From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Alexey Makhalov <amakhalov@vmware.com>

Date: Wed, 8 Jul 2020 01:44:38 +0000

Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_align()

 max_addr against integer underflow

This commit introduces integer underflow mitigation in max_addr calculation

in grub_relocator_alloc_chunk_align() invocation.

It consists of 2 fixes:

  1. Introduced grub_relocator_alloc_chunk_align_safe() wrapper function to perform

     sanity check for min/max and size values, and to make safe invocation of

     grub_relocator_alloc_chunk_align() with validated max_addr value. Replace all

     invocations such as grub_relocator_alloc_chunk_align(..., min_addr, max_addr - size, size, ...)

     by grub_relocator_alloc_chunk_align_safe(..., min_addr, max_addr, size, ...).

  2. Introduced UP_TO_TOP32(s) macro for the cases where max_addr is 32-bit top

     address (0xffffffff - size + 1) or similar.

Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>

Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Upstream-commit-id: 10498c8ba17

---

 grub-core/lib/i386/relocator.c        | 28 +++++++++++-----------------

 grub-core/lib/mips/relocator.c        |  6 ++----

 grub-core/lib/powerpc/relocator.c     |  6 ++----

 grub-core/loader/i386/linux.c         |  5 ++---

 grub-core/loader/i386/multiboot_mbi.c |  7 +++----

 grub-core/loader/i386/pc/linux.c      |  6 ++----

 grub-core/loader/mips/linux.c         |  9 +++------

 grub-core/loader/multiboot.c          |  2 +-

 grub-core/loader/multiboot_elfxx.c    |  5 ++---

 grub-core/loader/multiboot_mbi2.c     | 11 +++++++----

 grub-core/loader/xnu_resume.c         |  2 +-

 include/grub/relocator.h              | 29 +++++++++++++++++++++++++++++

 12 files changed, 65 insertions(+), 51 deletions(-)

diff --git a/grub-core/lib/i386/relocator.c b/grub-core/lib/i386/relocator.c

index ffaf25f088d..08f6821f20c 100644

--- a/grub-core/lib/i386/relocator.c

+++ b/grub-core/lib/i386/relocator.c

@@ -84,11 +84,10 @@ grub_relocator32_boot (struct grub_relocator *rel,

   /* Specific memory range due to Global Descriptor Table for use by payload

      that we will store in returned chunk.  The address range and preference

      are based on "THE LINUX/x86 BOOT PROTOCOL" specification.  */

-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0x1000,

-					  0x9a000 - RELOCATOR_SIZEOF (32),

-					  RELOCATOR_SIZEOF (32), 16,

-					  GRUB_RELOCATOR_PREFERENCE_LOW,

-					  avoid_efi_bootservices);

+  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x1000, 0x9a000,

+					       RELOCATOR_SIZEOF (32), 16,

+					       GRUB_RELOCATOR_PREFERENCE_LOW,

+					       avoid_efi_bootservices);

   if (err)

     return err;

@@ -126,13 +125,10 @@ grub_relocator16_boot (struct grub_relocator *rel,

   grub_relocator_chunk_t ch;

   /* Put it higher than the byte it checks for A20 check.  */

-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0x8010,

-					  0xa0000 - RELOCATOR_SIZEOF (16)

-					  - GRUB_RELOCATOR16_STACK_SIZE,

-					  RELOCATOR_SIZEOF (16)

-					  + GRUB_RELOCATOR16_STACK_SIZE, 16,

-					  GRUB_RELOCATOR_PREFERENCE_NONE,

-					  0);

+  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x8010, 0xa0000,

+					       RELOCATOR_SIZEOF (16) +

+					       GRUB_RELOCATOR16_STACK_SIZE, 16,

+					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);

   if (err)

     return err;

@@ -184,11 +180,9 @@ grub_relocator64_boot (struct grub_relocator *rel,

   void *relst;

   grub_relocator_chunk_t ch;

-  err = grub_relocator_alloc_chunk_align (rel, &ch, min_addr,

-					  max_addr - RELOCATOR_SIZEOF (64),

-					  RELOCATOR_SIZEOF (64), 16,

-					  GRUB_RELOCATOR_PREFERENCE_NONE,

-					  0);

+  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, min_addr, max_addr,

+					       RELOCATOR_SIZEOF (64), 16,

+					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);

   if (err)

     return err;

diff --git a/grub-core/lib/mips/relocator.c b/grub-core/lib/mips/relocator.c

index 9d5f49cb93a..743b213e695 100644

--- a/grub-core/lib/mips/relocator.c

+++ b/grub-core/lib/mips/relocator.c

@@ -120,10 +120,8 @@ grub_relocator32_boot (struct grub_relocator *rel,

   unsigned i;

   grub_addr_t vtarget;

