Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grub2 for openSUSE:Factory checked in at 2026-10-28 17:44:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grub2 (Old) and /work/SRC/openSUSE:Factory/.grub2.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grub2" Wed Oct 28 17:44:09 2026 rev:403 rq:1392975 version:2.16 Changes: -------- --- /work/SRC/openSUSE:Factory/grub2/grub2.changes 2026-10-22 19:25:20.058868043 +0200 +++ /work/SRC/openSUSE:Factory/.grub2.new.2252680/grub2.changes 2026-10-28 17:44:25.095726869 +0100 @@ -1,0 +2,22 @@ +Thu Oct 22 06:27:52 UTC 2026 - Michael Chang <[email protected]> + +- Fix out-of-bound memory write and uninitialized read in + add_multiple_nvme_bootdevices() when adding boot device to PowerPC + OpenFirmware's boot list (bsc#1284464) + * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch + * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch + * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch +- Fix memory leak in error path, add missing error return check in + grub_initrd_component(), ensure NULL check before memset() in + grub_cryptokey_discard() (bsc#1284464) + * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch + * 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch + * Fix-the-size-calculation-for-the-synthesized-initrd.patch +- Fix out-of-bound memory write in add_multiple_dm_multipath_bootdevices() when + adding boot device to PowerPC OpenFirmware's boot list + * 0001-ieee1275-support-dm-multipath-bootlist.patch +- Rebase patches + * 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch + * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch + +------------------------------------------------------------------- New: ---- 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch ----------(New B)---------- New: OpenFirmware's boot list (bsc#1284464) * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch New: * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch New: * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch - Fix memory leak in error path, add missing error return check in ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grub2.spec ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.271859616 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.273859700 +0100 @@ -216,6 +216,9 @@ Patch: 0002-mfa-reject-keyfile-offset-at-EOF-to-prevent-empty-ke.patch Patch: 0003-mfa-wipe-key-buffer-on-file-read-error.patch Patch: 0004-mfa-require-both-factors-to-provide-non-empty-keys.patch +Patch: 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch +Patch: 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch +Patch: 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch # Downstream patches below Patch: rename-grub-info-file-to-grub2.patch Patch: grub2-linux.patch ++++++ 0001-Improve-TPM-key-protection-on-boot-interruptions.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.324861832 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.327861957 +0100 @@ -93,8 +93,8 @@ + FOR_LIST_ELEMENTS_SAFE (cur, nxt, cryptokey_lst) { grub_list_remove (GRUB_AS_LIST (cur)); - grub_memset (cur->key, 0, cur->key_len); -@@ -69,6 +75,20 @@ + if (cur->key) +@@ -70,6 +76,20 @@ } } @@ -115,7 +115,7 @@ static grub_err_t grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), int argc, char **argv) -@@ -92,7 +112,7 @@ +@@ -93,7 +113,7 @@ } /*FIXME: Validate UUID string*/ @@ -144,7 +144,7 @@ #endif goto cleanup; } -@@ -1307,7 +1311,7 @@ +@@ -1314,7 +1318,7 @@ #ifndef GRUB_UTIL if (cargs->key_data && dev) @@ -153,7 +153,7 @@ #endif if (askpass) { -@@ -1890,6 +1894,10 @@ +@@ -1897,6 +1901,10 @@ grub_cryptodisk_t i; grub_uint8_t *buf; @@ -166,7 +166,7 @@ grub_fatal ("grub_cryptodisk_erasesecrets: cannot allocate memory"); --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c -@@ -226,13 +226,13 @@ +@@ -232,13 +232,13 @@ int i; int newc = 0; struct dir *root = 0; @@ -182,7 +182,7 @@ if (pk->key && pk->path) numkey++; -@@ -305,7 +305,7 @@ +@@ -326,7 +326,7 @@ goto overflow; } @@ -190,7 +190,7 @@ + FOR_LIST_ELEMENTS (pk, cryptokey_lst) if (pk->key && pk->path) { - grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); + grub_err_t err; --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -599,7 +599,7 @@ @@ -212,7 +212,7 @@ #ifdef GRUB_MACHINE_IEEE1275 #include <grub/ieee1275/ieee1275.h> #endif -@@ -770,6 +771,7 @@ +@@ -756,6 +757,7 @@ if (grub_key_is_interrupt (key)) { timeout = -1; @@ -220,7 +220,7 @@ break; } -@@ -852,6 +854,11 @@ +@@ -838,6 +840,11 @@ clear_timeout (); } ++++++ 0001-ieee1275-support-dm-multipath-bootlist.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.423865969 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.426866095 +0100 @@ -21,11 +21,9 @@ grub-core/osdep/unix/platform.c | 115 ++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) -diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c -index e8e28f3d4..733a8ec55 100644 --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c -@@ -304,6 +304,112 @@ add_multiple_nvme_bootdevices (const char *install_device) +@@ -364,6 +364,112 @@ return multipath_boot; } @@ -95,7 +93,7 @@ + } + + physical_paths[num_path++] = p; -+ if (num_path > max_physical_path) ++ if (num_path >= max_physical_path) + break; + } + @@ -138,9 +136,9 @@ void grub_install_register_ieee1275 (int is_prep, const char *install_device, int partno, const char *relpath) -@@ -355,6 +461,15 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, - free (boot_device); - boot_device = add_multiple_nvme_bootdevices (install_device); +@@ -421,6 +527,15 @@ + grub_util_error (_("couldn't find IEEE1275 device path for %s.\nYou will have to set `boot-device' variable manually"), + install_device); } + else + { @@ -154,7 +152,4 @@ } if (grub_util_exec ((const char * []){ "nvsetenv", "boot-device", --- -2.53.0 - ++++++ 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch ++++++ >From b83c1b1d0b7f9a65cd4f4f4cc80f58b3b8c3ede9 Mon Sep 17 00:00:00 2001 From: Michael Chang <[email protected]> Date: Thu, 8 Oct 2026 12:12:58 +0800 Subject: [PATCH 1/3] osdep/unix/platform: Fix NVMe boot-device buffer bounds and termination In add_multiple_nvme_bootdevices(), multipath_boot was allocated with xmalloc() and then used with strlen() before guaranteed initialization. This could read uninitialized memory while computing append space. The function also ended with "*--ptr = '\0'". If no entry was appended, ptr still pointed to the buffer start, so the pre-decrement wrote before the allocation. Initialize the buffer with an empty string, keep it NUL-terminated after each append, and remove the final pre-decrement write. Also tighten the capacity check to use >= and add a bounds check for the non-splitter path append. Fixes: 0f13508bc ("ieee1275: support added for multiple nvme bootpaths") Assisted-by: GitHub Copilot:gpt-5.3-codex Signed-off-by: Michael Chang <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> --- grub-core/osdep/unix/platform.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c index dc5270a7c..b79d3913d 100644 --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c @@ -271,11 +271,20 @@ add_multiple_nvme_bootdevices (const char *install_device) } ptr = multipath_boot = xmalloc (BOOTDEV_BUFFER); + *ptr = '\0'; if (is_splitter == false && is_FC == false) { + size_t len; non_splitter_path = xasprintf ("%s/namespace@%x:1 ", get_ofpathname (dirR1), nsid); - memcpy (ptr, non_splitter_path, strlen (non_splitter_path)); - ptr += strlen (non_splitter_path); + len = strlen (non_splitter_path); + if (len < BOOTDEV_BUFFER) + { + memcpy (ptr, non_splitter_path, len); + ptr += len; + *ptr = '\0'; + } + else + grub_util_warn (_("Maximum size of bootlist exceeded")); free (non_splitter_path); } else @@ -290,7 +299,7 @@ add_multiple_nvme_bootdevices (const char *install_device) grub_strstr (ep->d_name, dirR2) == NULL) continue; path = xasprintf ("%s/namespace@%x ", get_ofpathname (ep->d_name), nsid); - if ((strlen (multipath_boot) + strlen (path)) > BOOTDEV_BUFFER) + if ((strlen (multipath_boot) + strlen (path)) >= BOOTDEV_BUFFER) { grub_util_warn (_("Maximum five entries are allowed in the bootlist")); free (path); @@ -298,11 +307,16 @@ add_multiple_nvme_bootdevices (const char *install_device) } memcpy (ptr, path, strlen (path)); ptr += strlen (path); + *ptr = '\0'; free (path); } } } - *--ptr = '\0'; + + /* Remove trailing space if present */ + if (ptr > multipath_boot && *(ptr - 1) == ' ') + *(ptr - 1) = '\0'; + closedir (dp); free (sysfs_path); free (dirR1); -- 2.56.0 ++++++ 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.521870066 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.527870316 +0100 @@ -16,7 +16,7 @@ --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c -@@ -32,6 +32,7 @@ +@@ -33,6 +33,7 @@ char *buf; char *newc_name; grub_off_t size; @@ -24,23 +24,23 @@ }; struct dir -@@ -203,6 +204,7 @@ +@@ -195,6 +196,7 @@ + goto fail; grub_memcpy (comp->buf, buf, bufsz); - initrd_ctx->nfiles++; comp->size = bufsz; + comp->mode = 0100400; if (grub_add (initrd_ctx->size, comp->size, &initrd_ctx->size)) goto overflow; -@@ -272,6 +274,7 @@ - grub_initrd_close (initrd_ctx); +@@ -283,6 +285,7 @@ + grub_error_pop (); return grub_errno; } + initrd_ctx->components[i].mode = 0100777; name_len = grub_strlen (initrd_ctx->components[i].newc_name) + 1; if (grub_add (initrd_ctx->size, ALIGN_UP (sizeof (struct newc_head) + name_len, 4), -@@ -374,6 +377,7 @@ +@@ -396,6 +399,7 @@ if (initrd_ctx->components[i].newc_name) { grub_size_t dir_size; @@ -48,7 +48,7 @@ if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr, &dir_size)) -@@ -385,7 +389,7 @@ +@@ -406,7 +410,7 @@ ptr += dir_size; ptr = make_header (ptr, initrd_ctx->components[i].newc_name, grub_strlen (initrd_ctx->components[i].newc_name) + 1, ++++++ 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.545871069 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.549871236 +0100 @@ -17,7 +17,7 @@ --- a/grub-core/commands/crypttab.c +++ b/grub-core/commands/crypttab.c -@@ -53,6 +53,22 @@ +@@ -53,6 +53,23 @@ return GRUB_ERR_NONE; } @@ -29,7 +29,8 @@ + FOR_LIST_ELEMENTS_SAFE (cur, nxt, kpuber) + { + grub_list_remove (GRUB_AS_LIST (cur)); -+ grub_memset (cur->key, 0, cur->key_len); ++ if (cur->key) ++ grub_memset (cur->key, 0, cur->key_len); + grub_free (cur->name); + grub_free (cur->path); + grub_free (cur->key); @@ -42,7 +43,7 @@ int argc, char **argv) --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c -@@ -37,6 +37,7 @@ +@@ -38,6 +38,7 @@ #ifdef GRUB_MACHINE_IEEE1275 #include <grub/ieee1275/ieee1275.h> #endif @@ -50,7 +51,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); -@@ -478,6 +479,7 @@ +@@ -488,6 +489,7 @@ return; } @@ -68,7 +69,7 @@ enum update_mode { -@@ -1262,6 +1263,8 @@ +@@ -1266,6 +1267,8 @@ return; } ++++++ 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch ++++++ >From 3fada8f23d6074cc04351e6150f9e385a3c5dd37 Mon Sep 17 00:00:00 2001 From: Michael Chang <[email protected]> Date: Tue, 13 Oct 2026 13:17:36 +0800 Subject: [PATCH 2/3] osdep/unix/platform: Handle missing IEEE1275 NVMe boot path When add_multiple_nvme_bootdevices() cannot find any valid NVMe boot device paths, it returns an empty string instead of NULL. Return NULL when multipath_boot is empty, and check the return value in grub_install_register_ieee1275() so an error is reported instead of setting an empty boot-device variable. Fixes: 0f13508bc ("ieee1275: support added for multiple nvme bootpaths") Assisted-by: GitHub Copilot:gpt-5.3-codex Signed-off-by: Michael Chang <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> --- grub-core/osdep/unix/platform.