dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0151-Initialized-initrd_ctx-so-we-don-t-free-a-random-poi.patch

4fe85b
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
4fe85b
From: Peter Jones <pjones@redhat.com>
4fe85b
Date: Wed, 17 Sep 2014 15:13:14 -0500
4fe85b
Subject: [PATCH] Initialized initrd_ctx so we don't free a random pointer from
4fe85b
 the stack.
4fe85b
4fe85b
Currently, if "linux" fails, the "goto fail;" in grub_cmd_initrd sends us
4fe85b
into grub_initrd_close() without grub_initrd_init() being called, and thus
4fe85b
it never clears initrd_ctx->components.  grub_initrd_close() then frees that
4fe85b
address, which is stale data from the stack.  If the stack happens to have a
4fe85b
stale *address* there that matches a recent allocation, then you'll get a
4fe85b
double free later.
4fe85b
4fe85b
So initialize the memory up front.
4fe85b
4fe85b
Signed-off-by: Peter Jones <pjones@redhat.com>
4fe85b
---
4fe85b
 grub-core/loader/arm/linux.c              | 2 +-
4fe85b
 grub-core/loader/arm64/linux.c            | 2 +-
4fe85b
 grub-core/loader/i386/linux.c             | 2 +-
4fe85b
 grub-core/loader/i386/pc/linux.c          | 2 +-
4fe85b
 grub-core/loader/ia64/efi/linux.c         | 2 +-
4fe85b
 grub-core/loader/mips/linux.c             | 2 +-
4fe85b
 grub-core/loader/powerpc/ieee1275/linux.c | 2 +-
4fe85b
 grub-core/loader/sparc64/ieee1275/linux.c | 2 +-
4fe85b
 8 files changed, 8 insertions(+), 8 deletions(-)
4fe85b
4fe85b
diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
4fe85b
index e6770d96d29..62cbe75d34e 100644
4fe85b
--- a/grub-core/loader/arm/linux.c
4fe85b
+++ b/grub-core/loader/arm/linux.c
4fe85b
@@ -396,7 +396,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
 {
4fe85b
   grub_file_t file;
4fe85b
   grub_size_t size = 0;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
4fe85b
diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
4fe85b
index f1d10a16492..0dc144e5da0 100644
4fe85b
--- a/grub-core/loader/arm64/linux.c
4fe85b
+++ b/grub-core/loader/arm64/linux.c
4fe85b
@@ -328,7 +328,7 @@ static grub_err_t
4fe85b
 grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
 		 int argc, char *argv[])
4fe85b
 {
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
   int initrd_size, initrd_pages;
4fe85b
   void *initrd_mem = NULL;
4fe85b
 
4fe85b
diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
4fe85b
index 31fb91e2c73..2ae176315b6 100644
4fe85b
--- a/grub-core/loader/i386/linux.c
4fe85b
+++ b/grub-core/loader/i386/linux.c
4fe85b
@@ -1050,7 +1050,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
   grub_addr_t addr_min, addr_max;
4fe85b
   grub_addr_t addr;
4fe85b
   grub_err_t err;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     {
4fe85b
diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
4fe85b
index 672c013e74d..b481e466846 100644
4fe85b
--- a/grub-core/loader/i386/pc/linux.c
4fe85b
+++ b/grub-core/loader/i386/pc/linux.c
4fe85b
@@ -388,7 +388,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
   grub_uint8_t *initrd_chunk;
4fe85b
   grub_addr_t initrd_addr;
4fe85b
   grub_err_t err;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     {
4fe85b
diff --git a/grub-core/loader/ia64/efi/linux.c b/grub-core/loader/ia64/efi/linux.c
4fe85b
index 87ac49f8c3b..eb78e6e626b 100644
4fe85b
--- a/grub-core/loader/ia64/efi/linux.c
4fe85b
+++ b/grub-core/loader/ia64/efi/linux.c
4fe85b
@@ -568,7 +568,7 @@ static grub_err_t
4fe85b
 grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
 		 int argc, char *argv[])
4fe85b
 {
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     {
4fe85b
diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c
4fe85b
index ef64a5b1d36..4a3e8c5dfa2 100644
4fe85b
--- a/grub-core/loader/mips/linux.c
4fe85b
+++ b/grub-core/loader/mips/linux.c
4fe85b
@@ -415,7 +415,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
   void *initrd_src;
4fe85b
   grub_addr_t initrd_dest;
4fe85b
   grub_err_t err;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
4fe85b
diff --git a/grub-core/loader/powerpc/ieee1275/linux.c b/grub-core/loader/powerpc/ieee1275/linux.c
4fe85b
index 4a14f66dee5..787d7dc2af3 100644
4fe85b
--- a/grub-core/loader/powerpc/ieee1275/linux.c
4fe85b
+++ b/grub-core/loader/powerpc/ieee1275/linux.c
4fe85b
@@ -333,7 +333,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
   grub_size_t size = 0;
4fe85b
   grub_addr_t first_addr;
4fe85b
   grub_addr_t addr;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     {
4fe85b
diff --git a/grub-core/loader/sparc64/ieee1275/linux.c b/grub-core/loader/sparc64/ieee1275/linux.c
4fe85b
index de6ee2f75ed..c5e8dfab234 100644
4fe85b
--- a/grub-core/loader/sparc64/ieee1275/linux.c
4fe85b
+++ b/grub-core/loader/sparc64/ieee1275/linux.c
4fe85b
@@ -373,7 +373,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
4fe85b
   grub_addr_t paddr;
4fe85b
   grub_addr_t addr;
4fe85b
   int ret;
4fe85b
-  struct grub_linux_initrd_context initrd_ctx;
4fe85b
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
4fe85b
 
4fe85b
   if (argc == 0)
4fe85b
     {