Merge branch 'c10s' of https://gitlab.com/redhat/centos-stream/rpms/grub2 into more_fmf_shenanagins
This commit is contained in:
Marta Lewandowska
commit
8823254f32
@ -0,0 +1,24 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Leo Sandoval <lsandova@redhat.com>
|
||||
Date: Wed, 11 Feb 2026 15:12:10 -0600
|
||||
Subject: [PATCH] commands/search.c: check possible NULL pointer before
|
||||
dereference
|
||||
|
||||
Signed-off-by: Leo Sandoval <lsandova@redhat.com>
|
||||
---
|
||||
grub-core/commands/search.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/grub-core/commands/search.c b/grub-core/commands/search.c
|
||||
index 9dd937e6df..4677f009cd 100644
|
||||
--- a/grub-core/commands/search.c
|
||||
+++ b/grub-core/commands/search.c
|
||||
@@ -213,7 +213,7 @@ iterate_device (const char *name, void *data)
|
||||
int ret = 0;
|
||||
|
||||
get_device_uuid(name, &quid_name);
|
||||
- if (!grub_strcmp(quid_name, ctx->key))
|
||||
+ if (quid_name && !grub_strcmp(quid_name, ctx->key))
|
||||
{
|
||||
uuid_ctx.name = name;
|
||||
uuid_ctx.uuid = quid_name;
|
||||
@ -0,0 +1,81 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
||||
Date: Fri, 2 Jan 2026 16:13:13 +0530
|
||||
Subject: [PATCH] util/grub-mkimagexx: Stop generating unaligned appended
|
||||
signatures
|
||||
|
||||
When creating the core image with an unaligned appended signature size,
|
||||
e.g. 479, for PowerPC, the grub-mkimage aligns the appended signature
|
||||
size to a multiple of 4 bytes, but it does not add a padding needed to
|
||||
align to multiple of 4 bytes appended signature size in the appended
|
||||
signature ELF note. Therefore, after signing and installing this core
|
||||
image, the firmware tries to read the magic string "~Module signature
|
||||
appended~" from the appended signature ELF note but gets the partial
|
||||
magic string like "Module signature appended~". It leads to the appended
|
||||
signature magic string match failure.
|
||||
|
||||
Example:
|
||||
grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
|
||||
kernel.der --appended-signature-size 479 ...
|
||||
|
||||
sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed
|
||||
|
||||
Without padding: hexdump -C ./core.elf.signed
|
||||
...
|
||||
00383550 00 00 00 13 00 00 01 e0 41 53 69 67 41 70 70 65 |........ASigAppe|
|
||||
00383560 6e 64 65 64 2d 53 69 67 6e 61 74 75 72 65 00 00 |nded-Signature..|
|
||||
...
|
||||
003836f0 dd 47 cd ed 02 8e 15 af 5b 09 2e 44 6f da 67 88 |.G......[..Do.g.|
|
||||
00383700 4d 94 17 31 26 9d 47 95 d8 7c ad 36 00 d2 9c 53 |M..1&.G..|.6...S|
|
||||
00383710 20 e0 af 60 78 cd 22 e6 ed 45 1e b1 e7 7e cf b5 | ..`x."..E...~..|
|
||||
00383720 fc 58 ec df 1b ab 7a 00 00 02 00 00 00 00 00 00 |.X....z.........|
|
||||
00383730 00 01 b7 7e 4d 6f 64 75 6c 65 20 73 69 67 6e 61 |...~Module signa|
|
||||
00383740 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ture appended~.|
|
||||
|
||||
Fix this by adding a padding required to align appended signature size in the
|
||||
appended signature ELF note to multiple of 4 bytes.
|
||||
|
||||
Example:
|
||||
grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
|
||||
kernel.der --appended-signature-size 479 ...
|
||||
|
||||
sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed
|
||||
|
||||
With padding: hexdump -C ./core.elf.signed
|
||||
...
|
||||
00137460 62 00 00 00 00 00 00 13 00 00 01 ec 41 53 69 67 |b...........ASig|
|
||||
00137470 41 70 70 65 6e 64 65 64 2d 53 69 67 6e 61 74 75 |Appended-Signatu|
|
||||
...