-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0,

-					  (0xffffffff - stateset_size)

-					  + 1, stateset_size,

-					  sizeof (grub_uint32_t),

+  err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),

+					  stateset_size, sizeof (grub_uint32_t),

 					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);

   if (err)

     return err;

diff --git a/grub-core/lib/powerpc/relocator.c b/grub-core/lib/powerpc/relocator.c

index bdf2b111be7..8ffb8b68683 100644

--- a/grub-core/lib/powerpc/relocator.c

+++ b/grub-core/lib/powerpc/relocator.c

@@ -115,10 +115,8 @@ grub_relocator32_boot (struct grub_relocator *rel,

   unsigned i;

   grub_relocator_chunk_t ch;

-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0,

-					  (0xffffffff - stateset_size)

-					  + 1, stateset_size,

-					  sizeof (grub_uint32_t),

+  err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),

+					  stateset_size, sizeof (grub_uint32_t),

 					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);

   if (err)

     return err;

diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c

index 1a36979a5ec..8531ca17437 100644

--- a/grub-core/loader/i386/linux.c

+++ b/grub-core/loader/i386/linux.c

@@ -230,9 +230,8 @@ allocate_pages (grub_size_t prot_size, grub_size_t *align,

 	for (; err && *align + 1 > min_align; (*align)--)

 	  {

 	    grub_errno = GRUB_ERR_NONE;

-	    err = grub_relocator_alloc_chunk_align (relocator, &ch,

-						    0x1000000,

-						    0xffffffff & ~prot_size,

+	    err = grub_relocator_alloc_chunk_align (relocator, &ch, 0x1000000,

+						    UP_TO_TOP32 (prot_size),

 						    prot_size, 1 << *align,

 						    GRUB_RELOCATOR_PREFERENCE_LOW,

 						    1);

diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c

index f10c087f724..adda5fd3a87 100644

--- a/grub-core/loader/i386/multiboot_mbi.c

+++ b/grub-core/loader/i386/multiboot_mbi.c

@@ -445,10 +445,9 @@ grub_multiboot_make_mbi (grub_uint32_t *target)

   bufsize = grub_multiboot_get_mbi_size ();

-  err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch,

-					  0x10000, 0xa0000 - bufsize,

-					  bufsize, 4,

-					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);

+  err = grub_relocator_alloc_chunk_align_safe (grub_multiboot_relocator, &ch,

+					       0x10000, 0xa0000, bufsize, 4,

+					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);

   if (err)

     return err;

   ptrorig = get_virtual_current_address (ch);

diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c

index 4a801a7ab08..f217f5071b6 100644

--- a/grub-core/loader/i386/pc/linux.c

+++ b/grub-core/loader/i386/pc/linux.c

@@ -457,10 +457,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),

   {

     grub_relocator_chunk_t ch;

-    err = grub_relocator_alloc_chunk_align (relocator, &ch,

-					    addr_min, addr_max - size,

-					    size, 0x1000,

-					    GRUB_RELOCATOR_PREFERENCE_HIGH, 0);

+    err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, addr_min, addr_max, size,

+						 0x1000, GRUB_RELOCATOR_PREFERENCE_HIGH, 0);

     if (err)

       return err;

     initrd_chunk = get_virtual_current_address (ch);

diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c

index 4a3e8c5dfa2..f4bfd1d8b20 100644

--- a/grub-core/loader/mips/linux.c

+++ b/grub-core/loader/mips/linux.c

@@ -434,12 +434,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),

   {

     grub_relocator_chunk_t ch;

-    err = grub_relocator_alloc_chunk_align (relocator, &ch,

-					    (target_addr & 0x1fffffff)

-					    + linux_size + 0x10000,

-					    (0x10000000 - size),

-					    size, 0x10000,

-					    GRUB_RELOCATOR_PREFERENCE_NONE, 0);

+    err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, (target_addr & 0x1fffffff) +

+						 linux_size + 0x10000, 0x10000000, size,

+						 0x10000, GRUB_RELOCATOR_PREFERENCE_NONE, 0);

     if (err)

       goto fail;

diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c

index e4e696e8f89..e2d3a8b5b2e 100644

--- a/grub-core/loader/multiboot.c

+++ b/grub-core/loader/multiboot.c

@@ -343,7 +343,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),

   {

     grub_relocator_chunk_t ch;

     err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch,

-					    lowest_addr, (0xffffffff - size) + 1,

+					    lowest_addr, UP_TO_TOP32 (size),

 					    size, MULTIBOOT_MOD_ALIGN,

 					    GRUB_RELOCATOR_PREFERENCE_NONE, 1);

     if (err)

diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c

index c0ff1239dbf..6d87f08976f 100644

--- a/grub-core/loader/multiboot_elfxx.c

+++ b/grub-core/loader/multiboot_elfxx.c

@@ -201,9 +201,8 @@ CONCAT(grub_multiboot_load_elf, XX) (grub_file_t file, const char *filename, voi

 	    grub_relocator_chunk_t ch;

 	    err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator,

 						    &ch, 0,

-						    (0xffffffff - sh->sh_size)

