information is stored in a separate set of +extents dedicated to just the leaf information. These extents come after +the directory entry extents and are not included in the inode size. So +the existing parser already ignores the leaf extents. + +The only reason to read the trailer/leaf information at all is so that +the parser can avoid misinterpreting that data as directory entries. So +this updates the parser as follows: + +For the single extent case the parser doesn't change much: +1. Read the size of the leaf information from the trailer +2. Set the end pointer for the parser to the start of the leaf + information. (The previous bounds checking set the end pointer to the + start of the trailer, so this is actually a small improvement.) +3. Set the entries variable to the expected number of directory entries. + +For the multiple extent case: +1. Set the end pointer to the end of the block. +2. Do not set up the entries variable. Figuring out how many entries are + in each individual block is complex and does not seem worth it when + it appears to be safe to just iterate over the entire block. + +The bounds check itself was also dependent upon the faulty XFS parser +because it accidentally used "filename + length - 1". Presumably this +was able to pass the fuzzer because in the old parser there was always +8 bytes of slack space between the tail pointer and the actual end of +the block. Since this is no longer the case the bounds check needs to be +updated to "filename + length + 1" in order to prevent a regression in +the handling of corrupt fliesystems. + +Notes: +* When there is only one extent there will only ever be one block. If + more than one block is required then XFS will always switch to holding + leaf information in a separate extent. +* B-tree based directories seems to be parsed properly by the same code + that handles multiple extents. This is unlikely to ever occur within + /boot though because its only used when there are an extremely large + number of directory entries. + +Fixes: ef7850c75 (fs/xfs: Fix issues found while fuzzing the XFS filesystem) +Fixes: b2499b29c (Adds support for the XFS filesystem.) +Fixes: https://savannah.gnu.org/bugs/?64376 + +Signed-off-by: Jon DeVree +Reviewed-by: Daniel Kiper +Tested-by: Sebastian Andrzej Siewior +Tested-by: Marta Lewandowska +--- + grub-core/fs/xfs.c | 52 +++++++++++++++++++++++++++++++++------------- + 1 file changed, 38 insertions(+), 14 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index a79d805..5beda40 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -223,6 +223,12 @@ struct grub_xfs_inode + /* Size of struct grub_xfs_inode v2, up to unused4 member included. */ + #define XFS_V2_INODE_SIZE (XFS_V3_INODE_SIZE - 76) + ++struct grub_xfs_dir_leaf_entry ++{ ++ grub_uint32_t hashval; ++ grub_uint32_t address; ++} GRUB_PACKED; ++ + struct grub_xfs_dirblock_tail + { + grub_uint32_t leaf_count; +@@ -899,9 +905,8 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + { + struct grub_xfs_dir2_entry *direntry = + grub_xfs_first_de(dir->data, dirblock); +- int entries; +- struct grub_xfs_dirblock_tail *tail = +- grub_xfs_dir_tail(dir->data, dirblock); ++ int entries = -1; ++ char *end = dirblock + dirblk_size; + + numread = grub_xfs_read_file (dir, 0, 0, + blk << dirblk_log2, +@@ -912,14 +917,27 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + return 0; + } + +- entries = (grub_be_to_cpu32 (tail->leaf_count) +- - grub_be_to_cpu32 (tail->leaf_stale)); ++ /* ++ * Leaf and tail information are only in the data block if the number ++ * of extents is 1. ++ */ ++ if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ { ++ struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); ++ ++ end = (char *) tail; ++ ++ /* Subtract the space used by leaf nodes. */ ++ end -= grub_be_to_cpu32 (tail->leaf_count) * sizeof (struct grub_xfs_dir_leaf_entry); + +- if (!entries) +- continue; ++ entries = grub_be_to_cpu32 (tail->leaf_count) - grub_be_to_cpu32 (tail->leaf_stale); ++ ++ if (!entries) ++ continue; ++ } + + /* Iterate over all entries within this block. */ +- while ((char *)direntry < (char *)tail) ++ while ((char *) direntry < (char *) end) + { + grub_uint8_t *freetag; + char *filename; +@@ -939,7 +957,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + } + + filename = (char *)(direntry + 1); +- if (filename + direntry->len - 1 > (char *) tail) ++ if (filename + direntry->len + 1 > (char *) end) + return grub_error (GRUB_ERR_BAD_FS, "invalid XFS directory entry"); + + /* The byte after the filename is for the filetype, padding, or +@@ -953,11 +971,17 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + return 1; + } + +- /* Check if last direntry in this block is +- reached. */ +- entries--; +- if (!entries) +- break; ++ /* ++ * The expected number of directory entries is only tracked for the ++ * single extent case. ++ */ ++ if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ { ++ /* Check if last direntry in this block is reached. */ ++ entries--; ++ if (!entries) ++ break; ++ } + + /* Select the next directory entry. */ + direntry = grub_xfs_next_de(dir->data, direntry); +-- +2.43.5 + diff --git a/SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch b/SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch new file mode 100644 index 0000000..9f9bfda --- /dev/null +++ b/SOURCES/0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch @@ -0,0 +1,119 @@ +From 8aa1ebc1a094c7ae8eb6d2b11412bff99eda66b0 Mon Sep 17 00:00:00 2001 +From: Anthony Iliopoulos +Date: Thu, 26 Oct 2023 11:53:39 +0200 +Subject: [PATCH 674/676] fs/xfs: Add large extent counters incompat feature + support + +XFS introduced 64-bit extent counters for inodes via a series of +upstream commits and the feature was marked as stable in v6.5 via +commit 61d7e8274cd8 (xfs: drop EXPERIMENTAL tag for large extent +counts). + +Further, xfsprogs release v6.5.0 switched this feature on by default +in mkfs.xfs via commit e5b18d7d1d96 (mkfs: enable large extent counts +by default). + +Filesystems formatted with large extent count support, nrext64=1, are +thus currently not recognizable by GRUB, since this is an incompat +feature. Add the required support so that those filesystems and inodes +with large extent counters can be read by GRUB. + +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Andrey Albershteyn +Reviewed-by: Daniel Kiper +Tested-by: Marta Lewandowska +Tested-by: Sebastian Andrzej Siewior +--- + grub-core/fs/xfs.c | 30 +++++++++++++++++++++++++----- + 1 file changed, 25 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 5beda40..f74b316 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -79,6 +79,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); + /* Inode flags2 flags */ + #define XFS_DIFLAG2_BIGTIME_BIT 3 + #define XFS_DIFLAG2_BIGTIME (1 << XFS_DIFLAG2_BIGTIME_BIT) ++#define XFS_DIFLAG2_NREXT64_BIT 4 ++#define XFS_DIFLAG2_NREXT64 (1 << XFS_DIFLAG2_NREXT64_BIT) + + /* incompat feature flags */ + #define XFS_SB_FEAT_INCOMPAT_FTYPE (1 << 0) /* filetype in dirent */ +@@ -86,6 +88,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + #define XFS_SB_FEAT_INCOMPAT_META_UUID (1 << 2) /* metadata UUID */ + #define XFS_SB_FEAT_INCOMPAT_BIGTIME (1 << 3) /* large timestamps */ + #define XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR (1 << 4) /* needs xfs_repair */ ++#define XFS_SB_FEAT_INCOMPAT_NREXT64 (1 << 5) /* large extent counters */ + + /* + * Directory entries with ftype are explicitly handled by GRUB code. +@@ -101,7 +104,8 @@ GRUB_MOD_LICENSE ("GPLv3+"); + XFS_SB_FEAT_INCOMPAT_SPINODES | \ + XFS_SB_FEAT_INCOMPAT_META_UUID | \ + XFS_SB_FEAT_INCOMPAT_BIGTIME | \ +- XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR) ++ XFS_SB_FEAT_INCOMPAT_NEEDSREPAIR | \ ++ XFS_SB_FEAT_INCOMPAT_NREXT64) + + struct grub_xfs_sblock + { +@@ -203,7 +207,8 @@ struct grub_xfs_inode + grub_uint16_t mode; + grub_uint8_t version; + grub_uint8_t format; +- grub_uint8_t unused2[26]; ++ grub_uint8_t unused2[18]; ++ grub_uint64_t nextents_big; + grub_uint64_t atime; + grub_uint64_t mtime; + grub_uint64_t ctime; +@@ -547,11 +552,26 @@ get_fsb (const void *keys, int idx) + return grub_be_to_cpu64 (grub_get_unaligned64 (p)); + } + ++static int ++grub_xfs_inode_has_large_extent_counts (const struct grub_xfs_inode *inode) ++{ ++ return inode->version >= 3 && ++ (inode->flags2 & grub_cpu_to_be64_compile_time (XFS_DIFLAG2_NREXT64)); ++} ++ ++static grub_uint64_t ++grub_xfs_get_inode_nextents (struct grub_xfs_inode *inode) ++{ ++ return (grub_xfs_inode_has_large_extent_counts (inode)) ? ++ grub_be_to_cpu64 (inode->nextents_big) : ++ grub_be_to_cpu32 (inode->nextents); ++} ++ + static grub_disk_addr_t + grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + { + struct grub_xfs_btree_node *leaf = 0; +- int ex, nrec; ++ grub_uint64_t ex, nrec; + struct grub_xfs_extent *exts; + grub_uint64_t ret = 0; + +@@ -576,7 +596,7 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + / (2 * sizeof (grub_uint64_t)); + do + { +- int i; ++ grub_uint64_t i; + grub_addr_t keys_end, data_end; + if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || + grub_add ((grub_addr_t) keys, keys_end, &keys_end) || +@@ -633,7 +653,7 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + grub_addr_t exts_end = 0; + grub_addr_t data_end = 0; + +- nrec = grub_be_to_cpu32 (node->inode.nextents); ++ nrec = grub_xfs_get_inode_nextents (&node->inode); + exts = (struct grub_xfs_extent *) grub_xfs_inode_data(&node->inode); + + if (grub_mul (sizeof (struct grub_xfs_extent), nrec, &exts_end) || +-- +2.43.5 + diff --git a/SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch b/SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch new file mode 100644 index 0000000..2938e8d --- /dev/null +++ b/SOURCES/0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch @@ -0,0 +1,57 @@ +From 4011de1eec2ccd61246cffe7bb96822ed97942eb Mon Sep 17 00:00:00 2001 +From: Jon DeVree +Date: Sun, 11 Feb 2024 10:34:58 -0500 +Subject: [PATCH 675/676] fs/xfs: Handle non-continuous data blocks in + directory extents + +The directory extent list does not have to be a continuous list of data +blocks. When GRUB tries to read a non-existant member of the list, +grub_xfs_read_file() will return a block of zero'ed memory. Checking for +a zero'ed magic number is sufficient to skip this non-existant data block. + +Prior to commit 07318ee7e (fs/xfs: Fix XFS directory extent parsing) +this was handled as a subtle side effect of reading the (non-existant) +tail data structure. Since the block was zero'ed the computation of the +number of directory entries in the block would return 0 as well. + +Fixes: 07318ee7e (fs/xfs: Fix XFS directory extent parsing) +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2254370 + +Signed-off-by: Jon DeVree +Reviewed-By: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index f74b316..a5ab311 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -927,6 +927,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + grub_xfs_first_de(dir->data, dirblock); + int entries = -1; + char *end = dirblock + dirblk_size; ++ grub_uint32_t magic; + + numread = grub_xfs_read_file (dir, 0, 0, + blk << dirblk_log2, +@@ -937,6 +938,15 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + return 0; + } + ++ /* ++ * If this data block isn't actually part of the extent list then ++ * grub_xfs_read_file() returns a block of zeros. So, if the magic ++ * number field is all zeros then this block should be skipped. ++ */ ++ magic = *(grub_uint32_t *)(void *) dirblock; ++ if (!magic) ++ continue; ++ + /* + * Leaf and tail information are only in the data block if the number + * of extents is 1. +-- +2.43.5 + diff --git a/SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch b/SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch new file mode 100644 index 0000000..daea017 --- /dev/null +++ b/SOURCES/0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch @@ -0,0 +1,48 @@ +From dd6867d45ecc3ca9bb5026ee5197a9d88f5d2888 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Wed, 4 Dec 2024 07:50:28 -0600 +Subject: [PATCH 676/676] fs/xfs: fix large extent counters incompat feature + support + +When large extent counter / NREXT64 support was added to grub, it missed +a couple of direct reads of nextents which need to be changed to the new +NREXT64-aware helper as well. Without this, we'll have mis-reads of some +directories with this feature enabled. + +(The large extent counter fix likely raced on merge with +07318ee7e ("fs/xfs: Fix XFS directory extent parsing") which added the new +direct nextents reads just prior, causing this issue.) + +Fixes: aa7c1322671e ("fs/xfs: Add large extent counters incompat feature support") +Signed-off-by: Eric Sandeen +Reviewed-by: Anthony Iliopoulos +Reviewed-by: Jon DeVree +--- + grub-core/fs/xfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index a5ab311..148a0e5 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -951,7 +951,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + * Leaf and tail information are only in the data block if the number + * of extents is 1. + */ +- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) + { + struct grub_xfs_dirblock_tail *tail = grub_xfs_dir_tail (dir->data, dirblock); + +@@ -1005,7 +1005,7 @@ grub_xfs_iterate_dir (grub_fshelp_node_t dir, + * The expected number of directory entries is only tracked for the + * single extent case. + */ +- if (dir->inode.nextents == grub_cpu_to_be32_compile_time (1)) ++ if (grub_xfs_get_inode_nextents(&dir->inode) == 1) + { + /* Check if last direntry in this block is reached. */ + entries--; +-- +2.43.5 + diff --git a/SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch b/SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch new file mode 100644 index 0000000..162ee8f --- /dev/null +++ b/SOURCES/0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 21 Feb 2025 09:06:12 +0800 +Subject: [PATCH] fs/ext2: Rework out-of-bounds read for inline and external + extents + +Previously, the number of extent entries was not properly capped based +on the actual available space. This could lead to insufficient reads for +external extents since the computation was based solely on the inline +extent layout. + +In this patch, when processing the extent header we determine whether +the header is stored inline, i.e. at inode->blocks.dir_blocks, or in an +external extent block. We then clamp the number of entries accordingly +(using max_inline_ext for inline extents and max_external_ext for +external extent blocks). + +This change ensures that only the valid number of extent entries is +processed preventing out-of-bound reads and potential filesystem +corruption. + +Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents) + +Signed-off-by: Michael Chang +Tested-by: Christian Hesse +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index dc62a6c..b144549 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -474,7 +474,10 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + int i; + grub_disk_addr_t ret; + grub_uint16_t nent; ++ /* Maximum number of extent entries in the inode's inline extent area. */ + const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ ++ /* Maximum number of extent entries in the external extent block. */ ++ const grub_uint16_t max_external_ext = EXT2_BLOCK_SIZE (data) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + leaf = grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, fileblock); + if (! leaf) +@@ -487,8 +490,18 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + + nent = grub_le_to_cpu16 (leaf->entries); + +- if (leaf->depth == 0) ++ /* ++ * Determine the effective number of extent entries (nent) to process. ++ * If the extent header (leaf) is stored inline in the inode’s block ++ * area, i.e. at inode->blocks.dir_blocks, then only max_inline_ext ++ * entries can fit. Otherwise, if the header was read from an external ++ * extent block use the larger limit, max_external_ext, based on the ++ * full block size. ++ */ ++ if (leaf == (struct grub_ext4_extent_header *) inode->blocks.dir_blocks) + nent = grub_min (nent, max_inline_ext); ++ else ++ nent = grub_min (nent, max_external_ext); + + for (i = 0; i < nent; i++) + { diff --git a/SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch b/SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch new file mode 100644 index 0000000..4273d57 --- /dev/null +++ b/SOURCES/0678-Strip-correctly-BLS-files-with-conf-extension.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 3 Sep 2025 11:51:38 -0600 +Subject: [PATCH] Strip correctly BLS files with conf extension +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Renaud Métrich +Signed-off-by: Leo Sandoval +--- + grub-core/commands/blscfg.