|
||||
00137610 b7 07 cd b6 c8 ca 9a 5b 7c 13 8c 75 1d 1c 54 81 |.......[|..u..T.|
|
||||
00137620 7f c4 9a 8b bd d7 73 8d 2f 7d d2 e6 d1 3c 52 a9 |......s./}...<R.|
|
||||
00137630 4e 0b e5 24 ba 0a 82 aa 8e c5 86 fa e1 19 50 ec |N..$..........P.|
|
||||
00137640 9f a7 9a ed e5 ed 13 35 00 00 02 00 00 00 00 00 |.......5........|
|
||||
00137650 00 00 01 c2 7e 4d 6f 64 75 6c 65 20 73 69 67 6e |....~Module sign|
|
||||
00137660 61 74 75 72 65 20 61 70 70 65 6e 64 65 64 7e 0a |ature appended~.|
|
||||
|
||||
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
||||
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||
---
|
||||
util/grub-mkimagexx.c | 9 ++-------
|
||||
1 file changed, 2 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
|
||||
index c99c7f99c787..debd984ad51d 100644
|
||||
--- a/util/grub-mkimagexx.c
|
||||
+++ b/util/grub-mkimagexx.c
|
||||
@@ -248,13 +248,8 @@ SUFFIX (grub_mkimage_generate_elf) (const struct grub_install_image_target_desc
|
||||
if (appsig_size)
|
||||
{
|
||||
phnum++;
|
||||
- /*
|
||||
- * Rounds a appended signature size + appended signature note size up to
|
||||
- * the nearest multiple of a 4-byte alignment.
|
||||
- */
|
||||
- footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note) + appsig_size, 4);
|
||||
- /* Truncating to appended signature size. */
|
||||
- footer_size -= appsig_size;
|
||||
+ footer_size += ALIGN_UP (sizeof (struct grub_appended_signature_note), 4);
|
||||
+ footer_size += ALIGN_UP_OVERHEAD (appsig_size, 4);
|
||||
}
|
||||
|
||||
if (image_target->id != IMAGE_LOONGSON_ELF)
|
||||
61
0428-grub-mkimage-Do-not-generate-empty-SBAT-metadata.patch
Normal file
61
0428-grub-mkimage-Do-not-generate-empty-SBAT-metadata.patch
Normal file
@ -0,0 +1,61 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
||||
Date: Wed, 24 Dec 2025 17:58:59 +0530
|
||||
Subject: [PATCH] grub-mkimage: Do not generate empty SBAT metadata
|
||||
|
||||
When creating core.elf with SBAT the grub-mkimage does not check if
|
||||
an SBAT metadata file contains at least an SBAT header or not. It leads to
|
||||
adding an empty SBAT ELF note for PowerPC and the .sbat section for EFI.
|
||||
Fix this by checking the SBAT metadata file size against the SBAT header
|
||||
size before adding SBAT contents to the ELF note or .sbat section.
|
||||
|
||||
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
|
||||
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||
---
|
||||
util/mkimage.c | 12 ++++++++++--
|
||||
1 file changed, 10 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/util/mkimage.c b/util/mkimage.c
|
||||
index 5124cdbf4d01..b2c2b93ef932 100644
|
||||
--- a/util/mkimage.c
|
||||
+++ b/util/mkimage.c
|
||||
@@ -56,6 +56,9 @@
|
||||
|
||||
#pragma GCC diagnostic ignored "-Wcast-align"
|
||||
|
||||
+#define SBAT_HEADER "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md"
|
||||
+#define SBAT_HEADER_SIZE (sizeof (SBAT_HEADER))
|
||||
+
|
||||
#define TARGET_NO_FIELD 0xffffffff
|
||||
|
||||
/* use 2015-01-01T00:00:00+0000 as a stock timestamp */
|
||||
@@ -963,6 +966,12 @@ grub_install_generate_image (const char *dir, const char *prefix,
|
||||
|
||||
if (sbat_path != NULL && (image_target->id != IMAGE_EFI && image_target->id != IMAGE_PPC))
|
||||
grub_util_error (_("SBAT data can be added only to EFI or powerpc-ieee1275 images"));
|
||||
+ else if (sbat_path != NULL)
|
||||
+ {
|
||||
+ sbat_size = grub_util_get_image_size (sbat_path);
|
||||
+ if (sbat_size < SBAT_HEADER_SIZE)
|
||||
+ grub_util_error (_("%s file should contain at least an SBAT header"), sbat_path);
|
||||
+ }
|
||||
|
||||
if (appsig_size != 0 && image_target->id != IMAGE_PPC)
|
||||
grub_util_error (_("appended signature can be support only to powerpc-ieee1275 images"));
|
||||
@@ -1396,7 +1405,7 @@ grub_install_generate_image (const char *dir, const char *prefix,
|
||||
|
||||
if (sbat_path != NULL)
|
||||
{
|
||||
- sbat_size = ALIGN_ADDR (grub_util_get_image_size (sbat_path));
|
||||
+ sbat_size = ALIGN_ADDR (sbat_size);
|
||||
sbat_size = ALIGN_UP (sbat_size, GRUB_PE32_FILE_ALIGNMENT);
|
||||
}
|
||||
|
||||
@@ -1857,7 +1866,6 @@ grub_install_generate_image (const char *dir, const char *prefix,
|
||||
char *sbat = NULL;
|
||||
if (sbat_path != NULL)
|
||||
{
|
||||
- sbat_size = grub_util_get_image_size (sbat_path);
|
||||
sbat = xmalloc (sbat_size);
|
||||
grub_util_load_image (sbat_path, sbat);
|
||||
layout.sbat_size = sbat_size;
|
||||
@ -0,0 +1,72 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Mate Kukri <mate.kukri@canonical.com>
|
||||
Date: Wed, 12 Jun 2024 16:10:49 +0100
|
||||
Subject: [PATCH] kern/efi/mm: Change grub_efi_mm_add_regions() to keep track
|
||||
of map allocation size
|
||||
|
||||
If the map was too big for the initial allocation, it was freed and replaced
|
||||
with a bigger one, but the free call still used the hard-coded size.
