Files
lbmk/config/grub/xhci/patches/0020-grub-core-bus-usb-usbhub-Add-xHCI-non-root-hub-suppo.patch
T
Leah Rowe e348ea0381 Bump GRUB revision to add 73 security patches
You can find information about these patches here:
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

GRUB has been on a crusade as of late, to proactively audit
and fix many security vulnerabilities. This lbmk change brings
in a comprehensive series of patches that fix bugs ranging from
possible buffer overflows, use-after frees, null derefs and so on.

These changes are critical, so a revision release *will* be issued,
for the Libreboot 20241206 release series.

This change imports the following 73 patches which
are present on the upstream GRUB repository (commit IDs
matched to upstream):

* 4dc616657 loader/i386/bsd: Use safe math to avoid underflow
* 490a6ab71 loader/i386/linux: Cast left shift to grub_uint32_t
* a8d6b0633 kern/misc: Add sanity check after grub_strtoul() call
* 8e6e87e79 kern/partition: Add sanity check after grub_strtoul() call
* 5b36a5210 normal/menu: Use safe math to avoid an integer overflow
* 9907d9c27 bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t
* f8795cde2 misc: Ensure consistent overflow error messages
* 66733f7c7 osdep/unix/getroot: Fix potential underflow
* d13b6e8eb script/execute: Fix potential underflow and NULL dereference
* e3c578a56 fs/sfs: Check if allocated memory is NULL
* 1c06ec900 net: Check if returned pointer for allocated memory is NULL
* dee2c14fd net: Prevent overflows when allocating memory for arrays
* 4beeff8a3 net: Use safe math macros to prevent overflows
* dd6a4c8d1 fs/zfs: Add missing NULL check after grub_strdup() call
* 13065f69d fs/zfs: Check if returned pointer for allocated memory is NULL
* 7f38e32c7 fs/zfs: Prevent overflows when allocating memory for arrays
* 88e491a0f fs/zfs: Use safe math macros to prevent overflows
* cde9f7f33 fs: Prevent overflows when assigning returned values from read_number()
* 84bc0a9a6 fs: Prevent overflows when allocating memory for arrays
* 6608163b0 fs: Use safe math macros to prevent overflows
* fbaddcca5 disk/ieee1275/ofdisk: Call grub_ieee1275_close() when grub_malloc() fails
* 33bd6b5ac disk: Check if returned pointer for allocated memory is NULL
* d8151f983 disk: Prevent overflows when allocating memory for arrays
* c407724da disk: Use safe math macros to prevent overflows
* c4bc55da2 fs: Disable many filesystems under lockdown
* 26db66050 fs/bfs: Disable under lockdown
* 5f31164ae commands/hexdump: Disable memory reading in lockdown mode
* 340e4d058 commands/memrw: Disable memory reading in lockdown mode
* 34824806a commands/minicmd: Block the dump command in lockdown mode