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 795a9f9f17..5e2302c4e8 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -417,12 +417,14 @@ static int bls_cmp(const void *p0, const void *p1, void *state) + id1 = grub_strdup(e1->filename); + + l = grub_strlen(id0); +- if (l > 5 && grub_strcmp(id0 + l - 5, ".conf")) +- id0[l-5] = '\0'; ++ if (l > 5) ++ if (!grub_strcmp(id0 + l - 5, ".conf")) ++ id0[l-5] = '\0'; + + l = grub_strlen(id1); +- if (l > 5 && grub_strcmp(id1 + l - 5, ".conf")) +- id1[l-5] = '\0'; ++ if (l > 5) ++ if(!grub_strcmp(id1 + l - 5, ".conf")) ++ id1[l-5] = '\0'; + + r = split_cmp(id0, id1, 1); + diff --git a/SOURCES/0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch b/SOURCES/0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch new file mode 100644 index 0000000..0e783a6 --- /dev/null +++ b/SOURCES/0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch @@ -0,0 +1,399 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Glenn Washburn +Date: Tue, 8 Dec 2020 16:45:32 -0600 +Subject: [PATCH] disk: Rename grub_disk_get_size() to + grub_disk_native_sectors() + +The function grub_disk_get_size() is confusingly named because it actually +returns a sector count where the sectors are sized in the GRUB native sector +size. Rename to something more appropriate. + +Suggested-by: Daniel Kiper +Signed-off-by: Glenn Washburn +Reviewed-by: Patrick Steinhardt +Reviewed-by: Daniel Kiper +--- + grub-core/disk/diskfilter.c | 12 ++++++------ + grub-core/disk/dmraid_nvidia.c | 2 +- + grub-core/disk/efi/efidisk.c | 2 +- + grub-core/disk/geli.c | 6 +++--- + grub-core/disk/ldm.c | 4 ++-- + grub-core/disk/luks.c | 2 +- + grub-core/disk/mdraid1x_linux.c | 2 +- + grub-core/disk/mdraid_linux.c | 2 +- + grub-core/fs/cbfs.c | 16 ++++++++-------- + grub-core/fs/nilfs2.c | 2 +- + grub-core/fs/zfs/zfs.c | 4 ++-- + grub-core/kern/disk.c | 2 +- + grub-core/kern/mips/arc/init.c | 2 +- + grub-core/normal/misc.c | 6 +++--- + grub-core/osdep/windows/platform.c | 2 +- + include/grub/disk.h | 4 ++-- + util/grub-install.c | 2 +- + util/grub-probe.c | 2 +- + 18 files changed, 37 insertions(+), 37 deletions(-) + +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index a881aa2c9c73..1a4c4aba56f0 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -149,7 +149,7 @@ scan_disk_partition_iter (grub_disk_t disk, grub_partition_t p, void *data) + if (m->disk && m->disk->id == disk->id + && m->disk->dev->id == disk->dev->id + && m->part_start == grub_partition_get_start (disk->partition) +- && m->part_size == grub_disk_get_size (disk)) ++ && m->part_size == grub_disk_native_sectors (disk)) + return 0; + } + +@@ -1194,13 +1194,13 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, + + grub_dprintf ("diskfilter", "Inserting %s (+%lld,%lld) into %s (%s)\n", disk->name, + (unsigned long long) grub_partition_get_start (disk->partition), +- (unsigned long long) grub_disk_get_size (disk), ++ (unsigned long long) grub_disk_native_sectors (disk), + array->name, diskfilter->name); + #ifdef GRUB_UTIL + grub_util_info ("Inserting %s (+%" GRUB_HOST_PRIuLONG_LONG ",%" + GRUB_HOST_PRIuLONG_LONG ") into %s (%s)\n", disk->name, + (unsigned long long) grub_partition_get_start (disk->partition), +- (unsigned long long) grub_disk_get_size (disk), ++ (unsigned long long) grub_disk_native_sectors (disk), + array->name, diskfilter->name); + array->driver = diskfilter; + #endif +@@ -1214,7 +1214,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, + struct grub_diskfilter_lv *lv; + /* FIXME: Check whether the update time of the superblocks are + the same. */ +- if (pv->disk && grub_disk_get_size (disk) >= pv->part_size) ++ if (pv->disk && grub_disk_native_sectors (disk) >= pv->part_size) + return GRUB_ERR_NONE; + pv->disk = grub_disk_open (disk->name); + if (!pv->disk) +@@ -1223,7 +1223,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id, + raid device, we shouldn't change it. */ + pv->start_sector -= pv->part_start; + pv->part_start = grub_partition_get_start (disk->partition); +- pv->part_size = grub_disk_get_size (disk); ++ pv->part_size = grub_disk_native_sectors (disk); + + #ifdef GRUB_UTIL + { +@@ -1315,7 +1315,7 @@ grub_diskfilter_get_pv_from_disk (grub_disk_t disk, + if (pv->disk && pv->disk->id == disk->id + && pv->disk->dev->id == disk->dev->id + && pv->part_start == grub_partition_get_start (disk->partition) +- && pv->part_size == grub_disk_get_size (disk)) ++ && pv->part_size == grub_disk_native_sectors (disk)) + { + if (vg_out) + *vg_out = vg; +diff --git a/grub-core/disk/dmraid_nvidia.c b/grub-core/disk/dmraid_nvidia.c +index 06027912453b..4d2fb04d1265 100644 +--- a/grub-core/disk/dmraid_nvidia.c ++++ b/grub-core/disk/dmraid_nvidia.c +@@ -107,7 +107,7 @@ grub_dmraid_nv_detect (grub_disk_t disk, + /* Skip partition. */ + return NULL; + +- sector = grub_disk_get_size (disk); ++ sector = grub_disk_native_sectors (disk); + if (sector == GRUB_DISK_SIZE_UNKNOWN) + /* Not raid. */ + return NULL; +diff --git a/grub-core/disk/efi/efidisk.c b/grub-core/disk/efi/efidisk.c +index 720a23fcca63..ea8d70a8d127 100644 +--- a/grub-core/disk/efi/efidisk.c ++++ b/grub-core/disk/efi/efidisk.c +@@ -871,7 +871,7 @@ grub_efidisk_get_device_name (grub_efi_handle_t *handle) + if (ctx.hd->partition_start == 0 + && (ctx.hd->partition_size << (parent->log_sector_size + - GRUB_DISK_SECTOR_BITS)) +- == grub_disk_get_size (parent)) ++ == grub_disk_native_sectors (parent)) + { + dev_name = grub_strdup (parent->name); + } +diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c +index e9d23299a538..3281b1d40482 100644 +--- a/grub-core/disk/geli.c ++++ b/grub-core/disk/geli.c +@@ -258,7 +258,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid, + if (2 * GRUB_MD_SHA256->mdlen + 1 > GRUB_CRYPTODISK_MAX_UUID_LENGTH) + return NULL; + +- sector = grub_disk_get_size (disk); ++ sector = grub_disk_native_sectors (disk); + if (sector == GRUB_DISK_SIZE_UNKNOWN || sector == 0) + return NULL; + +@@ -391,7 +391,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid, + + newdev->modname = "geli"; + +- newdev->total_length = grub_disk_get_size (disk) - 1; ++ newdev->total_length = grub_disk_native_sectors (disk) - 1; + grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid)); + COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= 32 * 2 + 1); + return newdev; +@@ -420,7 +420,7 @@ recover_key (grub_disk_t source, grub_cryptodisk_t dev) + if (dev->hash->mdlen > GRUB_CRYPTO_MAX_MDLEN) + return grub_error (GRUB_ERR_BUG, "mdlen is too long"); + +- sector = grub_disk_get_size (source); ++ sector = grub_disk_native_sectors (source); + if (sector == GRUB_DISK_SIZE_UNKNOWN || sector == 0) + return grub_error (GRUB_ERR_BUG, "not a geli"); + +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 1510fb35a765..6ba5d73af0f0 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -898,7 +898,7 @@ grub_ldm_detect (grub_disk_t disk, + /* LDM is never inside a partition. */ + if (!has_ldm || disk->partition) + continue; +- sector = grub_disk_get_size (disk); ++ sector = grub_disk_native_sectors (disk); + if (sector == GRUB_DISK_SIZE_UNKNOWN) + continue; + sector--; +@@ -1015,7 +1015,7 @@ grub_util_is_ldm (grub_disk_t disk) + /* LDM is never inside a partition. */ + if (!has_ldm || disk->partition) + continue; +- sector = grub_disk_get_size (disk); ++ sector = grub_disk_native_sectors (disk); + if (sector == GRUB_DISK_SIZE_UNKNOWN) + continue; + sector--; +diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c +index 18b3a8bb1d3f..ef5130c512d2 100644 +--- a/grub-core/disk/luks.c ++++ b/grub-core/disk/luks.c +@@ -300,7 +300,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid, + newdev->essiv_hash = essiv_hash; + newdev->hash = hash; + newdev->log_sector_size = 9; +- newdev->total_length = grub_disk_get_size (disk) - newdev->offset; ++ newdev->total_length = grub_disk_native_sectors (disk) - newdev->offset; + grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid)); + newdev->modname = "luks"; + COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid)); +diff --git a/grub-core/disk/mdraid1x_linux.c b/grub-core/disk/mdraid1x_linux.c +index 7cc80d3df39f..2c83f99fd8ea 100644 +--- a/grub-core/disk/mdraid1x_linux.c ++++ b/grub-core/disk/mdraid1x_linux.c +@@ -111,7 +111,7 @@ grub_mdraid_detect (grub_disk_t disk, + grub_uint64_t size; + grub_uint8_t minor_version; + +- size = grub_disk_get_size (disk); ++ size = grub_disk_native_sectors (disk); + + /* Check for an 1.x superblock. + * It's always aligned to a 4K boundary +diff --git a/grub-core/disk/mdraid_linux.c b/grub-core/disk/mdraid_linux.c +index 11024ae31e06..e40216f51117 100644 +--- a/grub-core/disk/mdraid_linux.c ++++ b/grub-core/disk/mdraid_linux.c +@@ -190,7 +190,7 @@ grub_mdraid_detect (grub_disk_t disk, + struct grub_diskfilter_vg *ret; + + /* The sector where the mdraid 0.90 superblock is stored, if available. */ +- size = grub_disk_get_size (disk); ++ size = grub_disk_native_sectors (disk); + if (size == GRUB_DISK_SIZE_UNKNOWN) + /* not 0.9x raid. */ + return NULL; +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index c82980375c83..8f02425d9b52 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -149,16 +149,16 @@ grub_cbfs_mount (grub_disk_t disk) + grub_off_t header_off; + struct cbfs_header head; + +- if (grub_disk_get_size (disk) == GRUB_DISK_SIZE_UNKNOWN) ++ if (grub_disk_native_sectors (disk) == GRUB_DISK_SIZE_UNKNOWN) + goto fail; + +- if (grub_disk_read (disk, grub_disk_get_size (disk) - 1, ++ if (grub_disk_read (disk, grub_disk_native_sectors (disk) - 1, + GRUB_DISK_SECTOR_SIZE - sizeof (ptr), + sizeof (ptr), &ptr)) + goto fail; + + ptr = grub_cpu_to_le32 (ptr); +- header_off = (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS) ++ header_off = (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS) + + (grub_int32_t) ptr; + + if (grub_disk_read (disk, 0, header_off, +@@ -172,16 +172,16 @@ grub_cbfs_mount (grub_disk_t disk) + if (!data) + goto fail; + +- data->cbfs_start = (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS) ++ data->cbfs_start = (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS) + - (grub_be_to_cpu32 (head.romsize) - grub_be_to_cpu32 (head.offset)); +- data->cbfs_end = (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS) ++ data->cbfs_end = (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS) + - grub_be_to_cpu32 (head.bootblocksize); + data->cbfs_align = grub_be_to_cpu32 (head.align); + +- if (data->cbfs_start >= (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS)) ++ if (data->cbfs_start >= (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS)) + goto fail; +- if (data->cbfs_end > (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS)) +- data->cbfs_end = (grub_disk_get_size (disk) << GRUB_DISK_SECTOR_BITS); ++ if (data->cbfs_end > (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS)) ++ data->cbfs_end = (grub_disk_native_sectors (disk) << GRUB_DISK_SECTOR_BITS); + + data->next_hofs = data->cbfs_start; + +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index 6aaa5b9390f1..fdcd23272335 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -772,7 +772,7 @@ grub_nilfs2_load_sb (struct grub_nilfs2_data *data) + partition_size = (grub_le_to_cpu64 (data->sblock.s_dev_size) + >> GRUB_DISK_SECTOR_BITS); + else +- partition_size = grub_disk_get_size (disk); ++ partition_size = grub_disk_native_sectors (disk); + if (partition_size != GRUB_DISK_SIZE_UNKNOWN) + { + /* Read second super block. */ +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index de6e26fb4336..738dd5065905 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -1179,7 +1179,7 @@ scan_disk (grub_device_t dev, struct grub_zfs_data *data, + desc.original = original; + + /* Don't check back labels on CDROM. */ +- if (grub_disk_get_size (dev->disk) == GRUB_DISK_SIZE_UNKNOWN) ++ if (grub_disk_native_sectors (dev->disk) == GRUB_DISK_SIZE_UNKNOWN) + vdevnum = VDEV_LABELS / 2; + + for (label = 0; ubbest == NULL && label < vdevnum; label++) +@@ -1188,7 +1188,7 @@ scan_disk (grub_device_t dev, struct grub_zfs_data *data, + = label * (sizeof (vdev_label_t) >> SPA_MINBLOCKSHIFT) + + ((VDEV_SKIP_SIZE + VDEV_BOOT_HEADER_SIZE) >> SPA_MINBLOCKSHIFT) + + (label < VDEV_LABELS / 2 ? 0 : +- ALIGN_DOWN (grub_disk_get_size (dev->disk), sizeof (vdev_label_t)) ++ ALIGN_DOWN (grub_disk_native_sectors (dev->disk), sizeof (vdev_label_t)) + - VDEV_LABELS * (sizeof (vdev_label_t) >> SPA_MINBLOCKSHIFT)); + + /* Read in the uberblock ring (128K). */ +diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c +index 62d6a85cc28c..e26b61f69b8a 100644 +--- a/grub-core/kern/disk.c ++++ b/grub-core/kern/disk.c +@@ -550,7 +550,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + } + + grub_uint64_t +-grub_disk_get_size (grub_disk_t disk) ++grub_disk_native_sectors (grub_disk_t disk) + { + if (disk->partition) + return grub_partition_get_len (disk->partition); +diff --git a/grub-core/kern/mips/arc/init.c b/grub-core/kern/mips/arc/init.c +index 86b3a25ec403..5c40c34078d5 100644 +--- a/grub-core/kern/mips/arc/init.c ++++ b/grub-core/kern/mips/arc/init.c +@@ -430,7 +430,7 @@ grub_machine_get_bootlocation (char **device, char **path) + } + + if (poff == 0 +- && pend == grub_disk_get_size (parent)) ++ && pend == grub_disk_native_sectors (parent)) + { + grub_disk_close (parent); + *device = dname; +diff --git a/grub-core/normal/misc.c b/grub-core/normal/misc.c +index 38f91b9b9837..ae63d1ebacc3 100644 +--- a/grub-core/normal/misc.c ++++ b/grub-core/normal/misc.c +@@ -176,14 +176,14 @@ grub_normal_print_device_info (const char *name) + (grub_partition_get_start (dev->disk->partition) & 1) ? ".5" : "" ); + else + grub_printf_ (N_(" - Sector size %uB"), 1 << dev->disk->log_sector_size); +- if (grub_disk_get_size (dev->disk) == GRUB_DISK_SIZE_UNKNOWN) ++ if (grub_disk_native_sectors (dev->disk) == GRUB_DISK_SIZE_UNKNOWN) + grub_puts_ (N_(" - Total size unknown")); + else + grub_printf (_(" - Total size %llu%sKiB"), +- (unsigned long long) (grub_disk_get_size (dev->disk) >> 1), ++ (unsigned long long) (grub_disk_native_sectors (dev->disk) >> 1), + /* TRANSLATORS: Replace dot with appropriate decimal separator for + your language. */ +- (grub_disk_get_size (dev->disk) & 1) ? _(".5") : ""); ++ (grub_disk_native_sectors (dev->disk) & 1) ? _(".5") : ""); + } + + if (dev) +diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c +index 04e0eda9aeb9..0cb9d1b7d007 100644 +--- a/grub-core/osdep/windows/platform.c ++++ b/grub-core/osdep/windows/platform.c +@@ -371,7 +371,7 @@ grub_install_register_efi (grub_device_t efidir_grub_dev, + + hddp->partition_start = grub_partition_get_start (efidir_grub_dev->disk->partition) + >> (efidir_grub_dev->disk->log_sector_size - GRUB_DISK_SECTOR_BITS); +- hddp->partition_size = grub_disk_get_size (efidir_grub_dev->disk) ++ hddp->partition_size = grub_disk_native_sectors (efidir_grub_dev->disk) + >> (efidir_grub_dev->disk->log_sector_size - GRUB_DISK_SECTOR_BITS); + + pathptr = hddp + 1; +diff --git a/include/grub/disk.h b/include/grub/disk.h +index b385af826fc4..0e0c4f430497 100644 +--- a/include/grub/disk.h ++++ b/include/grub/disk.h +@@ -170,7 +170,7 @@ typedef struct grub_disk_memberlist *grub_disk_memberlist_t; + + #define GRUB_DISK_MAX_MAX_AGGLOMERATE ((1 << (30 - GRUB_DISK_CACHE_BITS - GRUB_DISK_SECTOR_BITS)) - 1) + +-/* Return value of grub_disk_get_size() in case disk size is unknown. */ ++/* Return value of grub_disk_native_sectors() in case disk size is unknown. */ + #define GRUB_DISK_SIZE_UNKNOWN 0xffffffffffffffffULL + + /* This is called from the memory manager. */ +@@ -211,7 +211,7 @@ extern grub_err_t (*EXPORT_VAR(grub_disk_write_weak)) (grub_disk_t disk, + const void *buf); + + +-grub_uint64_t EXPORT_FUNC(grub_disk_get_size) (grub_disk_t disk); ++grub_uint64_t EXPORT_FUNC(grub_disk_native_sectors) (grub_disk_t disk); + + #if DISK_CACHE_STATS + void +diff --git a/util/grub-install.c b/util/grub-install.c +index 65bb2f99ef1f..eb49a36c5fba 100644 +--- a/util/grub-install.c ++++ b/util/grub-install.c +@@ -737,7 +737,7 @@ is_prep_empty (grub_device_t dev) + grub_disk_addr_t dsize, addr; + grub_uint32_t buffer[32768]; + +- dsize = grub_disk_get_size (dev->disk); ++ dsize = grub_disk_native_sectors (dev->disk); + for (addr = 0; addr < dsize; + addr += sizeof (buffer) / GRUB_DISK_SECTOR_SIZE) + { +diff --git a/util/grub-probe.c b/util/grub-probe.c +index 2a8c2cdffd50..e2e45e16a15e 100644 +--- a/util/grub-probe.c ++++ b/util/grub-probe.c +@@ -398,7 +398,7 @@ probe (const char *path, char **device_names, char delim) + if (! dev || !dev->disk) + grub_util_error ("%s", grub_errmsg); + +- dsize = grub_disk_get_size (dev->disk); ++ dsize = grub_disk_native_sectors (dev->disk); + for (addr = 0; addr < dsize; + addr += sizeof (buffer) / GRUB_DISK_SECTOR_SIZE) + { diff --git a/SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch b/SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch new file mode 100644 index 0000000..21e41f1 --- /dev/null +++ b/SOURCES/0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Glenn Washburn +Date: Mon, 23 Nov 2020 03:27:42 -0600 +Subject: [PATCH] fs: Fix block lists not being able to address to end of disk + sometimes + +When checking if a block list goes past the end of the disk, make sure +the total size of the disk is in GRUB native sector sizes, otherwise there +will be blocks at the end of the disk inaccessible by block lists. + +Signed-off-by: Glenn Washburn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/fs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c +index 730d21770f2b..84d2f14fb88a 100644 +--- a/grub-core/kern/fs.c ++++ b/grub-core/kern/fs.c +@@ -139,6 +139,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name) + unsigned i; + grub_disk_t disk = file->device->disk; + struct grub_fs_block *blocks; ++ grub_size_t max_sectors; + + /* First, count the number of blocks. */ + do +@@ -156,6 +157,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name) + return 0; + + file->size = 0; ++ max_sectors = grub_disk_from_native_sector (disk, disk->total_sectors); + p = (char *) name; + for (i = 0; i < num; i++) + { +@@ -181,7 +183,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name) + goto fail; + } + +- if (disk->total_sectors < blocks[i].offset + blocks[i].length) ++ if (max_sectors < blocks[i].offset + blocks[i].length) + { + grub_error (GRUB_ERR_BAD_FILENAME, "beyond the total sectors"); + goto fail; diff --git a/SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch b/SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch new file mode 100644 index 0000000..6ac5acf --- /dev/null +++ b/SOURCES/0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch @@ -0,0 +1,70 