From 49610f868a0ffb4b4f24c02bf8b23ce86f7259f9 Mon Sep 17 00:00:00 2001 From: Josue Hernandez Date: Fri, 27 Feb 2026 15:05:44 -0600 Subject: [PATCH] kern/efi/mm: Change to keep track of map allocation size Resolves: #RHEL-148309 Signed-off-by: Josue Hernandez --- ...ge-grub_efi_mm_add_regions-to-keep-t.patch | 72 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 6 +- 3 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch diff --git a/0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch b/0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch new file mode 100644 index 0000000..aa8e8da --- /dev/null +++ b/0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch @@ -0,0 +1,72 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Mate Kukri +Date: Wed, 12 Jun 2024 16:10:49 +0100 +Subject: [PATCH] kern/efi/mm: Change grub_efi_mm_add_regions() to keep track + of map allocation size + +If the map was too big for the initial allocation, it was freed and replaced +with a bigger one, but the free call still used the hard-coded size. + +Seems like this wasn't hit for a long time, because most firmware maps +fit into 12K. + +This bug was triggered on Project Mu firmware with a big memory map, and +results in the heap getting trashed and the firmware ASSERTING on +corrupted heap guard values when GRUB exits. + +Signed-off-by: Mate Kukri +Reviewed-by: Daniel Kiper +--- + grub-core/kern/efi/mm.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c +index 464fe1c3c..e37af445e 100644 +--- a/grub-core/kern/efi/mm.c ++++ b/grub-core/kern/efi/mm.c +@@ -687,6 +687,7 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + grub_efi_memory_descriptor_t *memory_map_end; + grub_efi_memory_descriptor_t *filtered_memory_map; + grub_efi_memory_descriptor_t *filtered_memory_map_end; ++ grub_efi_uintn_t alloc_size; + grub_efi_uintn_t map_size; + grub_efi_uintn_t desc_size; + grub_err_t err; +@@ -695,7 +696,8 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + grub_nx_init (); + + /* Prepare a memory region to store two memory maps. */ +- memory_map = grub_efi_allocate_any_pages (2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE)); ++ alloc_size = 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE); ++ memory_map = grub_efi_allocate_any_pages (alloc_size); + if (! memory_map) + return grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate memory for memory map"); + +@@ -706,14 +708,13 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + + if (mm_status == 0) + { +- grub_efi_free_pages +- ((grub_efi_physical_address_t) ((grub_addr_t) memory_map), +- 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) memory_map, alloc_size); + + /* Freeing/allocating operations may increase memory map size. */ + map_size += desc_size * 32; + +- memory_map = grub_efi_allocate_any_pages (2 * BYTES_TO_PAGES (map_size)); ++ alloc_size = 2 * BYTES_TO_PAGES (map_size); ++ memory_map = grub_efi_allocate_any_pages (alloc_size); + if (! memory_map) + return grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate memory for new memory map"); + +@@ -757,8 +758,7 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags) + #endif + + /* Release the memory maps. */ +- grub_efi_free_pages ((grub_addr_t) memory_map, +- 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE)); ++ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) memory_map, alloc_size); + + return GRUB_ERR_NONE; + } diff --git a/grub.patches b/grub.patches index 0705946..2fc0816 100644 --- a/grub.patches +++ b/grub.patches @@ -425,3 +425,4 @@ Patch0425: 0425-commands-usbtest-Ensure-string-length-is-sufficient-.patch Patch0426: 0426-commands-search.c-check-possible-NULL-pointer-before.patch Patch0427: 0427-util-grub-mkimagexx-Stop-generating-unaligned-append.patch Patch0428: 0428-grub-mkimage-Do-not-generate-empty-SBAT-metadata.patch +Patch0429: 0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch diff --git a/grub2.spec b/grub2.spec index a3d9024..06b692a 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 43%{?dist} +Release: 44%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -579,6 +579,10 @@ fi %endif %changelog +* Mon Mar 09 2026 Josue Hernandez 2.12-44 +- kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size +- Resolves: #RHEL-148309 + * Mon Mar 09 2026 Nicolas Frayer 2.12-43 - Bump release - Related: #RHEL-146590