Blame SOURCES/0524-net-netbuff-Block-overly-large-netbuff-allocs.patch

bf0270
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
bf0270
From: Daniel Axtens <dja@axtens.net>
bf0270
Date: Tue, 8 Mar 2022 23:47:46 +1100
bf0270
Subject: [PATCH] net/netbuff: Block overly large netbuff allocs
bf0270
bf0270
A netbuff shouldn't be too huge. It's bounded by MTU and TCP segment
bf0270
reassembly.
bf0270
bf0270
This helps avoid some bugs (and provides a spot to instrument to catch
bf0270
them at their source).
bf0270
bf0270
Signed-off-by: Daniel Axtens <dja@axtens.net>
bf0270
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
bf0270
(cherry picked from commit ee9591103004cd13b4efadda671536090ca7fd57)
bf0270
(cherry picked from commit acde668bb9d9fa862a1a63e3bbd5fa47fdfa9183)
bf0270
(cherry picked from commit e47ad2eb4fe38ef2bdcab52245286f31170e73e3)
bf0270
---
bf0270
 grub-core/net/netbuff.c | 13 +++++++++++++
bf0270
 1 file changed, 13 insertions(+)
bf0270
bf0270
diff --git a/grub-core/net/netbuff.c b/grub-core/net/netbuff.c
bf0270
index dbeeefe478..d5e9e9a0d7 100644
bf0270
--- a/grub-core/net/netbuff.c
bf0270
+++ b/grub-core/net/netbuff.c
bf0270
@@ -79,10 +79,23 @@ grub_netbuff_alloc (grub_size_t len)
bf0270
 
bf0270
   COMPILE_TIME_ASSERT (NETBUFF_ALIGN % sizeof (grub_properly_aligned_t) == 0);
bf0270
 
bf0270
+  /*
bf0270
+   * The largest size of a TCP packet is 64 KiB, and everything else
bf0270
+   * should be a lot smaller - most MTUs are 1500 or less. Cap data
bf0270
+   * size at 64 KiB + a buffer.
bf0270
+   */
bf0270
+  if (len > 0xffffUL + 0x1000UL)
bf0270
+    {
bf0270
+      grub_error (GRUB_ERR_BUG,
bf0270
+                  "attempted to allocate a packet that is too big");
bf0270
+      return NULL;
bf0270
+    }
bf0270
+
bf0270
   if (len < NETBUFFMINLEN)
bf0270
     len = NETBUFFMINLEN;
bf0270
 
bf0270
   len = ALIGN_UP (len, NETBUFF_ALIGN);
bf0270
+
bf0270
 #ifdef GRUB_MACHINE_EMU
bf0270
   data = grub_malloc (len + sizeof (*nb));
bf0270
 #else