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Mukesh Kumar Chaurasiya +Date: Thu, 9 Feb 2023 13:09:16 +0530 +Subject: [PATCH] osdep/linux/hostdisk: Modify sector by sysfs as disk sector + +The disk sector size provided by sysfs file system considers the sector +size of 512 irrespective of disk sector size, thus causing the read by +the GRUB to an incorrect offset from what was originally intended. + +Considering the 512 sector size of sysfs data the actual sector needs to +be modified corresponding to disk sector size. + +Signed-off-by: Mukesh Kumar Chaurasiya +Reviewed-by: Daniel Kiper +(cherry picked from commit f7564844f82b57078d601befadc438b5bc1fa01b) +--- + grub-core/osdep/linux/hostdisk.c | 7 ++++--- + include/grub/disk.h | 7 +++++++ + 2 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/grub-core/osdep/linux/hostdisk.c b/grub-core/osdep/linux/hostdisk.c +index 06179fca7258..9b3030765b1f 100644 +--- a/grub-core/osdep/linux/hostdisk.c ++++ b/grub-core/osdep/linux/hostdisk.c +@@ -240,7 +240,8 @@ have_devfs (void) + #pragma GCC diagnostic ignored "-Wformat-nonliteral" + + static int +-grub_hostdisk_linux_find_partition (char *dev, grub_disk_addr_t sector) ++grub_hostdisk_linux_find_partition (const grub_disk_t disk, char *dev, ++ grub_disk_addr_t sector) + { + size_t len = strlen (dev); + const char *format; +@@ -305,7 +306,7 @@ grub_hostdisk_linux_find_partition (char *dev, grub_disk_addr_t sector) + if (fstat (fd, &st) < 0 + || !grub_util_device_is_mapped_stat (&st) + || !grub_util_get_dm_node_linear_info (st.st_rdev, 0, 0, &start)) +- start = grub_util_find_partition_start_os (real_dev); ++ start = grub_disk_to_native_sector (disk, grub_util_find_partition_start_os (real_dev)); + /* We don't care about errors here. */ + grub_errno = GRUB_ERR_NONE; + +@@ -382,7 +383,7 @@ grub_util_fd_open_device (const grub_disk_t disk, grub_disk_addr_t sector, int f + && strncmp (dev, "/dev/", 5) == 0) + { + if (sector >= part_start) +- is_partition = grub_hostdisk_linux_find_partition (dev, part_start); ++ is_partition = grub_hostdisk_linux_find_partition (disk, dev, part_start); + else + *max = part_start - sector; + } +diff --git a/include/grub/disk.h b/include/grub/disk.h +index 0e0c4f430497..4d3c2e571ef8 100644 +--- a/include/grub/disk.h ++++ b/include/grub/disk.h +@@ -173,6 +173,13 @@ typedef struct grub_disk_memberlist *grub_disk_memberlist_t; + /* Return value of grub_disk_native_sectors() in case disk size is unknown. */ + #define GRUB_DISK_SIZE_UNKNOWN 0xffffffffffffffffULL + ++/* Convert from GRUB native disk sized sector to disk sized sector. */ ++static inline grub_disk_addr_t ++grub_disk_to_native_sector (grub_disk_t disk, grub_disk_addr_t sector) ++{ ++ return sector >> (disk->log_sector_size - GRUB_DISK_SECTOR_BITS); ++} ++ + /* This is called from the memory manager. */ + void grub_disk_cache_invalidate_all (void); + diff --git a/SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch b/SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch new file mode 100644 index 0000000..19421c7 --- /dev/null +++ b/SOURCES/0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch @@ -0,0 +1,67 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Glenn Washburn +Date: Mon, 7 Sep 2020 17:27:59 +0200 +Subject: [PATCH] cryptodisk: Fix incorrect calculation of start sector + +Here dev is a grub_cryptodisk_t and dev->offset is offset in sectors of size +native to the cryptodisk device. The sector is correctly transformed into +native grub sector size, but then added to dev->offset which is not +transformed. It would be nice if the type system would help us with this. + +Signed-off-by: Glenn Washburn +Reviewed-by: Patrick Steinhardt +Reviewed-by: Daniel Kiper +--- + grub-core/disk/cryptodisk.c | 11 ++++------- + include/grub/disk.h | 7 +++++++ + 2 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 871640685d73..f4fd59095f6c 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -597,9 +597,8 @@ grub_cryptodisk_read (grub_disk_t disk, grub_disk_addr_t sector, + size, sector, dev->offset); + + err = grub_disk_read (dev->source_disk, +- (sector << (disk->log_sector_size +- - GRUB_DISK_SECTOR_BITS)) + dev->offset, 0, +- size << disk->log_sector_size, buf); ++ grub_disk_from_native_sector (disk, sector + dev->offset), ++ 0, size << disk->log_sector_size, buf); + if (err) + { + grub_dprintf ("cryptodisk", "grub_disk_read failed with error %d\n", err); +@@ -656,12 +655,10 @@ grub_cryptodisk_write (grub_disk_t disk, grub_disk_addr_t sector, + } + + /* Since ->write was called so disk.mod is loaded but be paranoid */ +- ++ sector = sector + dev->offset; + if (grub_disk_write_weak) + err = grub_disk_write_weak (dev->source_disk, +- (sector << (disk->log_sector_size +- - GRUB_DISK_SECTOR_BITS)) +- + dev->offset, ++ grub_disk_from_native_sector (disk, sector), + 0, size << disk->log_sector_size, tmp); + else + err = grub_error (GRUB_ERR_BUG, "disk.mod not loaded"); +diff --git a/include/grub/disk.h b/include/grub/disk.h +index 4d3c2e571ef8..0091fbca181c 100644 +--- a/include/grub/disk.h ++++ b/include/grub/disk.h +@@ -180,6 +180,13 @@ grub_disk_to_native_sector (grub_disk_t disk, grub_disk_addr_t sector) + return sector >> (disk->log_sector_size - GRUB_DISK_SECTOR_BITS); + } + ++/* Convert to GRUB native disk sized sector from disk sized sector. */ ++static inline grub_disk_addr_t ++grub_disk_from_native_sector (grub_disk_t disk, grub_disk_addr_t sector) ++{ ++ return sector << (disk->log_sector_size - GRUB_DISK_SECTOR_BITS); ++} ++ + /* This is called from the memory manager. */ + void grub_disk_cache_invalidate_all (void); + diff --git a/SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch b/SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch new file mode 100644 index 0000000..89741a1 --- /dev/null +++ b/SOURCES/0683-gettext-gettext-Unregister-gettext-command-on-module.patch @@ -0,0 +1,62 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Thu, 21 Aug 2025 21:14:06 +0000 +Subject: [PATCH] gettext/gettext: Unregister gettext command on module unload + +When the gettext module is loaded, the gettext command is registered but +isn't unregistered when the module is unloaded. We need to add a call to +grub_unregister_command() when unloading the module. + +Fixes: CVE-2025-61662 + +Reported-by: Alec Brown +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/gettext/gettext.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 0e51b5d28ad0..92e91b35e87f 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -509,6 +509,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)), + return 0; + } + ++static grub_command_t cmd; ++ + GRUB_MOD_INIT (gettext) + { + const char *lang; +@@ -528,13 +530,14 @@ GRUB_MOD_INIT (gettext) + grub_register_variable_hook ("locale_dir", NULL, read_main); + grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary); + +- grub_register_command_p1 ("gettext", grub_cmd_translate, +- N_("STRING"), +- /* TRANSLATORS: It refers to passing the string through gettext. +- So it's "translate" in the same meaning as in what you're +- doing now. +- */ +- N_("Translates the string with the current settings.")); ++ cmd = grub_register_command_p1 ("gettext", grub_cmd_translate, ++ N_("STRING"), ++ /* ++ * TRANSLATORS: It refers to passing the string through gettext. ++ * So it's "translate" in the same meaning as in what you're ++ * doing now. ++ */ ++ N_("Translates the string with the current settings.")); + + /* Reload .mo file information if lang changes. */ + grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang); +@@ -551,6 +554,8 @@ GRUB_MOD_FINI (gettext) + grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); + grub_register_variable_hook ("lang", NULL, NULL); + ++ grub_unregister_command (cmd); ++ + grub_gettext_delete_list (&main_context); + grub_gettext_delete_list (&secondary_context); + diff --git a/SOURCES/20-grub.install b/SOURCES/20-grub.install index 9b74538..0ecf1e2 100755 --- a/SOURCES/20-grub.install +++ b/SOURCES/20-grub.install @@ -90,13 +90,10 @@ case "$COMMAND" in [[ -d "$BLS_DIR" ]] || mkdir -m 0700 -p "$BLS_DIR" BLS_ID="${MACHINE_ID}-${KERNEL_VERSION}" BLS_TARGET="${BLS_DIR}/${BLS_ID}.conf" - if [[ -f "${KERNEL_DIR}/bls.conf" ]]; then - cp -aT "${KERNEL_DIR}/bls.conf" "${BLS_TARGET}" || exit $? - else - mkbls "${KERNEL_VERSION}" \ - "$(date -u +%Y%m%d%H%M%S -d "$(stat -c '%y' "${KERNEL_DIR}")")" \ - >"${BLS_TARGET}" - fi + mkbls "${KERNEL_VERSION}" \ + "$(date -u +%Y%m%d%H%M%S -d "$(stat -c '%y' "${KERNEL_DIR}")")" \ + >"${BLS_TARGET}" + command -v restorecon &>/dev/null && restorecon -R "${BLS_TARGET}" LINUX="$(grep '^linux[ \t]' "${BLS_TARGET}" | sed -e 's,^linux[ \t]*,,')" INITRD="$(grep '^initrd[ \t]' "${BLS_TARGET}" | sed -e 's,^initrd[ \t]*,,')" @@ -109,7 +106,11 @@ case "$COMMAND" in sed -i -e "s,^initrd.