mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH master] blspec: fix use-after-free of firmware search path
@ 2021-09-13  8:29 Ahmad Fatoum
  2021-10-04 10:46 ` Sascha Hauer
  0 siblings, 1 reply; 2+ messages in thread
From: Ahmad Fatoum @ 2021-09-13  8:29 UTC (permalink / raw)
  To: barebox; +Cc: Ahmad Fatoum

firmware_set_searchpath() is used to temporarily extend firmware search
path when parsing boot spec files. It does so by first freeing the
original firmware pointer and then storing a pointer to a copy of the
new search path.

firmware_get_searchpath() returns this pointer without copying meaning
that following sequence causes a use-after-free:

	old_fws = firmware_get_searchpath();
	firmware_set_searchpath(fws); /* calls free(old_fws) */
	firmware_set_searchpath(old_fws);

Fix this by keeping around a copy of the search path.

Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath")
Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
---
 common/blspec.c    | 4 ++--
 common/firmware.c  | 4 ++--
 include/firmware.h | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/common/blspec.c b/common/blspec.c
index 6cb1fea9e876..158fd1e9a28c 100644
--- a/common/blspec.c
+++ b/common/blspec.c
@@ -75,8 +75,7 @@ static int blspec_boot(struct bootentry *be, int verbose, int dryrun)
 	const char *abspath, *devicetree, *options, *initrd, *linuximage;
 	const char *overlays;
 	const char *appendroot;
-	const char *old_fws;
-	char *fws;
+	char *old_fws, *fws;
 	struct bootm_data data = {
 		.dryrun = dryrun,
 	};
@@ -158,6 +157,7 @@ static int blspec_boot(struct bootentry *be, int verbose, int dryrun)
 
 	of_overlay_set_basedir("/");
 	firmware_set_searchpath(old_fws);
+	free(old_fws);
 
 err_out:
 	free((char *)data.oftree_file);
diff --git a/common/firmware.c b/common/firmware.c
index b33acff77ff8..b87d7da38fa7 100644
--- a/common/firmware.c
+++ b/common/firmware.c
@@ -224,9 +224,9 @@ out:
 
 static char *firmware_path;
 
-const char *firmware_get_searchpath(void)
+char *firmware_get_searchpath(void)
 {
-	return firmware_path;
+	return strdup(firmware_path);
 }
 
 void firmware_set_searchpath(const char *path)
diff --git a/include/firmware.h b/include/firmware.h
index 0ffea5284086..2583342230ae 100644
--- a/include/firmware.h
+++ b/include/firmware.h
@@ -31,7 +31,7 @@ struct firmware_mgr *firmwaremgr_find(const char *);
 #ifdef CONFIG_FIRMWARE
 struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np);
 int firmwaremgr_load_file(struct firmware_mgr *, const char *path);
-const char *firmware_get_searchpath(void);
+char *firmware_get_searchpath(void);
 void firmware_set_searchpath(const char *path);
 #else
 static inline struct firmware_mgr *firmwaremgr_find_by_node(struct device_node *np)
@@ -44,7 +44,7 @@ static inline int firmwaremgr_load_file(struct firmware_mgr *mgr, const char *pa
 	return -ENOSYS;
 }
 
-static inline const char *firmware_get_searchpath(void)
+static inline char *firmware_get_searchpath(void)
 {
 	return NULL;
 }
-- 
2.33.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH master] blspec: fix use-after-free of firmware search path
  2021-09-13  8:29 [PATCH master] blspec: fix use-after-free of firmware search path Ahmad Fatoum
@ 2021-10-04 10:46 ` Sascha Hauer
  0 siblings, 0 replies; 2+ messages in thread
From: Sascha Hauer @ 2021-10-04 10:46 UTC (permalink / raw)
  To: Ahmad Fatoum; +Cc: barebox

On Mon, Sep 13, 2021 at 10:29:57AM +0200, Ahmad Fatoum wrote:
> firmware_set_searchpath() is used to temporarily extend firmware search
> path when parsing boot spec files. It does so by first freeing the
> original firmware pointer and then storing a pointer to a copy of the
> new search path.
> 
> firmware_get_searchpath() returns this pointer without copying meaning
> that following sequence causes a use-after-free:
> 
> 	old_fws = firmware_get_searchpath();
> 	firmware_set_searchpath(fws); /* calls free(old_fws) */
> 	firmware_set_searchpath(old_fws);
> 
> Fix this by keeping around a copy of the search path.
> 
> Fixes: dfebbb0a5944 ("blspec: Set firmware searchpath")
> Signed-off-by: Ahmad Fatoum <ahmad@a3f.at>
> ---
>  common/blspec.c    | 4 ++--
>  common/firmware.c  | 4 ++--
>  include/firmware.h | 4 ++--
>  3 files changed, 6 insertions(+), 6 deletions(-)

Applied, thanks

Sascha


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-10-04 10:48 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-13  8:29 [PATCH master] blspec: fix use-after-free of firmware search path Ahmad Fatoum
2021-10-04 10:46 ` Sascha Hauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox