|
 |
9723a8 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
9723a8 |
From: Marco A Benatto <mbenatto@redhat.com>
|
|
|
9723a8 |
Date: Mon, 7 Dec 2020 11:53:03 -0300
|
|
|
9723a8 |
Subject: [PATCH] disk/ldm: Make sure comp data is freed before exiting from
|
|
|
9723a8 |
make_vg()
|
|
|
9723a8 |
|
|
|
9723a8 |
Several error handling paths in make_vg() do not free comp data before
|
|
|
9723a8 |
jumping to fail2 label and returning from the function. This will leak
|
|
|
9723a8 |
memory. So, let's fix all issues of that kind.
|
|
|
9723a8 |
|
|
|
9723a8 |
Fixes: CID 73804
|
|
|
9723a8 |
|
|
|
9723a8 |
Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
|
|
|
9723a8 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
9723a8 |
---
|
|
|
9723a8 |
grub-core/disk/ldm.c | 51 ++++++++++++++++++++++++++++++++++++++++++++-------
|
|
|
9723a8 |
1 file changed, 44 insertions(+), 7 deletions(-)
|
|
|
9723a8 |
|
|
|
9723a8 |
diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
|
|
|
b71686 |
index 58f8a53e1..428415fac 100644
|
|
|
9723a8 |
--- a/grub-core/disk/ldm.c
|
|
|
9723a8 |
+++ b/grub-core/disk/ldm.c
|
|
|
9723a8 |
@@ -554,7 +554,11 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
comp->segments = grub_calloc (comp->segment_alloc,
|
|
|
9723a8 |
sizeof (*comp->segments));
|
|
|
9723a8 |
if (!comp->segments)
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
}
|
|
|
9723a8 |
else
|
|
|
9723a8 |
{
|
|
|
9723a8 |
@@ -562,7 +566,11 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
comp->segment_count = 1;
|
|
|
9723a8 |
comp->segments = grub_malloc (sizeof (*comp->segments));
|
|
|
9723a8 |
if (!comp->segments)
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
comp->segments->start_extent = 0;
|
|
|
9723a8 |
comp->segments->extent_count = lv->size;
|
|
|
9723a8 |
comp->segments->layout = 0;
|
|
|
9723a8 |
@@ -574,15 +582,26 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK;
|
|
|
9723a8 |
}
|
|
|
9723a8 |
else
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
ptr += *ptr + 1;
|
|
|
9723a8 |
ptr++;
|
|
|
9723a8 |
if (!(vblk[i].flags & 0x10))
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic)
|
|
|
9723a8 |
|| ptr + *ptr + 1 >= vblk[i].dynamic
|
|
|
9723a8 |
+ sizeof (vblk[i].dynamic))
|
|
|
9723a8 |
{
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
grub_free (comp->internal_id);
|
|
|
9723a8 |
grub_free (comp);
|
|
|
9723a8 |
goto fail2;
|
|
|
9723a8 |
@@ -592,6 +611,7 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
if (ptr + *ptr + 1 >= vblk[i].dynamic
|
|
|
9723a8 |
+ sizeof (vblk[i].dynamic))
|
|
|
9723a8 |
{
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
grub_free (comp->internal_id);
|
|
|
9723a8 |
grub_free (comp);
|
|
|
9723a8 |
goto fail2;
|
|
|
9723a8 |
@@ -601,7 +621,12 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
|
|
|
9723a8 |
sizeof (*comp->segments->nodes));
|
|
|
9723a8 |
if (!lv->segments->nodes)
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
}
|
|
|
9723a8 |
|
|
|
9723a8 |
if (lv->segments->node_alloc == lv->segments->node_count)
|
|
|
9723a8 |
@@ -611,11 +636,23 @@ make_vg (grub_disk_t disk,
|
|
|
9723a8 |
|
|
|
9723a8 |
if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
|
|
|
9723a8 |
grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->segments->nodes);
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
|
|
|
9723a8 |
t = grub_realloc (lv->segments->nodes, sz);
|
|
|
9723a8 |
if (!t)
|
|
|
9723a8 |
- goto fail2;
|
|
|
9723a8 |
+ {
|
|
|
9723a8 |
+ grub_free (comp->segments->nodes);
|
|
|
9723a8 |
+ grub_free (comp->segments);
|
|
|
9723a8 |
+ grub_free (comp->internal_id);
|
|
|
9723a8 |
+ grub_free (comp);
|
|
|
9723a8 |
+ goto fail2;
|
|
|
9723a8 |
+ }
|
|
|
9723a8 |
lv->segments->nodes = t;
|
|
|
9723a8 |
}
|
|
|
9723a8 |
lv->segments->nodes[lv->segments->node_count].pv = 0;
|