*,initrd ${BOOTPREFIX}${INITRD},g" "${BLS_TARGET}" fi - if [[ "$KERNEL_VERSION" == *\+* ]] && [ "x$GRUB_DEFAULT_TO_DEBUG" != "xtrue" ]; then + if ( [[ "$KERNEL_VERSION" != *${GRUB_DEFAULT_KERNEL_TYPE}* ]] && \ + [ "x$GRUB_NON_STANDARD_KERNEL" == "xtrue" ] ) || \ + ( echo "$KERNEL_VERSION" | grep -E -q "64k|auto|rt|uki" && \ + [ "x$GRUB_NON_STANDARD_KERNEL" != "xtrue" ] ) || \ + ( [[ "$KERNEL_VERSION" == *debug* ]] && [ "x$GRUB_DEFAULT_TO_DEBUG" != "xtrue" ] ); then GRUB_UPDATE_DEFAULT_KERNEL=false fi @@ -154,8 +155,9 @@ case "$COMMAND" in if [[ "x${GRUB_ENABLE_BLSCFG}" = "xtrue" ]] || [[ ! -f /sbin/new-kernel-pkg ]]; then ARCH="$(uname -m)" BLS_TARGET="${BLS_DIR}/${MACHINE_ID}-${KERNEL_VERSION}.conf" + BLS_FAKE_TARGET="${BLS_DIR}/ffffffffffffffffffffffffffffffff-${KERNEL_VERSION}.conf" BLS_DEBUG="$(echo ${BLS_TARGET} | sed -e "s/${KERNEL_VERSION}/${KERNEL_VERSION}~debug/")" - rm -f "${BLS_TARGET}" "${BLS_DEBUG}" + rm -f "${BLS_TARGET}" "${BLS_DEBUG}" "${BLS_FAKE_TARGET}" for i in vmlinuz System.map config zImage.stub dtb; do rm -rf "/boot/${i}-${KERNEL_VERSION}" diff --git a/SOURCES/99-grub-mkconfig.install b/SOURCES/99-grub-mkconfig.install old mode 100644 new mode 100755 index b14fc82..4736367 --- a/SOURCES/99-grub-mkconfig.install +++ b/SOURCES/99-grub-mkconfig.install @@ -8,17 +8,33 @@ ARCH=$(uname -m) [[ -f /etc/default/grub ]] && . /etc/default/grub -# Can't assume a BLS capable bootloader on ppc64 -if [[ x$GRUB_ENABLE_BLSCFG != xfalse && - $ARCH != "ppc64" && $ARCH != "ppc64le" ]]; then +# Assume GRUB_ENABLE_BLSCFG is true if +# GRUB_ENABLE_BLSCFG is not set, e.g. /etc/default/grub does not exist +# GRUB_ENABLE_BLSCFG is set to true +if [[ x$GRUB_ENABLE_BLSCFG != xfalse ]]; then + # Can't assume a BLS capable bootloader on ppc64 + if [[ $ARCH = "ppc64" || $ARCH = "ppc64le" ]]; then + RUN_MKCONFIG="true" + fi +fi + +# A traditional grub configuration file needs to be generated only in the case when +# the bootloaders are not capable of populating a menu entry from the BLS fragments. +if [[ $RUN_MKCONFIG != "true" ]]; then exit 0 fi COMMAND="$1" +grub_cfg=/boot/grub2/grub.cfg +if mountpoint -q /boot/efi; then + os_name=$(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/' -e 's/\"//g') + grub_cfg=/boot/efi/EFI/$os_name/grub.cfg +fi + case "$COMMAND" in add|remove) - grub2-mkconfig --no-grubenv-update -o /boot/grub2/grub.cfg >& /dev/null + grub2-mkconfig --no-grubenv-update -o $grub_cfg >& /dev/null ;; *) ;; diff --git a/SOURCES/ciq_sb_grub2_aarch64.crt b/SOURCES/ciq_sb_grub2_aarch64.crt new file mode 100644 index 0000000..6a30b53 --- /dev/null +++ b/SOURCES/ciq_sb_grub2_aarch64.crt @@ -0,0 +1,36 @@ +-----BEGIN CERTIFICATE----- +MIIGOzCCBCOgAwIBAgIQBeFE47Ri94u6HaD3NnplgTANBgkqhkiG9w0BAQwFADBo +MQswCQYDVQQGEwJVUzEPMA0GA1UECBMGTmV2YWRhMQ0wCwYDVQQHEwRSZW5vMRYw +FAYDVQQKEw1DdHJsIElRLCBJbmMuMSEwHwYDVQQDExhDdHJsIElRLCBJbmMuIElz +c3VpbmcgQ0EwHhcNMjQxMTE1MjMxODA2WhcNMzQxMTEzMjMxODA2WjBeMQswCQYD +VQQGEwJVUzEPMA0GA1UECBMGTmV2YWRhMRUwEwYDVQQKEwxDVFJMIElRLCBJTkMx +JzAlBgNVBAMTHkNJUSBHcnViMiBTZWN1cmVCb290IC0gYWFyY2g2NDCCAaIwDQYJ +KoZIhvcNAQEBBQADggGPADCCAYoCggGBALPgNoYyEDps1WOiproHdZCPM92LDVgD +K6oadBfwJLmxRdtW5wUyX7qn8VlP426wi7P5QHl4Ufi/m/LqyhmdDOziGaDNQYeH +cIsJTfNe6lzXumryHzDp7n9n9HE6fdJgf81FNykoVPTMKiYDpRbv53ze0BqayyKb +DtCOnz0d8Z7+8plkn11yfwKXg49VjJ+P+Q8Fk+MkHvULNu+Ue8iVLNy5YEG3qzIi +sPML4ttVpu9QM+IZfwpgI0N0nQOaiUuOJ5jFomnR0/XTGUV8Qvlew+Kp0ICIYqo7 +D/w7xl4bxI/21VKDom+7ltyB0f12VQJo9EM3iLhxaJ1JkKdTS3fU2zRkPg4glzSe +DvFgfw3bCSIs3j+61SbJnYfXfSSBn/VU4YrV2TMs/xRg3tKWxjc7Ws4vAeKUMovw +9tWVrZoGM6XMLNZhpyo6qIoH9i8y1H3/Nye8EVNXp/cIguWYCMuM+4XSciLuyGX3 +JWpOlDoIxpzg/IIP9dO4y1SAUdqw9e7ZDQIDAQABo4IBaTCCAWUwHwYDVR0jBBgw +FoAUkyKuYIju74ifnwWqc0KdLwiHqc0wDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB +/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSQYDVR0fBEIwQDA+oDygOoY4aHR0 +cDovL2NybC5lbnRlcnByaXNlLnNlY3RpZ28uY29tL0N0cmxJUUluY0lzc3VpbmdD +QS5jcmwwgYQGCCsGAQUFBwEBBHgwdjBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5l +bnRlcnByaXNlLnNlY3RpZ28uY29tL0N0cmxJUUluY0lzc3VpbmdDQS5jcnQwLgYI +KwYBBQUHMAGGImh0dHA6Ly9vY3NwLmVudGVycHJpc2Uuc2VjdGlnby5jb20wHgYD +VR0RBBcwFYETaXRfc2VjdXJpdHlAY2lxLmNvbTAdBgNVHQ4EFgQUwqC5C+UYeCQz +jPu1JL+BnN4vHpUwDQYJKoZIhvcNAQEMBQADggIBAEdnctJ0xzqiYmiTvc8hjAUt ++bRfaELDdOcGQ73fzdd917ShthJXSDWzWdowfyxY3C3CFrJ22FJ/iPnCbzg0/0so +GlM2uKTDdFl9hJWlhmd3TJ9TVl0MbcFNMii4+ezlxLNXxFPqC8+DTBdgru6CEPWL +XguRDUzKhp5gsZ8bxJOMpF68FycaFh7jcMBdV0Hd9aWc9f1OR85nqNMvCF6YTp1P +BU7SMjreTEK2hRE3/zCKjJGmIynvH2NsuPgURbToH8B0ftmb0GpEztWAJbOwrtyO +X/iAXrAAG9gtdYgI5Oloxtkh5Z5deEOB7E5lA577b6CBXC/Ls+b4CAQbJji6dIeU +kW5a6PDBEi3TElOhG/xnVFaaO+scqLcIkVqc+ciPDbrgAVaNghq/bVDQ7itiiEN3 +mj7Z9ZuQ9LHqQoj3kmR2QBLa8vO0qOReuW4O3THhtRhkYJDItkdFGfRYNknuzAyN +VgAw8zL8D5gL6BSIeqgMweJ2Z5G4GRkDvyhg0nrZNyEkGh8XdkzMgFwwv2+r67rN +t5gkbnyBdC29qb/2sxAThgv+3e6RNTpogJr/5lotmttbS5rD+G/7YeqUMQxwc376 +16uaGcC2xAYsW3MfuqRrNwAIfPTiMdI3AieZSrQqF7fC1ROz5at4gUvqG65qt+LH +gHvwuMzv8u2HbLjIbPKD +-----END CERTIFICATE----- diff --git a/SOURCES/ciq_sbsign.macros b/SOURCES/ciq_sbsign.macros new file mode 100644 index 0000000..8edc2c5 --- /dev/null +++ b/SOURCES/ciq_sbsign.macros @@ -0,0 +1,26 @@ +# CIQ-specific sbsign override +# If pe_signing_certkeyslot is defined, we assume we want to do a proper secureboot signing as part of the build +# This macro overrides the "new" Rocky way of using a Python wrapper, and simply makes the pesign macro call sbsign instead with the specified cert, key slot and openssl conf file + +%if 0%{?pe_signing_certkeyslot:1} +%define __certkeyslot %{?pe_signing_certkeyslot:%{pe_signing_certkeyslot}} + +%define _sbsign /usr/bin/sbsign + +%define __opensslcnf %{?pe_signing_opensslcnf:%{pe_signing_opensslcnf}} + +%define pesign(i:o:C:e:c:n:a:s) \ + OPENSSL_CONF=%{__opensslcnf} %{_sbsign} --engine pkcs11 --key 'pkcs11:token=YubiHSM;id=%{__certkeyslot}' %{?-c:--cert "%{-c*}"} %{?-i: "%{-i*}"} %{?-o:--output "%{-o*}"} +%endif + + +# Override secureboot cert + key definitions with CIQ specific ones: +%ifarch x86_64 +%define sb_cer %{SOURCE1102} +%define sb_key ciq_sb_grub2 +%endif + +%ifarch aarch64 +%define sb_cer %{SOURCE1104} +%define sb_key ciq_sb_grub2_aarch64 +%endif diff --git a/SOURCES/grub.macros b/SOURCES/grub.macros index bf9e5fd..3fac42f 100644 --- a/SOURCES/grub.macros +++ b/SOURCES/grub.macros @@ -286,6 +286,10 @@ Requires: %{name}-tools-minimal >= %{evr} \ Requires: %{name}-tools-extra = %{evr} \ Requires: %{name}-tools = %{evr} \ Provides: %{name}-efi = %{evr} \ +# Add ciq-shim requirement, ONLY on ciq secureboot supported arches \ +%ifarch x86_64 aarch64 \ +Requires: ciq-shim >= 15.8 \ +%endif \ %{?legacy_provides:Provides: %{name} = %{evr}} \ %{-o:Obsoletes: %{name}-efi < %{evr}} \ \ @@ -587,14 +591,15 @@ install -d -m 0700 ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig \ touch ${RPM_BUILD_ROOT}%{_sysconfdir}/default/grub \ ln -sf ../default/grub \\\ ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/grub \ -touch ${RPM_BUILD_ROOT}/boot/%{name}/grub.cfg \ +touch grub.cfg \ +install -m 0600 grub.cfg ${RPM_BUILD_ROOT}/boot/%{name}/ \ %{nil} %define define_legacy_variant_files() \ %{expand:%%files %{1}} \ %defattr(-,root,root,-) \ %config(noreplace) %{_sysconfdir}/%{name}.cfg \ -%ghost %config(noreplace) %attr(0700,root,root)/boot/%{name}/grub.cfg \ +%ghost %config(noreplace) %attr(0600,root,root)/boot/%{name}/grub.cfg \ %dir %attr(0700,root,root)/boot/loader/entries \ %ifarch ppc64le \ %dir %{_libdir}/grub/%{2}/ \ diff --git a/SOURCES/grub.patches b/SOURCES/grub.patches index 3bb7067..003d7b2 100644 --- a/SOURCES/grub.patches +++ b/SOURCES/grub.patches @@ -576,3 +576,107 @@ Patch0575: 0575-Enable-shared-processor-mode-in-vector-5.patch Patch0576: 0576-efi-http-change-uint32_t-to-uintn_t-for-grub_efi_htt.patch Patch0577: 0577-ieee1275-Converting-plain-numbers-to-constants-in-Ve.patch Patch0578: 0578-ieee1275-extended-support-in-options-vector5.patch +Patch0579: 0579-Regenerate-kernelopts-if-missing-on-ppc.patch +Patch0580: 0580-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch +Patch0581: 0581-util-Enable-default-kernel-for-updates.patch +Patch0582: 0582-grub-set-bootflag-Conservative-partial-fix-for-CVE-2.patch +Patch0583: 0583-grub-set-bootflag-More-complete-fix-for-CVE-2024-104.patch +Patch0584: 0584-grub-set-bootflag-Exit-calmly-when-not-running-as-ro.patch +Patch0585: 0585-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch +Patch0586: 0586-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch +Patch0587: 0587-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch +Patch0588: 0588-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch +Patch0589: 0589-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch +Patch0590: 0590-fs-ntfs-Make-code-more-readable.patch +Patch0591: 0591-grub-mkconfig.in-turn-off-executable-owner-bit.patch +Patch0592: 0592-misc-Implement-grub_strlcpy.patch +Patch0593: 0593-fs-ufs-Fix-a-heap-OOB-write.patch +Patch0594: 