-						    + 1, sh->sh_size,

-						    sh->sh_addralign,

+						    UP_TO_TOP32 (sh->sh_size),

+						    sh->sh_size, sh->sh_addralign,

 						    GRUB_RELOCATOR_PREFERENCE_NONE,

 						    0);

 	    if (err)

diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c

index 7e01dfb5ee7..e99d3177a4a 100644

--- a/grub-core/loader/multiboot_mbi2.c

+++ b/grub-core/loader/multiboot_mbi2.c

@@ -235,15 +235,18 @@ grub_multiboot_load (grub_file_t file, const char *filename)

       grub_size_t code_size;

       void *source;

       grub_relocator_chunk_t ch;

+      int preference = GRUB_RELOCATOR_PREFERENCE_NONE;

       if (addr_tag->bss_end_addr)

 	code_size = (addr_tag->bss_end_addr - load_addr);

       else

 	code_size = load_size;

-      err = grub_relocator_alloc_chunk_addr (grub_multiboot_relocator, 

-					     &ch, load_addr,

-					     code_size);

+      err = grub_relocator_alloc_chunk_align_safe (grub_multiboot_relocator,

+						   &ch, load_addr,

+						   UP_TO_TOP32(load_addr),

+						   code_size, 0, preference,

+						   keep_bs);

       if (err)

 	{

 	  grub_dprintf ("multiboot_loader", "Error loading aout kludge\n");

@@ -647,7 +650,7 @@ grub_multiboot_make_mbi (grub_uint32_t *target)

   COMPILE_TIME_ASSERT (MULTIBOOT_TAG_ALIGN % sizeof (grub_properly_aligned_t) == 0);

   err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch,

-					  0, 0xffffffff - bufsize,

+					  0, UP_TO_TOP32 (bufsize),

 					  bufsize, MULTIBOOT_TAG_ALIGN,

 					  GRUB_RELOCATOR_PREFERENCE_NONE, 1);

   if (err)

diff --git a/grub-core/loader/xnu_resume.c b/grub-core/loader/xnu_resume.c

index 534a74438b2..99119558d21 100644

--- a/grub-core/loader/xnu_resume.c

+++ b/grub-core/loader/xnu_resume.c

@@ -129,7 +129,7 @@ grub_xnu_resume (char *imagename)

   {

     grub_relocator_chunk_t ch;

     err = grub_relocator_alloc_chunk_align (grub_xnu_relocator, &ch, 0,

-					    (0xffffffff - hibhead.image_size) + 1,

+					    UP_TO_TOP32 (hibhead.image_size),

 					    hibhead.image_size,

 					    GRUB_XNU_PAGESIZE,

 					    GRUB_RELOCATOR_PREFERENCE_NONE, 0);

diff --git a/include/grub/relocator.h b/include/grub/relocator.h

index 24d8672d22c..1b3bdd92ac6 100644

--- a/include/grub/relocator.h

+++ b/include/grub/relocator.h

@@ -49,6 +49,35 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel,

 				  int preference,

 				  int avoid_efi_boot_services);

+/*

+ * Wrapper for grub_relocator_alloc_chunk_align() with purpose of

+ * protecting against integer underflow.

+ *

+ * Compare to its callee, max_addr has different meaning here.

+ * It covers entire chunk and not just start address of the chunk.

+ */

+static inline grub_err_t

+grub_relocator_alloc_chunk_align_safe (struct grub_relocator *rel,

+				       grub_relocator_chunk_t *out,

+				       grub_phys_addr_t min_addr,

+				       grub_phys_addr_t max_addr,

+				       grub_size_t size, grub_size_t align,

+				       int preference,

+				       int avoid_efi_boot_services)

+{

+  /* Sanity check and ensure following equation (max_addr - size) is safe. */

+  if (max_addr < size || (max_addr - size) < min_addr)

+    return GRUB_ERR_OUT_OF_RANGE;

+

+  return grub_relocator_alloc_chunk_align (rel, out, min_addr,

+					   max_addr - size,

+					   size, align, preference,

+					   avoid_efi_boot_services);

+}

+

+/* Top 32-bit address minus s bytes and plus 1 byte. */

+#define UP_TO_TOP32(s)	((~(s) & 0xffffffff) + 1)

+

 #define GRUB_RELOCATOR_PREFERENCE_NONE 0

 #define GRUB_RELOCATOR_PREFERENCE_LOW 1

 #define GRUB_RELOCATOR_PREFERENCE_HIGH 2