When a module is attempted to be removed its reference counter is always
decremented. This means that repeated rmmod invocations will cause the
module to be unloaded even if another module depends on it.
This may lead to a use-after-free scenario allowing an attacker to execute
arbitrary code and by-pass the UEFI Secure Boot protection.
While being there, add the extern keyword to some function declarations in
that header file.
Fixes: CVE-2020-25632
Reported-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This type of modules cannot be unloaded. This is useful if a given
functionality, e.g. UEFI secure boot shim signature verification, should
not be disabled if it was enabled at some point in time. Somebody may
say that we can use standalone GRUB2 here. That is true. However, the
code is not so big nor complicated hence it make sense to support
modularized configs too.
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
Let's provide file type info to the I/O layer. This way verifiers
framework and its users will be able to differentiate files and verify
only required ones.
This is preparatory patch.
Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com>
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Ross Philipson <ross.philipson@oracle.com>
* configure.ac: --enable-cache-stats added.
* config.h.in (DISK_CACHE_STATS): New define.
* grub-core/Makefile.core.def (cacheinfo): New command.
* include/grub/disk.h(grub_disk_cache_get_performance): New function.
* grub-core/commands/cacheinfo.c: New file.
* grub-core/commands/minicmd.c (grub_rescue_cmd_info): Updated and
moved to cacheinfo.c.
* grub-core/kern/disk.c: Use DISK_CACHE_STATS to disable disk cache
debug code.
* include/grub/disk.h: Likewise.
* grub-core/commands/minicmd.c (grub_rescue_cmd_testload) [0]: Moved
from here ...
* grub-core/commands/testload.c (grub_cmd_testload): ... here.
(GRUB_MOD_INIT): New function.
(GRUB_MOD_FINI): Likewise.
* grub-core/Makefile.core.def (testload): New module.