|
||||
|
||||
Seems like this wasn't hit for a long time, because most firmware maps
|
||||
fit into 12K.
|
||||
|
||||
This bug was triggered on Project Mu firmware with a big memory map, and
|
||||
results in the heap getting trashed and the firmware ASSERTING on
|
||||
corrupted heap guard values when GRUB exits.
|
||||
|
||||
Signed-off-by: Mate Kukri <mate.kukri@canonical.com>
|
||||
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||||
---
|
||||
grub-core/kern/efi/mm.c | 14 +++++++-------
|
||||
1 file changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
|
||||
index 464fe1c3c..e37af445e 100644
|
||||
--- a/grub-core/kern/efi/mm.c
|
||||
+++ b/grub-core/kern/efi/mm.c
|
||||
@@ -687,6 +687,7 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags)
|
||||
grub_efi_memory_descriptor_t *memory_map_end;
|
||||
grub_efi_memory_descriptor_t *filtered_memory_map;
|
||||
grub_efi_memory_descriptor_t *filtered_memory_map_end;
|
||||
+ grub_efi_uintn_t alloc_size;
|
||||
grub_efi_uintn_t map_size;
|
||||
grub_efi_uintn_t desc_size;
|
||||
grub_err_t err;
|
||||
@@ -695,7 +696,8 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags)
|
||||
grub_nx_init ();
|
||||
|
||||
/* Prepare a memory region to store two memory maps. */
|
||||
- memory_map = grub_efi_allocate_any_pages (2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE));
|
||||
+ alloc_size = 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE);
|
||||
+ memory_map = grub_efi_allocate_any_pages (alloc_size);
|
||||
if (! memory_map)
|
||||
return grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate memory for memory map");
|
||||
|
||||
@@ -706,14 +708,13 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags)
|
||||
|
||||
if (mm_status == 0)
|
||||
{
|
||||
- grub_efi_free_pages
|
||||
- ((grub_efi_physical_address_t) ((grub_addr_t) memory_map),
|
||||
- 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE));
|
||||
+ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) memory_map, alloc_size);
|
||||
|
||||
/* Freeing/allocating operations may increase memory map size. */
|
||||
map_size += desc_size * 32;
|
||||
|
||||
- memory_map = grub_efi_allocate_any_pages (2 * BYTES_TO_PAGES (map_size));
|
||||
+ alloc_size = 2 * BYTES_TO_PAGES (map_size);
|
||||
+ memory_map = grub_efi_allocate_any_pages (alloc_size);
|
||||
if (! memory_map)
|
||||
return grub_error (GRUB_ERR_OUT_OF_MEMORY, "cannot allocate memory for new memory map");
|
||||
|
||||
@@ -757,8 +758,7 @@ grub_efi_mm_add_regions (grub_size_t required_bytes, unsigned int flags)
|
||||
#endif
|
||||
|
||||
/* Release the memory maps. */
|
||||
- grub_efi_free_pages ((grub_addr_t) memory_map,
|
||||
- 2 * BYTES_TO_PAGES (MEMORY_MAP_SIZE));
|
||||
+ grub_efi_free_pages ((grub_efi_physical_address_t)(grub_addr_t) memory_map, alloc_size);
|
||||
|
||||
return GRUB_ERR_NONE;
|
||||
}
|
||||
@ -469,6 +469,7 @@ if [ -x /usr/bin/rpm-sign ]; then \
|
||||
fi \
|
||||
# FIXME: using this prefix is fragile, must be done properly \
|
||||
./grub-mkimage -O %{1} -o %{2}.orig \\\
|
||||
-s %{SOURCE14} \\\
|
||||
-d grub-core \\\
|
||||
-m memdisk.squashfs \\\
|
||||
-p '/grub2' \\\
|
||||
|
||||
@ -422,3 +422,7 @@ Patch0422: 0422-normal-main-Unregister-commands-on-module-unload.patch
