diff options
| -rw-r--r-- | util/nvmutil/nvmutil.c | 232 |
1 files changed, 166 insertions, 66 deletions
diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c index da6336aa..1a3ee366 100644 --- a/util/nvmutil/nvmutil.c +++ b/util/nvmutil/nvmutil.c @@ -135,6 +135,11 @@ CFLAGS += -fstack-protector-strong CFLAGS += -fno-common CFLAGS += -D_FORTIFY_SOURCE=2 CFLAGS += -fPIE + +also consider: +-fstack-clash-protection +-Wl,-z,relro +-Wl,-z,now */ #ifndef _XOPEN_SOURCE @@ -177,6 +182,7 @@ typedef unsigned int uint32_t; #include <time.h> #include <unistd.h> +/* type asserts */ typedef char static_assert_char_is_8_bits[(CHAR_BIT == 8) ? 1 : -1]; typedef char static_assert_uint8_is_1[(sizeof(uint8_t) == 1) ? 1 : -1]; typedef char static_assert_uint16_is_2[(sizeof(uint16_t) == 2) ? 1 : -1]; @@ -225,8 +231,8 @@ typedef char static_assert_off_t_is_32[(sizeof(off_t) >= 4) ? 1 : -1]; #define O_BINARY 0 #endif -#ifndef O_NONBLOCK -#define O_NONBLOCK 0 +#ifndef O_NOFOLLOW +#define O_NOFOLLOW 0 #endif /* @@ -234,8 +240,6 @@ typedef char static_assert_off_t_is_32[(sizeof(off_t) >= 4) ? 1 : -1]; */ static void sanitize_command_list(void); static void sanitize_command_index(size_t c); -static void check_enum_bin(size_t a, const char *a_name, - size_t b, const char *b_name); /* * Argument handling (user input) @@ -254,6 +258,7 @@ static int xstrxcmp(const char *a, const char *b, size_t maxlen); */ static void open_dev_urandom(void); static void open_gbe_file(void); +static void lock_gbe_file(void); static void xopen(int *fd, const char *path, int flags, struct stat *st); /* @@ -344,6 +349,8 @@ static ssize_t do_rw(int fd, static ssize_t prw(int fd, void *mem, size_t nrw, off_t off, int rw_type); static off_t lseek_eintr(int fd, off_t off, int whence); +static int io_args(int fd, size_t nrw, + off_t off, int rw_type); /* * Error handling and cleanup @@ -381,6 +388,8 @@ static void usage(uint8_t usage_exit); #define NVM_WORDS (NVM_SIZE >> 1) #define NVM_CHECKSUM_WORD (NVM_WORDS - 1) +#define NUM_RANDOM_BYTES 12 + /* * Portable macro based on BSD nitems. * Used to count the number of commands (see below). @@ -558,12 +567,40 @@ static const struct commands command[] = { */ static size_t cmd_index = CMD_NULL; +/* + * asserts (variables/defines sanity check) + */ typedef char assert_argc3[(ARGC_3==3)?1:-1]; typedef char assert_argc4[(ARGC_4==4)?1:-1]; typedef char assert_read[(IO_READ==0)?1:-1]; typedef char assert_write[(IO_WRITE==1)?1:-1]; typedef char assert_pread[(IO_PREAD==2)?1:-1]; typedef char assert_pwrite[(IO_PWRITE==3)?1:-1]; +typedef char assert_rand_byte[(NUM_RANDOM_BYTES>0)?1:-1]; +typedef char assert_rand_len[(NUM_RANDOM_BYTES<NVM_SIZE)?1:-1]; +/* commands */ +typedef char assert_cmd_dump[(CMD_DUMP==0)?1:-1]; +typedef char assert_cmd_setmac[(CMD_SETMAC==1)?1:-1]; +typedef char assert_cmd_swap[(CMD_SWAP==2)?1:-1]; +typedef char assert_cmd_copy[(CMD_COPY==3)?1:-1]; +typedef char assert_cmd_cat[(CMD_CAT==4)?1:-1]; +typedef char assert_cmd_cat16[(CMD_CAT16==5)?1:-1]; +typedef char assert_cmd_cat128[(CMD_CAT128==6)?1:-1]; +/* mod_type */ +typedef char assert_mod_off[(SET_MOD_OFF==0)?1:-1]; +typedef char assert_mod_0[(SET_MOD_0==1)?1:-1]; +typedef char assert_mod_1[(SET_MOD_1==2)?1:-1]; +typedef char assert_mod_n[(SET_MOD_N==3)?1:-1]; +typedef char assert_mod_both[(SET_MOD_BOTH==4)?1:-1]; +/* bool */ +typedef char bool_arg_nopart[(ARG_NOPART==0)?1:-1]; +typedef char bool_arg_part[(ARG_PART==1)?1:-1]; +typedef char bool_skip_checksum_read[(SKIP_CHECKSUM_READ==0)?1:-1]; +typedef char