1*4882a593SmuzhiyunFrom 6aee4bfd6973c714056fb7b56890b8d524e94ee1 Mon Sep 17 00:00:00 2001
2*4882a593SmuzhiyunFrom: Darren Kenny <darren.kenny@oracle.com>
3*4882a593SmuzhiyunDate: Fri, 11 Dec 2020 15:03:13 +0000
4*4882a593SmuzhiyunSubject: [PATCH] kern/efi/mm: Fix possible NULL pointer dereference
5*4882a593Smuzhiyun
6*4882a593SmuzhiyunThe model of grub_efi_get_memory_map() is that if memory_map is NULL,
7*4882a593Smuzhiyunthen the purpose is to discover how much memory should be allocated to
8*4882a593Smuzhiyunit for the subsequent call.
9*4882a593Smuzhiyun
10*4882a593SmuzhiyunThe problem here is that with grub_efi_is_finished set to 1, there is no
11*4882a593Smuzhiyuncheck at all that the function is being called with a non-NULL memory_map.
12*4882a593Smuzhiyun
13*4882a593SmuzhiyunWhile this MAY be true, we shouldn't assume it.
14*4882a593Smuzhiyun
15*4882a593SmuzhiyunThe solution to this is to behave as expected, and if memory_map is NULL,
16*4882a593Smuzhiyunthen don't try to use it and allow memory_map_size to be filled in, and
17*4882a593Smuzhiyunreturn 0 as is done later in the code if the buffer is too small (or NULL).
18*4882a593Smuzhiyun
19*4882a593SmuzhiyunAdditionally, drop unneeded ret = 1.
20*4882a593Smuzhiyun
21*4882a593SmuzhiyunFixes: CID 96632
22*4882a593Smuzhiyun
23*4882a593SmuzhiyunSigned-off-by: Darren Kenny <darren.kenny@oracle.com>
24*4882a593SmuzhiyunReviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
25*4882a593SmuzhiyunSigned-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
26*4882a593Smuzhiyun---
27*4882a593Smuzhiyun grub-core/kern/efi/mm.c | 19 ++++++++++++++-----
28*4882a593Smuzhiyun 1 file changed, 14 insertions(+), 5 deletions(-)
29*4882a593Smuzhiyun
30*4882a593Smuzhiyundiff --git a/grub-core/kern/efi/mm.c b/grub-core/kern/efi/mm.c
31*4882a593Smuzhiyunindex b02fab1..5afcef7 100644
32*4882a593Smuzhiyun--- a/grub-core/kern/efi/mm.c
33*4882a593Smuzhiyun+++ b/grub-core/kern/efi/mm.c
34*4882a593Smuzhiyun@@ -328,15 +328,24 @@ grub_efi_get_memory_map (grub_efi_uintn_t *memory_map_size,
35*4882a593Smuzhiyun   if (grub_efi_is_finished)
36*4882a593Smuzhiyun     {
37*4882a593Smuzhiyun       int ret = 1;
38*4882a593Smuzhiyun-      if (*memory_map_size < finish_mmap_size)
39*4882a593Smuzhiyun+
40*4882a593Smuzhiyun+      if (memory_map != NULL)
41*4882a593Smuzhiyun 	{
42*4882a593Smuzhiyun-	  grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
43*4882a593Smuzhiyun-	  ret = 0;
44*4882a593Smuzhiyun+	  if (*memory_map_size < finish_mmap_size)
45*4882a593Smuzhiyun+	    {
46*4882a593Smuzhiyun+	      grub_memcpy (memory_map, finish_mmap_buf, *memory_map_size);
47*4882a593Smuzhiyun+	      ret = 0;
48*4882a593Smuzhiyun+	    }
49*4882a593Smuzhiyun+          else
50*4882a593Smuzhiyun+	    grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
51*4882a593Smuzhiyun 	}
52*4882a593Smuzhiyun       else
53*4882a593Smuzhiyun 	{
54*4882a593Smuzhiyun-	  grub_memcpy (memory_map, finish_mmap_buf, finish_mmap_size);
55*4882a593Smuzhiyun-	  ret = 1;
56*4882a593Smuzhiyun+	  /*
57*4882a593Smuzhiyun+	   * Incomplete, no buffer to copy into, same as
58*4882a593Smuzhiyun+	   * GRUB_EFI_BUFFER_TOO_SMALL below.
59*4882a593Smuzhiyun+	   */
60*4882a593Smuzhiyun+	  ret = 0;
61*4882a593Smuzhiyun 	}
62*4882a593Smuzhiyun       *memory_map_size = finish_mmap_size;
63*4882a593Smuzhiyun       if (map_key)
64*4882a593Smuzhiyun--
65*4882a593Smuzhiyun2.14.2
66*4882a593Smuzhiyun
67