0594-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch +Patch0595: 0595-fs-tar-Initialize-name-in-grub_cpio_find_file.patch +Patch0596: 0596-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0597: 0597-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch +Patch0598: 0598-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch +Patch0599: 0599-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch +Patch0600: 0600-fs-iso9660-Fix-invalid-free.patch +Patch0601: 0601-fs-jfs-Fix-OOB-read-in-jfs_getent.patch +Patch0602: 0602-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch +Patch0603: 0603-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch +Patch0604: 0604-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch +Patch0605: 0605-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch +Patch0606: 0606-fs-ntfs-Fix-out-of-bounds-read.patch +Patch0607: 0607-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch +Patch0608: 0608-fs-ntfs-Use-a-helper-function-to-access-attributes.patch +Patch0610: 0610-fs-xfs-Fix-out-of-bounds-read.patch +Patch0611: 0611-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch +Patch0612: 0612-kern-file-Ensure-file-data-is-set.patch +Patch0613: 0613-kern-file-Implement-filesystem-reference-counting.patch +Patch0614: 0614-disk-loopback-Reference-tracking-for-the-loopback.patch +Patch0615: 0615-kern-disk-Limit-recursion-depth.patch +Patch0616: 0616-kern-partition-Limit-recursion-in-part_iterate.patch +Patch0617: 0617-script-execute-Limit-the-recursion-depth.patch +Patch0618: 0618-net-Unregister-net_default_ip-and-net_default_mac-va.patch +Patch0619: 0619-net-Remove-variables-hooks-when-interface-is-unregis.patch +Patch0620: 0620-net-Fix-OOB-write-in-grub_net_search_config_file.patch +Patch0621: 0621-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch +Patch0622: 0622-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch +Patch0623: 0623-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch +Patch0624: 0624-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch +Patch0625: 0625-commands-extcmd-Missing-check-for-failed-allocation.patch +Patch0626: 0626-commands-ls-Fix-NULL-dereference.patch +Patch0627: 0627-commands-pgp-Unregister-the-check_signatures-hooks-o.patch +Patch0628: 0628-normal-Remove-variables-hooks-on-module-unload.patch +Patch0629: 0629-gettext-Remove-variables-hooks-on-module-unload.patch +Patch0630: 0630-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch +Patch0631: 0631-gettext-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0632: 0632-commands-read-Fix-an-integer-overflow-when-supplying.patch +Patch0633: 0633-commands-test-Stack-overflow-due-to-unlimited-recurs.patch +Patch0634: 0634-commands-minicmd-Block-the-dump-command-in-lockdown-.patch +Patch0635: 0635-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch +Patch0636: 0636-commands-hexdump-Disable-memory-reading-in-lockdown-.patch +Patch0637: 0637-fs-bfs-Disable-under-lockdown.patch +Patch0638: 0638-fs-Disable-many-filesystems-under-lockdown.patch +Patch0639: 0639-disk-Use-safe-math-macros-to-prevent-overflows.patch +Patch0640: 0640-disk-Prevent-overflows-when-allocating-memory-for-ar.patch +Patch0641: 0641-disk-Check-if-returned-pointer-for-allocated-memory-.patch +Patch0642: 0642-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch +Patch0643: 0643-fs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0644: 0644-fs-Prevent-overflows-when-allocating-memory-for-arra.patch +Patch0645: 0645-fs-Prevent-overflows-when-assigning-returned-values-.patch +Patch0646: 0646-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0647: 0647-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch +Patch0648: 0648-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch +Patch0649: 0649-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch +Patch0650: 0650-net-Use-safe-math-macros-to-prevent-overflows.patch +Patch0651: 0651-net-Prevent-overflows-when-allocating-memory-for-arr.patch +Patch0652: 0652-net-Check-if-returned-pointer-for-allocated-memory-i.patch +Patch0653: 0653-fs-sfs-Check-if-allocated-memory-is-NULL.patch +Patch0654: 0654-script-execute-Fix-potential-underflow-and-NULL-dere.patch +Patch0655: 0655-osdep-unix-getroot-Fix-potential-underflow.patch +Patch0656: 0656-misc-Ensure-consistent-overflow-error-messages.patch +Patch0657: 0657-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch +Patch0658: 0658-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch +Patch0659: 0659-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch +Patch0660: 0660-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch +Patch0661: 0661-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch +Patch0662: 0662-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch +Patch0663: 0663-types-Make-bool-generally-available.patch +Patch0664: 0664-Remove-exttra-bool-definitions.patch +Patch0665: 0665-fs-xfs-Fix-issues-found-while-fuzzing-the-XFS-filesy.patch +Patch0666: 0666-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch +Patch0667: 0667-fs-xfs-Add-bigtime-incompat-feature-support.patch +Patch0668: 0668-fs-xfs-Add-needsrepair-incompat-feature-support.patch +Patch0669: 0669-fs-xfs-Fix-unreadable-filesystem-with-v4-superblock.patch +Patch0670: 0670-fs-Remove-trailing-whitespaces.patch +Patch0671: 0671-fs-xfs-Fix-memory-leaks-in-XFS-module.patch +Patch0672: 0672-fs-xfs-Incorrect-short-form-directory-data-boundary-.patch +Patch0673: 0673-fs-xfs-Fix-XFS-directory-extent-parsing.patch +Patch0674: 0674-fs-xfs-Add-large-extent-counters-incompat-feature-su.patch +Patch0675: 0675-fs-xfs-Handle-non-continuous-data-blocks-in-director.patch +Patch0676: 0676-fs-xfs-fix-large-extent-counters-incompat-feature-su.patch +Patch0677: 0677-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch +Patch0678: 0678-Strip-correctly-BLS-files-with-conf-extension.patch +Patch0679: 0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch +Patch0680: 0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch +Patch0681: 0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch +Patch0682: 0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch +Patch0683: 0683-gettext-gettext-Unregister-gettext-command-on-module.patch diff --git a/SOURCES/redhatsecureboot301.cer b/SOURCES/redhatsecureboot301.cer new file mode 100644 index 0000000000000000000000000000000000000000..4ff8b79e6736e566dbf39603e0887a53345aa4e4 GIT binary patch literal 839 zcmXqLVs5=#_OQj1C) zic(WD5=-=w^K%X4#CZ)(42%qc(A3<>AWEFq*xbO#zzobaj4}u^)G^S4Sf`BDy5h|A zyv)3GQtWJER6_O@BP#=Q6C*!^K@%evQxhX2!zT5vqmx`?o`(oz{$eeCezR_cLPyl% zHpefqUbuO&%O^nA}y6#9BjM%~U7Q(5kw6_YN1epR)|xb9Elg4_B`%!~|-ixmyz4P=2K zFU!Xw#v&5#_@80Rp3FS`6#W&an$HJBb(91l2O=d+v%~@6}B_2%&Mg` zDvt6_STWb-ZhXD^RgaJz3Cq5o4B43+oEZD&XVQnj{jXOGHfUJJB>qmC?A`ut>Ahpw zdM-|DZzz7Yc^I3-u|J*vqdKqQ`kIF?LJd~2r8XOg&f%Z+Yj((@r{(*;Y?_w8rSDJJ zntk_K74NJ(drfx5hIZaKImf>p{fSPd=}qfHlV8OA-0dHz$M#&#on!XF_3NjY{(Hxy zbKN4k{8NvC{Y9;Yo!51>R!)l5n2-{5CgAUe(k!NLc|1u*B2w==ttY-NzWb+N=75O& zzv2uf{%c3S9%5x`<-dQv`g=w9>l=;D-vz#WO}UeuefPU1`=|Tw9$I=mIi&>vg+x|L literal 0 HcmV?d00001 diff --git a/SOURCES/redhatsecureboot502.cer b/SOURCES/redhatsecureboot502.cer new file mode 100644 index 0000000000000000000000000000000000000000..be0b5e211ccf8ad7ba74c88841c921cfdbad5a70 GIT binary patch literal 964 zcmXqLVm@Hd#I#}oGZP~d6DPygP|MB7r^(JU;AP{~YV&CO&dbQi&B|a9ZzyIU!p0oR z!o|ZIl$xU8kyxUm;F*`KXQ*f(4-#kQk${RT1g9pK7NsgU<>!|uI6Eqs8Y&qmz)j<1 z6ca8^O-{^7Eh=#+N=?Z~EYVBO&oz(}=QT1gFf*_;G%zqQGL91GHMTG?G_-(n4bpHr zK*K-{;sAMU4hYUn&&$k9S1>g&BFY_2j7rFUXJlnyZerwTFlb`rVrpV!WVlw+5~fxp zlC4%={*?v=&XRBAh?w3|ekJhoz zKe*}Ss+-Dp3y#N}_#^e|W8doa9aT(wxO?y2p89Cbu3Q!=zP!k}$2XsU9VoV!m$7=u zaXE&jl}!J>*zj`9usQhLT4_#)+wqRaoS&{Uz0p%LI=p$>w%yj@jOK-#m#OZnogtKa zXx0-|7pa7a%Pt;nc|B=yqk7|#ij=DjlCF{bKHcw(tDZ=IoA@v;?(+N1K5vh6$0wbX zowLen&AF!%E3#rkR^7F4a=E#$KV5;`11Av2kd# zF|x9 z$k^rSH+lBn4DN|8WwYk@BgYLeT>|5Vkzw{NgZMQ5DIkiD~`h}y9{<=D~#ILx2 z!|e$CoGxy;)T!q_Y)P}vi)7| puC*wrU@|^yJWH`pNJ3}E-0bhMGuf{5G|c)nwXm(hxVvuYUH~CAajXCU literal 0 HcmV?d00001 diff --git a/SOURCES/redhatsecureboot601.cer b/SOURCES/redhatsecureboot601.cer new file mode 100644 index 0000000000000000000000000000000000000000..c92b96b4e0d360b90333361ea61f565f196ea20e GIT binary patch literal 916 zcmXqLVxC~o#8k0>nTe5!iId^-97p53+3_w0ylk9WZ60mkc^MhGSs4u64HXUK*_cCF zn0X|EQd1N>5=#_*enXpOwY^AOII)h zY9hwICPpP>zc8{gFgG#sGZ-{6axpbAGBQki!xdZoCRX_S>dV}-BbKHWadCWS=ictf zX!LID`KNZP*Y{*9L|}%3_emT z=3e&*+PO}C!>cFT-xY3>#+jTtA9;|7?{ zfN{gfkisa`?6XkHTKh%6xuB-@a@A8u|2@AV?)Y1R|85iijb|M5C)`>v`vA}Wwb4kOkuKYkrH2^@l99De!}lh|79J&NCf?