* c68b7d236 commands/test: Stack overflow due to unlimited recursion depth
* dad8f5029 commands/read: Fix an integer overflow when supplying more than 2^31 characters
* b970a5ed9 gettext: Integer overflow leads to heap OOB write
* 09bd6eb58 gettext: Integer overflow leads to heap OOB write or read
* 7580addfc gettext: Remove variables hooks on module unload
* 9c1619773 normal: Remove variables hooks on module unload
* 2123c5bca commands/pgp: Unregister the "check_signatures" hooks on module unload
* 0bf56bce4 commands/ls: Fix NULL dereference
* 05be856a8 commands/extcmd: Missing check for failed allocation
* 98ad84328 kern/dl: Check for the SHF_INFO_LINK flag in grub_dl_relocate_symbols()
* d72208423 kern/dl: Use correct segment in grub_dl_set_mem_attrs()
* 500e5fdd8 kern/dl: Fix for an integer overflow in grub_dl_ref()
* 2c34af908 video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
* 0707accab net/tftp: Fix stack buffer overflow in tftp_open()
* 5eef88152 net: Fix OOB write in grub_net_search_config_file()
* aa8b4d7fa net: Remove variables hooks when interface is unregisted
* a1dd8e59d net: Unregister net_default_ip and net_default_mac variables hooks on unload
* d8a937cca script/execute: Limit the recursion depth
* 8a7103fdd kern/partition: Limit recursion in part_iterate()
* 18212f064 kern/disk: Limit recursion depth
* 67f70f70a disk/loopback: Reference tracking for the loopback
* 13febd78d disk/cryptodisk: Require authentication after TPM unlock for CLI access
* 16f196874 kern/file: Implement filesystem reference counting
* a79106872 kern/file: Ensure file->data is set
* d1d6b7ea5 fs/xfs: Ensuring failing to mount sets a grub_errno
* 6ccc77b59 fs/xfs: Fix out-of-bounds read
* 067b6d225 fs/ntfs: Implement attribute verification
* 048777bc2 fs/ntfs: Use a helper function to access attributes
* 237a71184 fs/ntfs: Track the end of the MFT attribute buffer
* aff263187 fs/ntfs: Fix out-of-bounds read
* 7e2f750f0 fs/ext2: Fix out-of-bounds read for inline extents
* edd995a26 fs/jfs: Inconsistent signed/unsigned types usage in return values
* bd999310f fs/jfs: Use full 40 bits offset and address for a data extent
* ab09fd053 fs/jfs: Fix OOB read caused by invalid dir slot index
* 66175696f fs/jfs: Fix OOB read in jfs_getent()
* 1443833a9 fs/iso9660: Fix invalid free
* 965db5970 fs/iso9660: Set a grub_errno if mount fails
* f7c070a2e fs/hfsplus: Set a grub_errno if mount fails
* 563436258 fs/f2fs: Set a grub_errno if mount fails
* 0087bc690 fs/tar: Integer overflow leads to heap OOB write
* 2c8ac08c9 fs/tar: Initialize name in grub_cpio_find_file()
* 417547c10 fs/hfs: Fix stack OOB write with grub_strcpy()
* c1a291b01 fs/ufs: Fix a heap OOB write
* ea703528a misc: Implement grub_strlcpy()