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c index b79d3913d..70050f5a7 100644 --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c @@ -322,6 +322,12 @@ add_multiple_nvme_bootdevices (const char *install_device) free (dirR1); free (dirR2); + if (*multipath_boot == '\0') + { + free (multipath_boot); + return NULL; + } + return multipath_boot; } @@ -367,6 +373,9 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, else if (grub_strstr (install_device, "nvme")) { boot_device = add_multiple_nvme_bootdevices (install_device); + if (boot_device == NULL) + grub_util_error (_("couldn't find IEEE1275 device path for %s.\nYou will have to set `boot-device' variable manually"), + install_device); } else { @@ -375,6 +384,9 @@ grub_install_register_ieee1275 (int is_prep, const char *install_device, { free (boot_device); boot_device = add_multiple_nvme_bootdevices (install_device); + if (boot_device == NULL) + grub_util_error (_("couldn't find IEEE1275 device path for %s.\nYou will have to set `boot-device' variable manually"), + install_device); } } -- 2.56.0 ++++++ 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch ++++++ >From 28b7bc3489ea3a4e143647c01f2a75ce2d006441 Mon Sep 17 00:00:00 2001 From: Michael Chang <[email protected]> Date: Tue, 13 Oct 2026 13:21:36 +0800 Subject: [PATCH 3/3] osdep/unix/platform: Fix memory leaks in add_multiple_nvme_bootdevices() In add_multiple_nvme_bootdevices(), strings returned by get_ofpathname() were passed directly to xasprintf() without being freed, leaking memory. Additionally, sysfs_path was leaked when opening the splitter directory failed. Assign the initial get_ofpathname() result directly to ofpath, store subsequent results in a temporary variable to free them after use, and free sysfs_path on the splitter_dp failure path. Fixes: 0f13508bc ("ieee1275: support added for multiple nvme bootpaths") Assisted-by: GitHub Copilot:gpt-5.3-codex Signed-off-by: Michael Chang <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Sudhakar Kuppusamy <[email protected]> --- grub-core/osdep/unix/platform.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/grub-core/osdep/unix/platform.c b/grub-core/osdep/unix/platform.c index 70050f5a7..cd34e12ef 100644 --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c @@ -206,7 +206,7 @@ add_multiple_nvme_bootdevices (const char *install_device) return NULL; sysfs_path = nvme_get_syspath (nvme_ns); - ofpath = xasprintf ("%s", get_ofpathname (nvme_ns)); + ofpath = get_ofpathname (nvme_ns); if (grub_strstr (ofpath, "fibre-channel")) { @@ -234,6 +234,7 @@ add_multiple_nvme_bootdevices (const char *install_device) free (splitter_info_path); if (!splitter_dp) { + free (sysfs_path); free (dirR1); return NULL; } @@ -275,7 +276,9 @@ add_multiple_nvme_bootdevices (const char *install_device) if (is_splitter == false && is_FC == false) { size_t len; - non_splitter_path = xasprintf ("%s/namespace@%x:1 ", get_ofpathname (dirR1), nsid); + char *p = get_ofpathname (dirR1); + non_splitter_path = xasprintf ("%s/namespace@%x:1 ", p, nsid); + free (p); len = strlen (non_splitter_path); if (len < BOOTDEV_BUFFER) { @@ -295,10 +298,13 @@ add_multiple_nvme_bootdevices (const char *install_device) if (grub_strstr (ep->d_name, "nvme") != NULL) { + char *p; if (is_FC == false && grub_strstr (ep->d_name, dirR1) == NULL && grub_strstr (ep->d_name, dirR2) == NULL) continue; - path = xasprintf ("%s/namespace@%x ", get_ofpathname (ep->d_name), nsid); + p = get_ofpathname (ep->d_name); + path = xasprintf ("%s/namespace@%x ", p, nsid); + free (p); if ((strlen (multipath_boot) + strlen (path)) >= BOOTDEV_BUFFER) { grub_util_warn (_("Maximum five entries are allowed in the bootlist")); -- 2.56.0 ++++++ 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.695877338 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.697877422 +0100 @@ -29,11 +29,9 @@ 5 files changed, 193 insertions(+), 5 deletions(-) create mode 100644 grub-core/commands/crypttab.c -Index: grub-2.16/grub-core/Makefile.core.def -=================================================================== ---- grub-2.16.orig/grub-core/Makefile.core.def -+++ grub-2.16/grub-core/Makefile.core.def -@@ -2906,3 +2906,8 @@ module = { +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -2906,3 +2906,8 @@ cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; }; @@ -42,10 +40,8 @@ + name = crypttab; + common = commands/crypttab.c; +}; -Index: grub-2.16/grub-core/commands/crypttab.c -=================================================================== --- /dev/null -+++ grub-2.16/grub-core/commands/crypttab.c ++++ b/grub-core/commands/crypttab.c @@ -0,0 +1,47 @@ + +#include <grub/dl.h> @@ -94,10 +90,8 @@ +{ + grub_unregister_command (cmd); +} -Index: grub-2.16/grub-core/disk/cryptodisk.c -=================================================================== ---- grub-2.16.orig/grub-core/disk/cryptodisk.c -+++ grub-2.16/grub-core/disk/cryptodisk.c +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c @@ -33,6 +33,8 @@ #ifdef GRUB_UTIL @@ -107,7 +101,7 @@ #endif GRUB_MOD_LICENSE ("GPLv3+"); -@@ -1310,6 +1312,10 @@ grub_cryptodisk_scan_device_real (const +@@ -1310,6 +1312,10 @@ if (cargs->hdr_file != NULL) source->read_hook = NULL; @@ -118,10 +112,8 @@ if (askpass) { grub_memset (cargs->key_data, 0, cargs->key_len); -Index: grub-2.16/grub-core/loader/linux.c -=================================================================== ---- grub-2.16.orig/grub-core/loader/linux.c -+++ grub-2.16/grub-core/loader/linux.c +--- a/grub-core/loader/linux.c ++++ b/grub-core/loader/linux.c @@ -6,6 +6,7 @@ #include <grub/mm.h> #include <grub/safemath.h> @@ -130,7 +122,7 @@ struct newc_head { -@@ -28,6 +29,7 @@ struct newc_head +@@ -28,6 +29,7 @@ struct grub_linux_initrd_component { grub_file_t file; @@ -138,7 +130,7 @@ char *newc_name; grub_off_t size; }; -@@ -39,6 +41,18 @@ struct dir +@@ -39,6 +41,18 @@ struct dir *child; }; @@ -157,7 +149,7 @@ static char hex (grub_uint8_t val) { -@@ -163,6 +177,65 @@ insert_dir (const char *name, struct dir +@@ -163,6 +177,70 @@ return GRUB_ERR_NONE; } @@ -176,11 +168,7 @@ + comp->newc_name = grub_strdup (newc_name); + if (!comp->newc_name || + insert_dir (comp->newc_name, &root, 0, &dir_size)) -+ { -+ /* FIXME: Check NULL file pointer before close */ -+ grub_initrd_close (initrd_ctx); -+ return grub_errno; -+ } ++ goto fail; + /* Should name_len count terminating null ? */ + name_len = grub_strlen (comp->newc_name) + 1; + if (grub_add (initrd_ctx->size, @@ -191,13 +179,8 @@ + + comp->buf = grub_malloc (bufsz); + if (!comp->buf) -+ { -+ free_dir (root); -+ grub_initrd_close (initrd_ctx); -+ return grub_errno; -+ } ++ goto fail; + grub_memcpy (comp->buf, buf, bufsz); -+ initrd_ctx->nfiles++; + comp->size = bufsz; + if (grub_add (initrd_ctx->size, comp->size, + &initrd_ctx->size)) @@ -210,20 +193,34 @@ + &initrd_ctx->size)) + goto overflow; + ++ /* Component fully built: only now is it owned by grub_initrd_close(). */ ++ initrd_ctx->nfiles++; + free_dir (root); -+ root = 0; + return GRUB_ERR_NONE; + + overflow: -+ free_dir (root); -+ grub_initrd_close (initrd_ctx); -+ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ ++ fail: ++ { ++ grub_error_push (); ++ ++ /* This slot is not counted in nfiles, so free it here exactly once. */ ++ grub_free (comp->newc_name); ++ grub_free (comp->buf); ++ comp->newc_name = NULL; ++ comp->buf = NULL; ++ free_dir (root); ++ grub_initrd_close (initrd_ctx); ++ grub_error_pop (); ++ return grub_errno; ++ } +} + grub_err_t grub_initrd_init (int argc, char *argv[], struct grub_linux_initrd_context *initrd_ctx) -@@ -170,11 +243,17 @@ grub_initrd_init (int argc, char *argv[] +@@ -170,11 +248,17 @@ int i; int newc = 0; struct dir *root = 0; @@ -242,7 +239,46 @@ if (!initrd_ctx->components) return grub_errno; -@@ -255,6 +334,10 @@ grub_initrd_init (int argc, char *argv[] +@@ -202,7 +286,12 @@ + insert_dir (initrd_ctx->components[i].newc_name, &root, 0, + &dir_size)) + { ++ grub_error_push (); ++ grub_free (initrd_ctx->components[i].newc_name); ++ initrd_ctx->components[i].newc_name = NULL; ++ free_dir (root); + grub_initrd_close (initrd_ctx); ++ grub_error_pop (); + return grub_errno; + } + name_len = grub_strlen (initrd_ctx->components[i].newc_name) + 1; +@@ -210,7 +299,11 @@ + ALIGN_UP (sizeof (struct newc_head) + name_len, 4), + &initrd_ctx->size) || + grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size)) +- goto overflow; ++ { ++ grub_free (initrd_ctx->components[i].newc_name); ++ initrd_ctx->components[i].newc_name = NULL; ++ goto overflow; ++ } + newc = 1; + fname = eptr + 1; + } +@@ -232,7 +325,12 @@ + | GRUB_FILE_TYPE_VERIFY_IN_PLACE); + if (!initrd_ctx->components[i].file) + { ++ grub_error_push (); ++ grub_free (initrd_ctx->components[i].newc_name); ++ initrd_ctx->components[i].newc_name = NULL; ++ free_dir (root); + grub_initrd_close (initrd_ctx); ++ grub_error_pop (); + return grub_errno; + } + initrd_ctx->nfiles++; +@@ -255,6 +353,10 @@ root = 0; } @@ -253,7 +289,7 @@ return GRUB_ERR_NONE; overflow: -@@ -278,7 +361,9 @@ grub_initrd_close (struct grub_linux_ini +@@ -278,7 +380,9 @@ for (i = 0; i < initrd_ctx->nfiles; i++) { grub_free (initrd_ctx->components[i].newc_name); @@ -264,7 +300,7 @@ } grub_free (initrd_ctx->components); initrd_ctx->components = 0; -@@ -327,7 +412,12 @@ grub_initrd_load (struct grub_linux_init +@@ -327,7 +431,12 @@ } cursize = initrd_ctx->components[i].size; @@ -278,7 +314,7 @@ != cursize) { if (!grub_errno) -@@ -381,3 +471,45 @@ grub_initrd_load (struct grub_linux_init +@@ -381,3 +490,45 @@ grub_initrd_close (initrd_ctx); return status; } @@ -324,11 +360,9 @@ + + return GRUB_ERR_NONE; +} -Index: grub-2.16/include/grub/linux.h -=================================================================== ---- grub-2.16.orig/include/grub/linux.h -+++ grub-2.16/include/grub/linux.h -@@ -22,3 +22,6 @@ grub_initrd_close (struct grub_linux_ini +--- a/include/grub/linux.h ++++ b/include/grub/linux.h +@@ -22,3 +22,6 @@ grub_err_t grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, void *target); ++++++ Fix-the-size-calculation-for-the-synthesized-initrd.patch ++++++ --- /var/tmp/diff_new_pack.v5o9N0/_old 2026-10-28 17:44:28.744879386 +0100 +++ /var/tmp/diff_new_pack.v5o9N0/_new 2026-10-28 17:44:28.747879512 +0100 @@ -26,11 +26,9 @@ grub-core/loader/linux.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) -diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c -index 4e028f5..9ee8f37 100644 --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c -@@ -209,13 +209,6 @@ grub_initrd_component (const char *buf, int bufsz, const char *newc_name, +@@ -201,13 +201,6 @@ &initrd_ctx->size)) goto overflow; @@ -41,24 +39,32 @@ - &initrd_ctx->size)) - goto overflow; - + /* Component fully built: only now is it owned by grub_initrd_close(). */ + initrd_ctx->nfiles++; free_dir (root); - root = 0; - return GRUB_ERR_NONE; -@@ -312,6 +305,13 @@ grub_initrd_init (int argc, char *argv[], +@@ -333,6 +326,21 @@ goto overflow; } + FOR_LIST_ELEMENTS (pk, kpuber) + if (pk->key && pk->path) + { -+ grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); ++ grub_err_t err; ++ ++ err = grub_initrd_component (pk->key, pk->key_len, pk->path, initrd_ctx); ++ if (err != GRUB_ERR_NONE) ++ { ++ /* grub_initrd_component() already closed initrd_ctx. */ ++ free_dir (root); ++ return err; ++ } + newc = 1; + } + if (newc) { initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4); -@@ -324,10 +324,6 @@ grub_initrd_init (int argc, char *argv[], +@@ -345,10 +353,6 @@ root = 0; } @@ -69,7 +75,7 @@ return GRUB_ERR_NONE; overflow: -@@ -404,10 +400,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, +@@ -425,10 +429,7 @@ cursize = initrd_ctx->components[i].size; if (initrd_ctx->components[i].buf) @@ -81,7 +87,4 @@ else if (grub_file_read (initrd_ctx->components[i].file, ptr, cursize) != cursize) { --- -2.35.3 -
