Sync from SUSE:SLFO:Main u-boot revision 2a2f7324e359218e9a7b120ffb836acd

0017-dlmalloc-Fix-integer-overflow-in-s-.patch

@@ -0,0 +1,45 @@
+From 265cf54d3b33258202bc755ff1ab67ac0f4153d8 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 12:08:45 +0200
+Subject: [PATCH] dlmalloc: Fix integer overflow in sbrk()
+
+Make sure that the new break is within mem_malloc_start
+and mem_malloc_end before making progress.
+ulong new = old + increment; can overflow for extremely large
+increment values and memset() can get wrongly called.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+(cherry picked from 0a10b49206a29b4aa2f80233a3e53ca0466bb0b3)
+Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
+---
+ common/dlmalloc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/common/dlmalloc.c b/common/dlmalloc.c
+index 41c72304..ce4e56da 100644
+--- a/common/dlmalloc.c
++++ b/common/dlmalloc.c
+@@ -604,6 +604,9 @@ void *sbrk(ptrdiff_t increment)
+ 	ulong old = mem_malloc_brk;
+ 	ulong new = old + increment;
+ 
++	if ((new < mem_malloc_start) || (new > mem_malloc_end))
++		return (void *)MORECORE_FAILURE;
++
+ 	/*
+ 	 * if we are giving memory back make sure we clear it out since
+ 	 * we set MORECORE_CLEARS to 1
+@@ -611,9 +614,6 @@ void *sbrk(ptrdiff_t increment)
+ 	if (increment < 0)
+ 		memset((void *)new, 0, -increment);
+ 
+-	if ((new < mem_malloc_start) || (new > mem_malloc_end))
+-		return (void *)MORECORE_FAILURE;
+-
+ 	mem_malloc_brk = new;
+ 
+ 	return (void *)old;
+-- 
+2.35.3
+

0018-dlmalloc-Fix-integer-overflow-in-r-.patch

@@ -0,0 +1,41 @@
+From eebd284f830ba900b7eeb0a48a476d47780450e4 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 12:08:44 +0200
+Subject: [PATCH] dlmalloc: Fix integer overflow in request2size()
+
+req is of type size_t, casting it to long opens the door
+for an integer overflow.
+Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
+cause and overflow such that request2size() returns MINSIZE.
+
+Fix by removing the cast.
+The origin of the cast is unclear, it's in u-boot and ppcboot since ever
+and predates the CVS history.
+Doug Lea's original dlmalloc implementation also doesn't have it.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+(cherry picked from 8642b2178d2c4002c99a0b69a845a48f2ae2706f)
+Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
+---
+ common/dlmalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/common/dlmalloc.c b/common/dlmalloc.c
+index ce4e56da..62935009 100644
+--- a/common/dlmalloc.c
++++ b/common/dlmalloc.c
+@@ -379,8 +379,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ /* pad request bytes into a usable size */
+ 
+ #define request2size(req) \
+- (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
+-  (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
++ ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
++  (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
+    (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK)))
+ 
+ /* Check if m has acceptable alignment */
+-- 
+2.35.3
+

0019-ext4-Fix-integer-overflow-in-ext4f-.patch

@@ -0,0 +1,49 @@
+From 6f4fd2e38aa87535f1a03a5fb4fc172a260acf25 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 9 Aug 2024 11:54:28 +0200
+Subject: [PATCH] ext4: Fix integer overflow in ext4fs_read_symlink()
+
+While zalloc() takes a size_t type, adding 1 to the le32 variable
+will overflow.
+A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
+and as consequence zalloc() will do a zero allocation.
+
+Later in the function the inode size is again used for copying data.
+So an attacker can overwrite memory.
+
+Avoid the overflow by using the __builtin_add_overflow() helper.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+(cherry picked from 35f75d2a46e5859138c83a75cd2f4141c5479ab9)
+Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
+---
+ fs/ext4/ext4_common.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
+index 9a9c520e..903c87db 100644
+--- a/fs/ext4/ext4_common.c
++++ b/fs/ext4/ext4_common.c
+@@ -2188,13 +2188,18 @@ static char *ext4fs_read_symlink(struct ext2fs_node *node)
+ 	struct ext2fs_node *diro = node;
+ 	int status;
+ 	loff_t actread;
++	size_t alloc_size;
+ 
+ 	if (!diro->inode_read) {
+ 		status = ext4fs_read_inode(diro->data, diro->ino, &diro->inode);
+ 		if (status == 0)
+ 			return NULL;
+ 	}
+-	symlink = zalloc(le32_to_cpu(diro->inode.size) + 1);
++
++	if (__builtin_add_overflow(le32_to_cpu(diro->inode.size), 1, &alloc_size))
++		return NULL;
++
++	symlink = zalloc(alloc_size);
+ 	if (!symlink)
+ 		return NULL;
+ 
+-- 
+2.35.3
+

u-boot.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Wed Feb 26 14:58:41 UTC 2025 - Andrea della Porta <andrea.porta@suse.com>
+
+- Fix CVE-2024-57256 (bsc#1237284)
+
+* Patches added:
+  0019-ext4-Fix-integer-overflow-in-ext4f-.patch
+
+-------------------------------------------------------------------
+Tue Feb 25 09:51:21 UTC 2025 - Andrea della Porta <andrea.porta@suse.com>
+
+- Fix CVE-2024-57258 (bsc#1237287)
+
+* Patches added:
+  0017-dlmalloc-Fix-integer-overflow-in-s-.patch
+  0018-dlmalloc-Fix-integer-overflow-in-r-.patch 
+
 -------------------------------------------------------------------
 Mon Apr 24 12:32:54 UTC 2023 - Guillaume GARDET <guillaume.gardet@opensuse.org>
 

u-boot.spec

@@ -238,6 +238,9 @@ Patch0013:      0013-Disable-timer-check-in-file-loading.patch
 Patch0014:      0014-Enable-EFI-and-ISO-partitions-suppo.patch
 Patch0015:      0015-cmd-boot-add-brom-cmd-to-reboot-to-.patch
 Patch0016:      0016-cmd-boot-add-brom-cmd-to-reboot-to-.patch
+Patch0017:      0017-dlmalloc-Fix-integer-overflow-in-s-.patch
+Patch0018:      0018-dlmalloc-Fix-integer-overflow-in-r-.patch
+Patch0019:      0019-ext4-Fix-integer-overflow-in-ext4f-.patch
 # Patches: end
 BuildRequires:  bc
 BuildRequires:  bison