#_qJr(?s~t*IWParC|#~@cmCKBc#uW$e87pz^*}ZFcLToW*~c?muOF`th~Ca6;MkH0u8E;ZRmJw4GFuwHdd(wk|9y*>0095ZYghmP literal 0 HcmV?d00001 diff --git a/SOURCES/redhatsecureboot701.cer b/SOURCES/redhatsecureboot701.cer new file mode 100644 index 0000000000000000000000000000000000000000..25e3743e47c3c1f06da0124a1d99e99e4920f6e7 GIT binary patch literal 916 zcmXqLVxC~o#8k0>nTe5!iId@pypfsK^#n41{+84Q{jxtN+585ynxiti9Hzr++{YFiX}{@nDZ%!WV8j3UD8 zZ+!lKjZO1y#-iirm+g-*`lJ<_aM|wiv%8TJnzQ!ssVaZm*kb4QPDg$M*B3_rD>p7% z?kp3_`l%Ar=Hn_UygBpZEbi)Ej8jc|c~`Do@=M>(-s$x6M`x*I82hq3^kj zzuK$&zt%X$xEUWcHLYq&I>7dM`!bUmYMbq*C9;>wz4$bJrJ2L!EH9x2*$dfwGPGu! z{Wi>7Cb@4_kMxc`jGwn$@9lan`0s9L(CJAVx;#y9x!n46o{5=}fpKw#L74#$Fw|v* z85#exFc~ly@PT;zARY@d6MKV!7>KV5;`11Av2kd#F|x9z^TJke=Yf+TuQImK*!64p6$GYbw=2q@m%cdpg{kMBT+r(Ch*_zS5 zA5Nx}NPA6rc(7rbaoFblPiE%v-1)WHp{F9M%kPns%89$*zq+znD|%ZCrmwr|cKX<| Tt1h>T)0Nk#SZ8pFAMXMHU|?Vk literal 0 HcmV?d00001 diff --git a/SOURCES/redhatsecurebootca3.cer b/SOURCES/redhatsecurebootca3.cer new file mode 100644 index 0000000000000000000000000000000000000000..b2354007b9668258683b99a68fa5bdd3067c31b1 GIT binary patch literal 977 zcmXqLVm@oo#I$t*GZP~d6DPykKFO2}lmD>>ylk9WZ60mkc^MhGSs4s`4b=@)*_cCF zn1$tnQd1N>5=#_OQj1C) zic(WD5=-=w^K%X4#CZ)(42%qc(8R>VG)kP;*xbO#zzoWzwslR6O2{5!WMyD(V&rEq zXkz4IYGPz$nC+~vi6EDouC4!V-;tv&JA zN}nf->iaHo2tM8rAb&8=Njdj{a^${=Z?aE)&k<1VH{Q3Wx7jKD-_5CYum4K4d~JV` z`ccOE*<7!m22LI4&u3g0F3h!NN?ysm?c*7~^lIfF3D-Xhnr_&uU!bJ$?ZS8WW+A0- zr9raw{Iep~On)hDAUrqc*pZy>@YoE^;z#ABPp))utMY{K9XOZuN+87Vv97^}gccFK z6&c%&T=rzVyKuJ1S>c?Rq?77kYS zv==`X%}MC|0a-81!fL?G$oL;QPJxLO7^jR3 zp{b9(0{X(lQ;+K%h_CKtxc%nd+9kH!CBia&JkgcqO9LvF9(I1~^2+p(_fBqs&+@+g zjZG)^b(y8?lr#NV`RkoR|I-BpaSiJiPBV7drX0Bbe!0fPB95K&)ygj1YM5%bK;(6L z=7Y@r2hM%A`uyr;o|A^(c{icYtu_B=WuE^MZ_<i|1QMhsQHT z4}wg*#%C!d<*ePQAKPyWoS|9R;jPUx*P-5Ksuo_~6c3tyKHzf+y+r*{_;vOAw> zmv4Wk&h*1hGe;ze)#t#BH;PsH)$e|FOmna8+@9jW!^ymRMf{q+C84h)mppfN*sxn6 NnfI|Q%N6m!6aeL$dME$@ literal 0 HcmV?d00001 diff --git a/SOURCES/redhatsecurebootca5.cer b/SOURCES/redhatsecurebootca5.cer new file mode 100644 index 0000000000000000000000000000000000000000..dfb0284954861282d1a0ce16c8c5cdc71c27659f GIT binary patch literal 920 zcmXqLVxD5q#8k6@nTe5!iIbtZm{+@~;bN2lFB_*;n@8JsUPeZ4RtAH3LoovpHs(+k zE*{>X)D#7e#1b6^&%9(kLq!95kT^4s1XNrhI5oMnC{@8JKfgr5*-^pNP{}|6ZW6NxP$#b?ru1p1aqn$3D)YB{Qqo zjCvjz?|=HkE#3AN-xTZpws*U~)f@DZ{t~uwMZy8<;F%jD%$u6!n#qYzp^Sryh{C;x9qf@!N=T4ui@b#({ zSD&^p3kNZ=9lAQ9%xdfP9doNToV+k2^LHOFD{5oE&78StJa^8n7$i2k94PWc<&xr*# z`sciS&XK#@>h!OC8{=mczNLHbADCJ+pE=-CsaDOF#s}?5Q)1qq&%R~#cz>QmiAiVx zk5XXYstAL9d+iK-w@u$FESybMIPOFY~9lmn~9nUf%vMc88@((p0B(#qL+!COmt7`j5IhPVzo{cRPw} Pd!}BnFF!b8N6JS4>O*3Z literal 0 HcmV?d00001 diff --git a/SOURCES/sbat.csv.in b/SOURCES/sbat.csv.in index b92b8c2..0a5fbbc 100755 --- a/SOURCES/sbat.csv.in +++ b/SOURCES/sbat.csv.in @@ -1,5 +1,5 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -grub,3,Free Software Foundation,grub,2.02,https://www.gnu.org/software/grub/ +grub,5,Free Software Foundation,grub,2.02,https://www.gnu.org/software/grub/ grub.rh,2,Red Hat Enterprise Linux 8,grub2,@@VERSION_RHEL_RELEASE@@,mailto:secalert@redhat.com grub.rocky8,2,Rocky Linux 8,grub2,@@VERSION_RESF_RELEASE@@,mailto:security@rockylinux.org grub.ciq_rocky8,1,Rocky Linux 8 (CIQ build),grub2,@@VERSION_RELEASE@@,mailto:secureboot@ciq.com diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index acc5fd2..af012e0 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 150%{?dist}.ciq.0.1 +Release: 167%{?dist}.ciq.0.1.3 Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base License: GPLv3+ @@ -31,8 +31,12 @@ Source12: 99-grub-mkconfig.install #Source17: redhatsecureboot601.cer #Source18: redhatsecureboot701.cer Source19: sbat.csv.in -Source1100: ciq.macros -BuildRequires: system-sb-certs +Source1101: ciq_sbsign.macros +Source1102: ciq_sb_grub2.crt +Source1103: ciq_sb_ca.der +Source1104: ciq_sb_grub2_aarch64.crt + +%include %{SOURCE1101} @@ -56,6 +60,9 @@ BuildRequires: system-sb-certs # generate with do-rebase %include %{SOURCE2} +# Include ciq_sbsign macros again - they also override the secureboot cert and key values +%include %{SOURCE1101} + BuildRequires: gcc efi-srpm-macros BuildRequires: flex bison binutils python3-devel BuildRequires: ncurses-devel xz-devel bzip2-devel @@ -165,7 +172,7 @@ This subpackage provides tools for support of all platforms. %endif %prep -%global upstreamDist .el8_8 +%global upstreamDist .el8_10 #Define RHEL release (stripped out ciq/rocky dist info) and Rocky release (stripped out CIQ info) respectively. Needed for SBAT entries for RHEL and RESF: %global sbatrhelrelease %(echo '%{release}' | sed 's,%{dist},%{upstreamDist},' | sed 's,\.rocky\..*$,,' | sed 's,\.ciq\..*$,,') @@ -317,7 +324,23 @@ if [ "$1" = 1 ]; then fi if [ "$1" = 2 ]; then - /sbin/grub2-switch-to-blscfg --backup-suffix=.rpmsave &>/dev/null || : + if [ -f /etc/default/grub ]; then + ! grep -q '^GRUB_ENABLE_BLSCFG=.*' /etc/default/grub && \ + /sbin/grub2-switch-to-blscfg --backup-suffix=.rpmsave &>/dev/null || : + fi +fi + +%posttrans common +set -eu + +GRUB_HOME=/boot/%{name} + +if test -f ${GRUB_HOME}/grub.cfg; then + # make sure GRUB_HOME/grub.cfg has 600 permissions + GRUB_CFG_MODE=$(stat --format="%a" ${GRUB_HOME}/grub.cfg) + if ! test "${GRUB_CFG_MODE}" = "600"; then + chmod 0600 ${GRUB_HOME}/grub.cfg + fi fi %triggerun -- grub2 < 1:1.99-4 @@ -480,10 +503,6 @@ fi %endif %endif - -# CIQ-specific EFI packages for secure boot: -%include %{SOURCE1100} - %files tools-extra %{_sbindir}/%{name}-sparc64-setup %{_sbindir}/%{name}-ofpathname @@ -524,17 +543,103 @@ fi %endif %changelog -* Tue Jan 30 2024 Skip Grube - 2.02-150 -- Porting Rocky 8 secureboot grub2 to CIQ build - -* Fri Nov 17 2023 Release Engineering - 2.02-150.rocky.0.1 +* Thu Apr 03 2026 Linux Engineering - 2.02-167.3 +- Bump SBAT level grub,3 -> grub,5 to reflect CVE patches already present +- Port patches 0678-0683 from grub2-rl8 (Rocky Linux 8): + - Strip correctly BLS files with .conf extension + - disk: rename grub_disk_get_size() to grub_disk_native_sectors() + - fs: fix block lists not being able to address end of disk + - osdep/linux/hostdisk: modify sector size via sysfs + - cryptodisk: fix incorrect calculation of start sector + - gettext: unregister gettext command on module unload (CVE-2025-61662) + +* Tue Aug 19 2025 Linux Engineering - 2.02-167.2 +- Porting Rocky 8 secureboot grub2 to CIQ build and sign +- Update: fixed ciq-shim requirement for non x86 architectures (SECO-83) +- Update: added aarch64 certs + +* Tue Jun 03 2025 Release Engineering - 2.02-167.rocky.0.1 - Removing redhat old cert sources entries (Sherif Nagy) - Preserving rhel8 sbat entry based on shim-review feedback ticket no. 194 -- Porting to 8.9 +- Porting to 8.10 - Cleaning up grup.macro extra signing certs and updating rocky test CA and CERT - Cleaning up grup.macro extra signing certs - Use rocky-sb-certs for secure boot signing +* Thu Apr 24 2025 Leo Sandoval - 2.02-167 +- 99-grub-mkconfig.install: fix condition allowing correct checks if GRUB_ENABLE_BLSCFG is not present +- Resolves: #RHEL-80168 + +* Wed Apr 23 2025 Leo Sandoval - 2.02-166 +- Don't try to switch to a BLS config if GRUB_ENABLE_BLSCFG is already set +- Resolves: #RHEL-86913 + +* Thu Apr 17 2025 Nicolas Frayer - 2.02-165 +- fs/ext2: Rework of OOB read patch +- Resolves: #RHEL-86553 + +* Fri Apr 4 2025 Leo Sandoval - 2.02-164 +- Bump NVR to sign the build +- Resolves: #RHEL-85627 + +* Thu Apr 3 2025 Nicolas Frayer - 2.02-163 +- fs/xfs: Synced xfs to latest +- Resolves: #RHEL-85627 + +* Tue Mar 25 2025 Nicolas Frayer - 2.02-162 +- ieee1275/ofnet: Fix grub_malloc() removed after added safe +- Remove 'fs/ntfs: Implement attribute verification' patch +- Related: #RHEL-79837 + +* Tue Feb 18 2025 Leo Sandoval - 2.02-161 +- Add Several CVE fixes +- Resolves CVE-2024-45775 CVE-2025-0624 +- Resolves: #RHEL-75735 +- Resolves: #RHEL-79837 + +* Wed Nov 13 2024 Leo Sandoval - 2.02-160 +- Remove BLS fake config in case of kernel removal +- Resolves: #RHEL-4316 + +* Tue Nov 12 2024 Leo Sandoval - 2.02-159 +- Fix default behavior when GRUB_ENABLE_BLSCFG is not present +- Resolves: #RHEL-4319 + +* Thu Sep 19 2024 Leo Sandoval - 2.02-158 +- grub-mkconfig.in: turn off executable owner bit +- Resolves: #RHEL-58835 + +* Wed Aug 14 2024 Leo Sandoval - 2.02-157 +- 20-grub-install: fix SELinux security type context for BLS +- Resolves: #RHEL-4395 + +* Tue Feb 20 2024 Nicolas Frayer - 2.02-156 +- fs/ntfs: OOB write fix +- (CVE-2023-4692) +- Resolves: #RHEL-11566 + +* Thu Feb 8 2024 Nicolas Frayer - 2.06-155 +- grub-set-bootflag: Fix for CVE-2024-1048 +- (CVE-2024-1048) +- Resolves: #RHEL-20746 + +* Mon Nov 27 2023 Nicolas Frayer - 2.02-154 +- Missing install script for previous commit +- Related: #RHEL-4343 + +* Fri Nov 24 2023 Nicolas Frayer - 2.02-153 +- util: Enable default kernel for updates +- Resolves: #RHEL-4343 + +* Fri Oct 20 2023 Nicolas Frayer - 2.02-152 +- kern/ieee1275/init: ppc64: Restrict high memory in presence + of fadump +- Resolves: #RHEL-14283 + +* Mon Aug 28 2023 Nicolas Frayer - 2.02-151 +- util: Regenerate kernelopts if missing on ppc +- Resolves: #2051889 + * Fri Jun 16 2023 Nicolas Frayer - 2.02-150 - kern/ieee1275/init: sync vec5 patchset with upstream - Resolves: #2172111