Browse Source

[sanboot] Prevent leaking a stack reference for "keep-san" AoE

When the "keep-san" option is used, the function is exited without
unregistering the stack allocated int13h drive.  To prevent a dangling
pointer to the stack, these structs should be heap allocated.

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Marty Connor <mdc@etherboot.org>
tags/v1.0.0-rc1
Stefan Hajnoczi 14 years ago
parent
commit
37883e99fd
1 changed files with 33 additions and 21 deletions
  1. 33
    21
      src/arch/i386/interface/pcbios/aoeboot.c

+ 33
- 21
src/arch/i386/interface/pcbios/aoeboot.c View File

@@ -1,11 +1,11 @@
1 1
 #include <stdint.h>
2 2
 #include <string.h>
3
+#include <stdlib.h>
3 4
 #include <stdio.h>
4
-#include <byteswap.h>
5
+#include <errno.h>
5 6
 #include <gpxe/aoe.h>
6 7
 #include <gpxe/ata.h>
7 8
 #include <gpxe/netdevice.h>
8
-#include <gpxe/settings.h>
9 9
 #include <gpxe/sanboot.h>
10 10
 #include <gpxe/abft.h>
11 11
 #include <int13.h>
@@ -13,50 +13,62 @@
13 13
 FILE_LICENCE ( GPL2_OR_LATER );
14 14
 
15 15
 static int aoeboot ( const char *root_path ) {
16
-	struct ata_device ata;
17
-	struct int13_drive drive;
16
+	struct ata_device *ata;
17
+	struct int13_drive *drive;
18 18
 	int rc;
19 19
 
20
-	memset ( &ata, 0, sizeof ( ata ) );
21
-	memset ( &drive, 0, sizeof ( drive ) );
20
+	ata = zalloc ( sizeof ( *ata ) );
21
+	if ( ! ata ) {
22
+		rc = -ENOMEM;
23
+		goto err_alloc_ata;
24
+	}
25
+	drive = zalloc ( sizeof ( *drive ) );
26
+	if ( ! drive ) {
27
+		rc = -ENOMEM;
28
+		goto err_alloc_drive;
29
+	}
22 30
 
23 31
 	/* FIXME: ugly, ugly hack */
24 32
 	struct net_device *netdev = last_opened_netdev();
25 33
 
26
-	if ( ( rc = aoe_attach ( &ata, netdev, root_path ) ) != 0 ) {
34
+	if ( ( rc = aoe_attach ( ata, netdev, root_path ) ) != 0 ) {
27 35
 		printf ( "Could not attach AoE device: %s\n",
28 36
 			 strerror ( rc ) );
29
-		goto error_attach;
37
+		goto err_attach;
30 38
 	}
31
-	if ( ( rc = init_atadev ( &ata ) ) != 0 ) {
39
+	if ( ( rc = init_atadev ( ata ) ) != 0 ) {
32 40
 		printf ( "Could not initialise AoE device: %s\n",
33 41
 			 strerror ( rc ) );
34
-		goto error_init;
42
+		goto err_init;
35 43
 	}
36 44
 
37 45
 	/* FIXME: ugly, ugly hack */
38 46
 	struct aoe_session *aoe =
39
-		container_of ( ata.backend, struct aoe_session, refcnt );
47
+		container_of ( ata->backend, struct aoe_session, refcnt );
40 48
 	abft_fill_data ( aoe );
41 49
 
42
-	drive.blockdev = &ata.blockdev;
50
+	drive->blockdev = &ata->blockdev;
43 51
 
44
-	register_int13_drive ( &drive );
45
-	printf ( "Registered as BIOS drive %#02x\n", drive.drive );
46
-	printf ( "Booting from BIOS drive %#02x\n", drive.drive );
47
-	rc = int13_boot ( drive.drive );
52
+	register_int13_drive ( drive );
53
+	printf ( "Registered as BIOS drive %#02x\n", drive->drive );
54
+	printf ( "Booting from BIOS drive %#02x\n", drive->drive );
55
+	rc = int13_boot ( drive->drive );
48 56
 	printf ( "Boot failed\n" );
49 57
 
50 58
 	/* Leave drive registered, if instructed to do so */
51 59
 	if ( keep_san() )
52 60
 		return rc;
53 61
 
54
-	printf ( "Unregistering BIOS drive %#02x\n", drive.drive );
55
-	unregister_int13_drive ( &drive );
62
+	printf ( "Unregistering BIOS drive %#02x\n", drive->drive );
63
+	unregister_int13_drive ( drive );
56 64
 
57
- error_init:
58
-	aoe_detach ( &ata );
59
- error_attach:
65
+ err_init:
66
+	aoe_detach ( ata );
67
+ err_attach:
68
+	free ( drive );
69
+ err_alloc_drive:
70
+	free ( ata );
71
+ err_alloc_ata:
60 72
 	return rc;
61 73
 }
62 74
 

Loading…
Cancel
Save