Signed-off-by: Leah Rowe <leah@libreboot.org>
2025-02-19 21:26:23 +00:00

128 lines
4.0 KiB
Diff

From e4416b166e501777e53de387ac4329150483a160 Mon Sep 17 00:00:00 2001
From: Patrick Rudolph <patrick.rudolph@9elements.com>
Date: Mon, 7 Dec 2020 08:41:27 +0100
Subject: [PATCH 20/26] grub-core/bus/usb/usbhub: Add xHCI non root hub support
Tested on Intel PCH C246, the USB3 hub can be configured by grub.
Issues:
* USB3 devices connected behind that hub are sometimes not detected.
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
---
grub-core/bus/usb/usbhub.c | 38 +++++++++++++++++++++++++++++++++-----
include/grub/usbdesc.h | 1 +
include/grub/usbtrans.h | 4 ++++
3 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c
index b4b3a1a61..e96505aa9 100644
--- a/grub-core/bus/usb/usbhub.c
+++ b/grub-core/bus/usb/usbhub.c
@@ -148,19 +148,32 @@ grub_usb_hub_add_dev (grub_usb_controller_t controller,
return dev;
}
-
+static grub_usb_err_t
+grub_usb_set_hub_depth(grub_usb_device_t dev, grub_uint8_t depth)
+{
+ return grub_usb_control_msg (dev, (GRUB_USB_REQTYPE_OUT
+ | GRUB_USB_REQTYPE_CLASS
+ | GRUB_USB_REQTYPE_TARGET_DEV),
+ GRUB_USB_HUB_REQ_SET_HUB_DEPTH, depth,
+ 0, 0, NULL);
+}
+
static grub_usb_err_t
grub_usb_add_hub (grub_usb_device_t dev)
{
struct grub_usb_usb_hubdesc hubdesc;
grub_usb_err_t err;
+ grub_uint16_t req;
int i;
+ req = (dev->speed == GRUB_USB_SPEED_SUPER) ? GRUB_USB_DESCRIPTOR_SS_HUB :
+ GRUB_USB_DESCRIPTOR_HUB;
+
err = grub_usb_control_msg (dev, (GRUB_USB_REQTYPE_IN
| GRUB_USB_REQTYPE_CLASS
| GRUB_USB_REQTYPE_TARGET_DEV),
- GRUB_USB_REQ_GET_DESCRIPTOR,
- (GRUB_USB_DESCRIPTOR_HUB << 8) | 0,
+ GRUB_USB_REQ_GET_DESCRIPTOR,
+ (req << 8) | 0,
0, sizeof (hubdesc), (char *) &hubdesc);
if (err)
return err;
@@ -183,6 +196,19 @@ grub_usb_add_hub (grub_usb_device_t dev)
return GRUB_USB_ERR_INTERNAL;
}
+ if (dev->speed == GRUB_USB_SPEED_SUPER)
+ {
+ grub_uint8_t depth;
+ grub_uint32_t route;
+ /* Depth maximum value is 5, but root hubs doesn't count */
+ for (depth = 0, route = dev->route; (route & 0xf) > 0; route >>= 4)
+ depth++;
+
+ err = grub_usb_set_hub_depth(dev, depth);
+ if (err)
+ return err;
+ }
+
/* Power on all Hub ports. */
for (i = 1; i <= hubdesc.portcnt; i++)
{
@@ -637,7 +663,9 @@ poll_nonroot_hub (grub_usb_device_t dev)
int split_hubaddr = 0;
/* Determine the device speed. */
- if (status & GRUB_USB_HUB_STATUS_PORT_LOWSPEED)
+ if (dev->speed == GRUB_USB_SPEED_SUPER)
+ speed = GRUB_USB_SPEED_SUPER;
+ else if (status & GRUB_USB_HUB_STATUS_PORT_LOWSPEED)
speed = GRUB_USB_SPEED_LOW;
else
{
@@ -651,7 +679,7 @@ poll_nonroot_hub (grub_usb_device_t dev)
grub_millisleep (10);
/* Find correct values for SPLIT hubport and hubaddr */
- if (speed == GRUB_USB_SPEED_HIGH)
+ if (speed == GRUB_USB_SPEED_HIGH || speed == GRUB_USB_SPEED_SUPER)
{
/* HIGH speed device needs not transaction translation */
split_hubport = 0;
diff --git a/include/grub/usbdesc.h b/include/grub/usbdesc.h
index bb2ab2e27..1697aa465 100644
--- a/include/grub/usbdesc.h
+++ b/include/grub/usbdesc.h
@@ -30,6 +30,7 @@ typedef enum {
GRUB_USB_DESCRIPTOR_ENDPOINT,
GRUB_USB_DESCRIPTOR_DEBUG = 10,
GRUB_USB_DESCRIPTOR_HUB = 0x29,
+ GRUB_USB_DESCRIPTOR_SS_HUB = 0x2a,
GRUB_USB_DESCRIPTOR_SS_ENDPOINT_COMPANION = 0x30
} grub_usb_descriptor_t;
diff --git a/include/grub/usbtrans.h b/include/grub/usbtrans.h
index 039ebed65..d6c3f71dc 100644
--- a/include/grub/usbtrans.h
+++ b/include/grub/usbtrans.h
@@ -110,6 +110,10 @@ enum
GRUB_USB_REQ_SET_INTERFACE = 0x0B,
GRUB_USB_REQ_SYNC_FRAME = 0x0C
};
+enum
+ {
+ GRUB_USB_HUB_REQ_SET_HUB_DEPTH = 0x0C,
+ };
#define GRUB_USB_FEATURE_ENDP_HALT 0x00
#define GRUB_USB_FEATURE_DEV_REMOTE_WU 0x01
--
2.39.5