46968b6e63
Resolves: CVE-2020-14372 Resolves: CVE-2020-25632 Resolves: CVE-2020-25647 Resolves: CVE-2020-27749 Resolves: CVE-2020-27779 Resolves: CVE-2021-20225 Resolves: CVE-2021-20233 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
100 lines
3.2 KiB
Diff
100 lines
3.2 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Matthew Garrett <mjg59@coreos.com>
|
|
Date: Sun, 9 Aug 2015 16:20:58 -0700
|
|
Subject: [PATCH] Rework linux16 command
|
|
|
|
We want a single buffer that contains the entire kernel image in order to
|
|
perform a TPM measurement. Allocate one and copy the entire kernel int it
|
|
before pulling out the individual blocks later on.
|
|
|
|
Signed-off-by: Matthew Garrett <mjg59@coreos.com>
|
|
---
|
|
grub-core/loader/i386/pc/linux.c | 33 +++++++++++++++++++++------------
|
|
1 file changed, 21 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
|
|
index 8be4c3b3f48..4b1750e360e 100644
|
|
--- a/grub-core/loader/i386/pc/linux.c
|
|
+++ b/grub-core/loader/i386/pc/linux.c
|
|
@@ -124,13 +124,14 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
grub_file_t file = 0;
|
|
struct linux_i386_kernel_header lh;
|
|
grub_uint8_t setup_sects;
|
|
- grub_size_t real_size;
|
|
+ grub_size_t real_size, kernel_offset = 0;
|
|
grub_ssize_t len;
|
|
int i;
|
|
char *grub_linux_prot_chunk;
|
|
int grub_linux_is_bzimage;
|
|
grub_addr_t grub_linux_prot_target;
|
|
grub_err_t err;
|
|
+ grub_uint8_t *kernel = NULL;
|
|
|
|
grub_dl_ref (my_mod);
|
|
|
|
@@ -144,7 +145,15 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
if (! file)
|
|
goto fail;
|
|
|
|
- if (grub_file_read (file, &lh, sizeof (lh)) != sizeof (lh))
|
|
+ len = grub_file_size (file);
|
|
+ kernel = grub_malloc (len);
|
|
+ if (!kernel)
|
|
+ {
|
|
+ grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("cannot allocate kernel buffer"));
|
|
+ goto fail;
|
|
+ }
|
|
+
|
|
+ if (grub_file_read (file, kernel, len) != len)
|
|
{
|
|
if (!grub_errno)
|
|
grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
@@ -152,6 +161,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
goto fail;
|
|
}
|
|
|
|
+ grub_memcpy (&lh, kernel, sizeof (lh));
|
|
+ kernel_offset = sizeof (lh);
|
|
+
|
|
if (lh.boot_flag != grub_cpu_to_le16_compile_time (0xaa55))
|
|
{
|
|
grub_error (GRUB_ERR_BAD_OS, "invalid magic number");
|
|
@@ -320,13 +332,9 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
grub_memmove (grub_linux_real_chunk, &lh, sizeof (lh));
|
|
|
|
len = real_size + GRUB_DISK_SECTOR_SIZE - sizeof (lh);
|
|
- if (grub_file_read (file, grub_linux_real_chunk + sizeof (lh), len) != len)
|
|
- {
|
|
- if (!grub_errno)
|
|
- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
- argv[0]);
|
|
- goto fail;
|
|
- }
|
|
+ grub_memcpy (grub_linux_real_chunk + sizeof (lh), kernel + kernel_offset,
|
|
+ len);
|
|
+ kernel_offset += len;
|
|
|
|
if (lh.header != grub_cpu_to_le32_compile_time (GRUB_LINUX_I386_MAGIC_SIGNATURE)
|
|
|| grub_le_to_cpu16 (lh.version) < 0x0200)
|
|
@@ -364,9 +372,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
}
|
|
|
|
len = grub_linux16_prot_size;
|
|
- if (grub_file_read (file, grub_linux_prot_chunk, len) != len && !grub_errno)
|
|
- grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
|
|
- argv[0]);
|
|
+ grub_memcpy (grub_linux_prot_chunk, kernel + kernel_offset, len);
|
|
+ kernel_offset += len;
|
|
|
|
if (grub_errno == GRUB_ERR_NONE)
|
|
{
|
|
@@ -376,6 +383,8 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
|
|
|
|
fail:
|
|
|
|
+ grub_free (kernel);
|
|
+
|
|
if (file)
|
|
grub_file_close (file);
|
|
|