diff options
| author | Ahmad Fatoum <ahmad@a3f.at> | 2021-09-13 10:29:57 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2021-10-04 12:46:31 +0200 |
| commit | ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85 (patch) | |
| tree | 97aa709cd3e6bd8da319ad3aca63a53dcead6ceb | |
| parent | 90583805dcd7745d2d3fbac5a95e70a3b11aaff2 (diff) | |
| download | barebox-ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85.tar.gz barebox-ee05dc28e9985640d5df0b46eb6d5bf8ade2cd85.tar.xz | |
blspec: fix use-after-free of firmware search path
firmware_set_searchpath() is used to temporarily extend firmware search
path when parsing boot spec files. It does so by first freeing the
original firmware pointer and then storing a pointer to a copy of the
new search path.
firmware_get_searchpath() returns this pointer without copying meaning
that following sequence causes a use-after-free:
old_fws = firmware_get_searchpath();
firmware_set_searchpath(fws); /* calls free(old_fws) */
firmware_set_searchpath(old_fws);
Fix this by keeping around a copy of the search path.
Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath")
Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
Link: https://lore.barebox.org/20210913082957.364440-1-ahmad@a3f.at
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| -rw-r--r-- | common/blspec.c | 4 | ||||
| -rw-r--r-- | common/firmware.c | 4 | ||||
| -rw-r--r-- | include/firmware.h | 4 |
3 files changed, 6 insertions, 6 deletions
diff --git a/common/blspec.c b/common/blspec.c index 6cb1fea9e8..158fd1e9a2 100644 --- a/common/blspec.c +++ b/common/blspec.c @@ -75,8 +75,7 @@ static int blspec_boot(struct bootentry *be, int verbose, int dryrun) const char *abspath, *devicetree, *options, *initrd, *linuximage; const char *overlays; const char *appendroot; - const char *old_fws; - char *fws; + char *old_fws, *fws; struct bootm_data data = { .dryrun = dryrun, }; @@ -158,6 +157,7 @@ static int blspec_boot(struct bootentry *be, int verbose, int dryrun) of_overlay_set_basedir("/"); firmware_set_searchpath(old_fws); + free(old_fws); err_out: free((char *)data.oftree_file); diff --git a/common/firmware.c b/common/firmware.c index b33acff77f..b87d7da38f 100644 --- a/common/firmware.c +++ b/common/firmware.c @@ -224,9 +224,9 @@ out: static char *firmware_path; -const char *firmware_get_searchpath(void) +char *firmware_get_searchpath(void) { - return firmware_path; + return strdup(firmware_path); } void firmware_set_searchpath(const char *path) diff --git a/include/firmware.h b/include/firmware.h index 0ffea52840..2583342230 100644 --- a/include/firmware.h +++ b/include/firmware.h @@ -31,7 +31,7 @@ struct firmware_mgr *firmwaremgr_find(const char *); #ifdef CONFIG_FIRMWARE struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np); int firmwaremgr_load_file(struct firmware_mgr *, const char *path); -const char *firmware_get_searchpath(void); +char *firmware_get_searchpath(void); void firmware_set_searchpath(const char *path); #else static inline struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np) @@ -44,7 +44,7 @@ static inline int firmwaremgr_load_file(struct firmware_mgr *mgr, const char *pa return -ENOSYS; } -static inline const char *firmware_get_searchpath(void) +static inline char *firmware_get_searchpath(void) { return NULL; } |