grub2/SOURCES/0506-loader-i386-efi-linux-Use-grub_loader_set_ex.patch

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Chris Coulson <chris.coulson@canonical.com>
Date: Mon, 2 May 2022 17:04:23 +0200
Subject: [PATCH] loader/i386/efi/linux: Use grub_loader_set_ex

This ports the linuxefi loader to use grub_loader_set_ex in order to fix
a use-after-fre bug that occurs when grub_cmd_linux is executed more than
once before a boot attempt is performed.

This is more complicated than for the chainloader command, as the initrd
command needs access to the loader state. To solve this, the linuxefi
module registers a dummy initrd command at startup that returns an error.
The linuxefi command then registers a proper initrd command with a higher
priority that is passed the loader state.

Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
(cherry picked from commit 7cf736436b4c934df5ddfa6f44b46a7e07d99fdc)
[rharwood/pjones: set kernel_size in context]
(cherry picked from commit 9c056391f7a36ea480de9a759c12e55a90f2040a)
[rharwood: verifying twice]
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
(cherry picked from commit df804892f1a754d88a9779320f9429bf40d2a1b3)
(cherry picked from commit d1b506f6c910b96ad47a20247b438c6402a74948)
---
 grub-core/loader/i386/efi/linux.c | 146 +++++++++++++++++++++++---------------
 1 file changed, 87 insertions(+), 59 deletions(-)

diff --git a/grub-core/loader/i386/efi/linux.c b/grub-core/loader/i386/efi/linux.c
index c9a2b47370..77a0734786 100644
--- a/grub-core/loader/i386/efi/linux.c
+++ b/grub-core/loader/i386/efi/linux.c
@@ -34,13 +34,19 @@
 GRUB_MOD_LICENSE ("GPLv3+");
 
 static grub_dl_t my_mod;
-static int loaded;
-static void *kernel_mem;
-static grub_uint64_t kernel_size;
-static void *initrd_mem;
-static grub_uint32_t handover_offset;
-struct linux_kernel_params *params;
-static char *linux_cmdline;
+
+static grub_command_t cmd_linux, cmd_initrd;
+static grub_command_t cmd_linuxefi, cmd_initrdefi;
+
+struct grub_linuxefi_context {
+  void *kernel_mem;
+  grub_uint64_t kernel_size;
+  grub_uint32_t handover_offset;
+  struct linux_kernel_params *params;
+  char *cmdline;
+
+  void *initrd_mem;
+};
 
 #define MIN(a, b) \
   ({ typeof (a) _a = (a); \
@@ -123,25 +129,32 @@ kernel_alloc(grub_efi_uintn_t size, const char * const errmsg)
 }
 
 static grub_err_t
-grub_linuxefi_boot (void)
+grub_linuxefi_boot (void *data)
 {
+  struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) data;
+
   asm volatile ("cli");
 
-  return grub_efi_linux_boot ((char *)kernel_mem,
-			      handover_offset,
-			      params);
+  return grub_efi_linux_boot ((char *)context->kernel_mem,
+			      context->handover_offset,
+			      context->params);
 }
 
 static grub_err_t
-grub_linuxefi_unload (void)
+grub_linuxefi_unload (void *data)
 {
+  struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) data;
+  struct linux_kernel_params *params = context->params;
+
   grub_dl_unref (my_mod);
-  loaded = 0;
 
-  kernel_free(initrd_mem, params->ramdisk_size);
-  kernel_free(linux_cmdline, params->cmdline_size + 1);
-  kernel_free(kernel_mem, kernel_size);
-  kernel_free(params, sizeof(*params));
+  kernel_free (context->initrd_mem, params->ramdisk_size);
+  kernel_free (context->cmdline, params->cmdline_size + 1);
+  kernel_free (context->kernel_mem, context->kernel_size);
+  kernel_free (params, sizeof(*params));
+  cmd_initrd->data = 0;
+  cmd_initrdefi->data = 0;
+  grub_free (context);
 
