1*4882a593SmuzhiyunFrom 6aee4bfd6973c714056fb7b56890b8d524e94ee1 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com> 3*4882a593SmuzhiyunDate: Fri, 11 Dec 2020 15:03:13 +0000 4*4882a593SmuzhiyunSubject: [PATCH] kern/efi/mm: Fix possible NULL pointer dereference 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunThe model of grub_efi_get_memory_map() is that if memory_map is NULL, 7*4882a593Smuzhiyunthen the purpose is to discover how much memory should be allocated to 8*4882a593Smuzhiyunit for the subsequent call. 9*4882a593Smuzhiyun 10*4882a593SmuzhiyunThe problem here is that with grub_efi_is_finished set to 1, there is no 11*4882a593Smuzhiyuncheck at all that the function is being called with a non-NULL memory_map. 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunWhile this MAY be true, we shouldn't assume it. 14*4882a593Smuzhiyun 15*4882a593SmuzhiyunThe solution to this is to behave as expected, and if memory_map is NULL, 16*4882a593Smuzhiyunthen don't try to use it and allow memory_map_size to be filled in, and 17*4882a593Smuzhiyunreturn 0 as is done later in the code if the buffer is too small (or NULL). 18*4882a593Smuzhiyun 19*4882a593SmuzhiyunAdditionally, drop unneeded ret = 1. 20*4882a593Smuzhiyun 21*4882a593SmuzhiyunFixes: CID 96632 22*4882a593Smuzhiyun 23*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com> 24*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com> 25*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> 26*4882a593Smuzhiyun--- 27*4882a593Smuzhiyun grub-core/kern/efi/mm.c | 19 ++++++++++++++----- 28*4882a593Smuzhiyun 1 file changed, 14 insertions(+), 5 deletions(-) 29*4882a593Smuzhiyun 30*4882a593Smuzhiyundiff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c 31*4882a593Smuzhiyunindex b02fab1..5afcef7 100644 32*4882a593Smuzhiyun--- a/grub-core/kern/efi/mm.c 33*4882a593Smuzhiyun+++ b/grub-core/kern/efi/mm.c 34*4882a593Smuzhiyun@@ -328,15 +328,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size, 35*4882a593Smuzhiyun if (grub_efi_is_finished) 36*4882a593Smuzhiyun { 37*4882a593Smuzhiyun int ret = 1; 38*4882a593Smuzhiyun- if (*memory_map_size < finish_mmap_size) 39*4882a593Smuzhiyun+ 40*4882a593Smuzhiyun+ if (memory_map != NULL) 41*4882a593Smuzhiyun { 42*4882a593Smuzhiyun- grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); 43*4882a593Smuzhiyun- ret = 0; 44*4882a593Smuzhiyun+ if (*memory_map_size < finish_mmap_size) 45*4882a593Smuzhiyun+ { 46*4882a593Smuzhiyun+ grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size); 47*4882a593Smuzhiyun+ ret = 0; 48*4882a593Smuzhiyun+ } 49*4882a593Smuzhiyun+ else 50*4882a593Smuzhiyun+ grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); 51*4882a593Smuzhiyun } 52*4882a593Smuzhiyun else 53*4882a593Smuzhiyun { 54*4882a593Smuzhiyun- grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size); 55*4882a593Smuzhiyun- ret = 1; 56*4882a593Smuzhiyun+ /* 57*4882a593Smuzhiyun+ * Incomplete, no buffer to copy into, same as 58*4882a593Smuzhiyun+ * GRUB_EFI_BUFFER_TOO_SMALL below. 59*4882a593Smuzhiyun+ */ 60*4882a593Smuzhiyun+ ret = 0; 61*4882a593Smuzhiyun } 62*4882a593Smuzhiyun *memory_map_size = finish_mmap_size; 63*4882a593Smuzhiyun if (map_key) 64*4882a593Smuzhiyun-- 65*4882a593Smuzhiyun2.14.2 66*4882a593Smuzhiyun 67