[PATCH v2 1/2] state: do not panic on flipped bits in on-disk sizes

[PATCH v2 1/2] state: do not panic on flipped bits in on-disk sizes

[Ahmad Fatoum]

We allocate some buffers with a size that's ultimately dictated by
on-disk metadata. This metadata can be incorrect and state is supposed
to handle that by storing the data redundantly in three buckets.

Due to the use of x-family functions, we triggered a panic though, which
made an unfortunate bitflip an irrecoverable error.

Fix this by switching the allocations in question to non-panicking ones
and propagating the error. This issue has been detected by libfuzzer.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
v1 -> v2:
  - also check for zero byte allocations
---
 common/state/backend_bucket_circular.c | 10 ++++++----
 common/state/backend_bucket_direct.c   |  6 +++---
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/common/state/backend_bucket_circular.c b/common/state/backend_bucket_circular.c
index 6b5873aa9af1..9fe38bc9c508 100644
--- a/common/state/backend_bucket_circular.c
+++ b/common/state/backend_bucket_circular.c
@@ -265,9 +265,9 @@ static int state_backend_bucket_circular_read(struct state_backend_storage_bucke
 		offset = circ->write_area - read_len;
 	}
 
-	buf = xmalloc(read_len);
-	if (!buf)
-		return -ENOMEM;
+	buf = malloc(read_len);
+	if (ZERO_OR_NULL_PTR(buf))
+		return buf ? -EINVAL : -ENOMEM;
 
 	dev_dbg(circ->dev, "Read state from PEB %u global offset %lld length %zd\n",
 		circ->eraseblock, (long long) offset, read_len);
@@ -311,7 +311,9 @@ static int state_backend_bucket_circular_write(struct state_backend_storage_buck
 	 * We need zero initialization so that our data comparisons don't show
 	 * random changes
 	 */
-	write_buf = xzalloc(written_length);
+	write_buf = calloc(1, written_length);
+	if (ZERO_OR_NULL_PTR(write_buf))
+		return write_buf ? -EINVAL : -ENOMEM;
 
 	memcpy(write_buf, buf, len);
 	meta = (struct state_backend_storage_bucket_circular_meta *)
diff --git a/common/state/backend_bucket_direct.c b/common/state/backend_bucket_direct.c
index 03c752d6fe41..2ee0c7184193 100644
--- a/common/state/backend_bucket_direct.c
+++ b/common/state/backend_bucket_direct.c
@@ -92,9 +92,9 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket
 
 	}
 
-	buf = xmalloc(read_len);
-	if (!buf)
-		return -ENOMEM;
+	buf = malloc(read_len);
+	if (ZERO_OR_NULL_PTR(buf))
+		return buf ? -EINVAL : -ENOMEM;
 
 	dev_dbg(direct->dev, "Read state from %lld length %d\n", (long long) direct->offset,
 		header_len + read_len);
-- 
2.39.5

[PATCH v2 2/2] state: dtb: enforce minimum FDT length

[Ahmad Fatoum]

We should check that we have at least a FDT header before dereferencing
pointers to the structure. Issue detected with libfuzzer.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
v1 -> v2:
  - new patch
---
 common/state/backend_format_dtb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/common/state/backend_format_dtb.c b/common/state/backend_format_dtb.c
index b41b896aaced..9624d1e8103e 100644
--- a/common/state/backend_format_dtb.c
+++ b/common/state/backend_format_dtb.c
@@ -45,9 +45,13 @@ static int state_backend_format_dtb_verify(struct state_backend_format *format,
 	struct state_backend_format_dtb *fdtb = get_format_dtb(format);
 	struct device_node *root;
 	struct fdt_header *fdt = (struct fdt_header *)buf;
-	size_t dtb_len = fdt32_to_cpu(fdt->totalsize);
+	size_t dtb_len;
 	size_t len = *lenp;
 
+	if (len < sizeof(*fdt))
+		return -EINVAL;
+
+	dtb_len = fdt32_to_cpu(fdt->totalsize);
 	if (dtb_len > len) {
 		dev_err(fdtb->dev, "Error, stored DTB length (%zd) longer than read buffer (%zd)\n",
 			dtb_len, len);
-- 
2.39.5