   return GRUB_ERR_NONE;
 }
@@ -188,13 +201,14 @@ read(grub_file_t file, grub_uint8_t *bufp, grub_size_t len)
 #define HIGH_U32(val) ((grub_uint32_t)(((grub_addr_t)(val) >> 32) & 0xffffffffull))
 
 static grub_err_t
-grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
-                 int argc, char *argv[])
+grub_cmd_initrd (grub_command_t cmd, int argc, char *argv[])
 {
   grub_file_t *files = 0;
   int i, nfiles = 0;
   grub_size_t size = 0;
   grub_uint8_t *ptr;
+  struct grub_linuxefi_context *context = (struct grub_linuxefi_context *) cmd->data;
+  struct linux_kernel_params *params;
 
   if (argc == 0)
     {
@@ -202,12 +216,14 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
       goto fail;
     }
 
-  if (!loaded)
+  if (!context)
     {
       grub_error (GRUB_ERR_BAD_ARGUMENT, N_("you need to load the kernel first"));
       goto fail;
     }
 
+  params = context->params;
+
   files = grub_calloc (argc, sizeof (files[0]));
   if (!files)
     goto fail;
@@ -226,19 +242,19 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
 	}
     }
 
-  initrd_mem = kernel_alloc(size, N_("can't allocate initrd"));
-  if (initrd_mem == NULL)
+  context->initrd_mem = kernel_alloc(size, N_("can't allocate initrd"));
+  if (context->initrd_mem == NULL)
     goto fail;
-  grub_dprintf ("linux", "initrd_mem = %p\n", initrd_mem);
+  grub_dprintf ("linux", "initrd_mem = %p\n", context->initrd_mem);
 
   params->ramdisk_size = LOW_U32(size);
-  params->ramdisk_image = LOW_U32(initrd_mem);
+  params->ramdisk_image = LOW_U32(context->initrd_mem);
 #if defined(__x86_64__)
   params->ext_ramdisk_size = HIGH_U32(size);
-  params->ext_ramdisk_image = HIGH_U32(initrd_mem);
+  params->ext_ramdisk_image = HIGH_U32(context->initrd_mem);
 #endif
 
-  ptr = initrd_mem;
+  ptr = context->initrd_mem;
 
   for (i = 0; i < nfiles; i++)
     {
@@ -264,8 +280,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
     grub_file_close (files[i]);
   grub_free (files);
 
-  if (initrd_mem && grub_errno)
-    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)initrd_mem,
+  if (context->initrd_mem && grub_errno)
+    grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t)context->initrd_mem,
 			 BYTES_TO_PAGES(size));
 
   return grub_errno;
@@ -281,6 +297,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
   void *kernel = NULL;
   int setup_header_end_offset;
   int rc;
+  void *kernel_mem = 0;
+  grub_uint64_t kernel_size = 0;
+  grub_uint32_t handover_offset;
+  struct linux_kernel_params *params = 0;
+  char *cmdline = 0;
+  struct grub_linuxefi_context *context = 0;
 
   grub_dl_ref (my_mod);
 
@@ -407,27 +429,27 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
   grub_dprintf ("linux", "new lh is at %p\n", lh);
 
   grub_dprintf ("linux", "setting up cmdline\n");
-  linux_cmdline = kernel_alloc (lh->cmdline_size + 1, N_("can't allocate cmdline"));
-  if (!linux_cmdline)
+  cmdline = kernel_alloc (lh->cmdline_size + 1, N_("can't allocate cmdline"));
+  if (!cmdline)
     goto fail;
-  grub_dprintf ("linux", "linux_cmdline = %p\n", linux_cmdline);
+  grub_dprintf ("linux", "cmdline = %p\n", cmdline);
 
-  grub_memcpy (linux_cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE));
+  grub_memcpy (cmdline, LINUX_IMAGE, sizeof (LINUX_IMAGE));
   grub_create_loader_cmdline (argc, argv,
-                              linux_cmdline + sizeof (LINUX_IMAGE) - 1,
+                              cmdline + sizeof (LINUX_IMAGE) - 1,
 			      lh->cmdline_size - (sizeof (LINUX_IMAGE) - 1),
 			      GRUB_VERIFY_KERNEL_CMDLINE);
 