|
||||
Patch0423: 0423-tests-lib-functional_test-Unregister-commands-on-mod.patch
|
||||
Patch0424: 0424-commands-usbtest-Use-correct-string-length-field.patch
|
||||
Patch0425: 0425-commands-usbtest-Ensure-string-length-is-sufficient-.patch
|
||||
Patch0426: 0426-commands-search.c-check-possible-NULL-pointer-before.patch
|
||||
Patch0427: 0427-util-grub-mkimagexx-Stop-generating-unaligned-append.patch
|
||||
Patch0428: 0428-grub-mkimage-Do-not-generate-empty-SBAT-metadata.patch
|
||||
Patch0429: 0429-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch
|
||||
|
||||
35
grub2.spec
35
grub2.spec
@ -17,7 +17,7 @@
|
||||
Name: grub2
|
||||
Epoch: 1
|
||||
Version: 2.12
|
||||
Release: 39%{?dist}
|
||||
Release: 45%{?dist}
|
||||
Summary: Bootloader with support for Linux, Multiboot and more
|
||||
License: GPL-3.0-or-later
|
||||
URL: http://www.gnu.org/software/grub/
|
||||
@ -36,13 +36,18 @@ Source10: 20-grub.install
|
||||
Source11: grub.patches
|
||||
Source12: sbat.csv.in
|
||||
Source13: gen_grub_cfgstub
|
||||
Source14: sbat.ppc.csv
|
||||
|
||||
%include %{SOURCE1}
|
||||
|
||||
%ifarch x86_64 aarch64 ppc64le
|
||||
%ifarch x86_64 aarch64
|
||||
%define sb_ca %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
|
||||
%define sb_cer %{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
|
||||
%endif
|
||||
%ifarch ppc64le
|
||||
%define sb_ca %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
|
||||
%define sb_cer %{_datadir}/pki/sb-certs/secureboot-kernel-%{_arch}.cer
|
||||
%endif
|
||||
|
||||
%if 0%{?centos}
|
||||
|
||||
@ -574,10 +579,34 @@ fi
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Feb 10 2026 Marta Lewandowska <mlewando@redhat.com> - 2.12-39
|
||||
* Tue Feb 10 2026 Marta Lewandowska <mlewando@redhat.com> - 2.12-45
|
||||
- Try to get gating tests running via fmf/tmt
|
||||
- Resolves: #RHEL-147757
|
||||
|
||||
* Mon Mar 09 2026 Josue Hernandez <josherna@redhat.com> 2.12-44
|
||||
- kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size
|
||||
- Resolves: #RHEL-148309
|
||||
|
||||
* Mon Mar 09 2026 Nicolas Frayer <nfrayer@redhat.com> 2.12-43
|
||||
- Bump release
|
||||
- Related: #RHEL-146590
|
||||
|
||||
* Thu Feb 26 2026 Nicolas Frayer <nfrayer@redhat.com> 2.12-42
|
||||
- ppc64le/sbat: Add an sbat CSV file for ppc64le
|
||||
- Resolves: #RHEL-146590
|
||||
|
||||
* Fri Feb 13 2026 Marta Lewandowska <mlewando@redhat.com> 2.12-41
|
||||
- ppc64le: Pointing to the right cert after redhat-release change
|
||||
- Related: #RHEL-24510
|
||||
|
||||
* Fri Feb 13 2026 Nicolas Frayer <nfrayer@redhat.com> - 2.12-40
|
||||
- ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat
|
||||
- Related: #RHEL-24510
|
||||
|
||||
* Wed Feb 11 2026 Leo Sandoval <lsandova@redhat.com> - 2.12-39
|
||||
- commands/search.c: check possible NULL pointer before dereference
|
||||
- Resolves: #RHEL-146317
|
||||
|
||||
* Wed Feb 4 2026 Nicolas Frayer <nfrayer@redhat.com> - 2.12-38
|
||||
- Fix several security issues about module unloading and file handling
|
||||
- Resolves: #RHEL-141581
|
||||
|
||||
1
sbat.ppc.csv
Executable file
1
sbat.ppc.csv
Executable file
@ -0,0 +1 @@
|
||||
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
|
||||
|
Loading…
Reference in New Issue
Block a user