-  grub_dprintf ("linux", "cmdline:%s\n", linux_cmdline);
+  grub_dprintf ("linux", "cmdline:%s\n", cmdline);
   grub_dprintf ("linux", "setting lh->cmd_line_ptr to 0x%08x\n",
-		LOW_U32(linux_cmdline));
-  lh->cmd_line_ptr = LOW_U32(linux_cmdline);
+		LOW_U32(cmdline));
+  lh->cmd_line_ptr = LOW_U32(cmdline);
 #if defined(__x86_64__)
-  if ((grub_efi_uintn_t)linux_cmdline > 0xffffffffull)
+  if ((grub_efi_uintn_t)cmdline > 0xffffffffull)
     {
       grub_dprintf ("linux", "setting params->ext_cmd_line_ptr to 0x%08x\n",
-		    HIGH_U32(linux_cmdline));
-      params->ext_cmd_line_ptr = HIGH_U32(linux_cmdline);
+		    HIGH_U32(cmdline));
+      params->ext_cmd_line_ptr = HIGH_U32(cmdline);
     }
 #endif
 
@@ -452,16 +474,13 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
     }
   max_addresses[1].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS;
   max_addresses[2].addr = GRUB_EFI_MAX_ALLOCATION_ADDRESS;
-  kernel_mem = kernel_alloc (lh->init_size, N_("can't allocate kernel"));
+  kernel_size = lh->init_size;
+  kernel_mem = kernel_alloc (kernel_size, N_("can't allocate kernel"));
   restore_addresses();
   if (!kernel_mem)
     goto fail;
   grub_dprintf("linux", "kernel_mem = %p\n", kernel_mem);
 
-  grub_loader_set (grub_linuxefi_boot, grub_linuxefi_unload, 0);
-
-  loaded = 1;
-
   grub_dprintf ("linux", "setting lh->code32_start to 0x%08x\n",
 		LOW_U32(kernel_mem));
   lh->code32_start = LOW_U32(kernel_mem);
@@ -478,33 +497,42 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
 		"setting lh->ext_loader_{type,ver} = {0x%02x,0x%02x}\n",
 		params->ext_loader_type, params->ext_loader_ver);
 
+  context = grub_zalloc (sizeof (*context));
+  if (!context)
+    goto fail;
+  context->kernel_mem = kernel_mem;
+  context->kernel_size = kernel_size;
+  context->handover_offset = handover_offset;
+  context->params = params;
+  context->cmdline = cmdline;
+
+  grub_loader_set_ex (grub_linuxefi_boot, grub_linuxefi_unload, context, 0);
+
+  cmd_initrd->data = context;
+  cmd_initrdefi->data = context;
+
+  grub_file_close (file);
+  grub_free (kernel);
+  return 0;
+
 fail:
   if (file)
     grub_file_close (file);
 
-  if (grub_errno != GRUB_ERR_NONE)
-    {
-      grub_dl_unref (my_mod);
-      loaded = 0;
-    }
+  grub_dl_unref (my_mod);
 
-  if (!loaded)
-    {
-      if (lh)
-	kernel_free (linux_cmdline, lh->cmdline_size + 1);
+  if (lh)
+    kernel_free (cmdline, lh->cmdline_size + 1);
 
-      kernel_free (kernel_mem, kernel_size);
-      kernel_free (params, sizeof(*params));
-    }
+  kernel_free (kernel_mem, kernel_size);
+  kernel_free (params, sizeof(*params));
 
+  grub_free (context);
   grub_free (kernel);
 
   return grub_errno;
 }
 
-static grub_command_t cmd_linux, cmd_initrd;
-static grub_command_t cmd_linuxefi, cmd_initrdefi;
-
 GRUB_MOD_INIT(linux)
 {
   cmd_linux =