bool_checksum_read[(CHECKSUM_READ==1)?1:-1]; +typedef char bool_skip_checksum_write[(SKIP_CHECKSUM_WRITE==0)?1:-1]; +typedef char bool_checksum_write[(CHECKSUM_WRITE==1)?1:-1]; +typedef char bool_no_invert[(NO_INVERT==0)?1:-1]; +typedef char bool_part_invert[(PART_INVERT==1)?1:-1]; static int use_prng = 0; @@ -621,6 +658,7 @@ main(int argc, char *argv[]) open_dev_urandom(); open_gbe_file(); + lock_gbe_file(); #ifdef NVMUTIL_PLEDGE if (pledge("stdio", NULL) == -1) @@ -657,6 +695,9 @@ sanitize_command_list(void) sanitize_command_index(c); } +/* + * TODO: specific config checks per command + */ static void sanitize_command_index(size_t c) { @@ -682,15 +723,6 @@ sanitize_command_index(size_t c) (unsigned long)c, command[c].str); } - if (!((CMD_SETMAC > CMD_DUMP) && (CMD_SWAP > CMD_SETMAC) && - (CMD_COPY > CMD_SWAP) && (CMD_CAT > CMD_COPY) && - (CMD_CAT16 > CMD_CAT) && (CMD_CAT128 > CMD_CAT16))) - err(EINVAL, "Some command integers are the same"); - - if (!((SET_MOD_0 > SET_MOD_OFF) && (SET_MOD_1 > SET_MOD_0) && - (SET_MOD_N > SET_MOD_1) && (SET_MOD_BOTH > SET_MOD_N))) - err(EINVAL, "Some modtype integers are the same"); - mod_type = command[c].set_modified; switch (mod_type) { case SET_MOD_0: @@ -708,13 +740,6 @@ sanitize_command_index(size_t c) check_bin(command[c].chksum_read, "cmd.chksum_read"); check_bin(command[c].chksum_write, "cmd.chksum_write"); - check_enum_bin(ARG_NOPART, "ARG_NOPART", ARG_PART, "ARG_PART"); - check_enum_bin(SKIP_CHECKSUM_READ, "SKIP_CHECKSUM_READ", - CHECKSUM_READ, "CHECKSUM_READ"); - check_enum_bin(SKIP_CHECKSUM_WRITE, "SKIP_CHECKSUM_WRITE", - CHECKSUM_WRITE, "CHECKSUM_WRITE"); - check_enum_bin(NO_INVERT, "NO_INVERT", PART_INVERT, "PART_INVERT"); - gbe_rw_size = command[c].rw_size; switch (gbe_rw_size) { @@ -736,17 +761,6 @@ sanitize_command_index(size_t c) } static void -check_enum_bin(size_t a, const char *a_name, - size_t b, const char *b_name) -{ - if (a) - err(EINVAL, "%s is non-zero", a_name); - - if (b != 1) - err(EINVAL, "%s is a value other than 1", b_name); -} - -static void set_cmd(int argc, char *argv[]) { const char *cmd_str; @@ -858,7 +872,8 @@ open_gbe_file(void) { struct stat gbe_st; - xopen(&gbe_fd, fname, command[cmd_index].flags | O_BINARY, &gbe_st); + xopen(&gbe_fd, fname, + command[cmd_index].flags | O_BINARY | O_NOFOLLOW, &gbe_st); gbe_file_size = gbe_st.st_size; @@ -873,6 +888,24 @@ open_gbe_file(void) } static void +lock_gbe_file(void) +{ + struct flock fl; + + memset(&fl, 0, sizeof(fl)); + + if (command[cmd_index].flags == O_RDONLY) + fl.l_type = F_RDLCK; + else + fl.l_type = F_WRLCK; + + fl.l_whence = SEEK_SET; + + if (fcntl(gbe_fd, F_SETLK, &fl) == -1) + err(errno, "file is locked by another process"); +} + +static void xopen(int *fd_ptr, const char *path, int flags, struct stat *st) { if ((*fd_ptr = open(path, flags)) == -1) @@ -1125,7 +1158,7 @@ static uint16_t rhex(void) { static size_t n = 0; - static uint8_t rnum[12]; + static uint8_t rnum[NUM_RANDOM_BYTES]; if (use_prng) return fallback_rand(); @@ -1171,6 +1204,7 @@ entropy_jitter(void) { struct timeval a, b; unsigned long mix = 0; + long mix_diff; int i; for (i = 0; i < 8; i++) { @@ -1178,7 +1212,15 @@ entropy_jitter(void) getpid(); gettimeofday(&b, NULL); - mix ^= (unsigned long)(b.tv_usec - a.tv_usec); + /* + * prevent negative numbers to prevent overflow, + * which would bias rand to large numbers + */ + mix_diff = (long)(b.tv_usec - a.tv_usec); + if (mix_diff < 0) + mix_diff = -mix_diff; + + mix ^= (unsigned long)(mix_diff); mix ^= (unsigned long)&mix; } @@ -1233,7 +1275,9 @@ print_mac_from_nvm(size_t partnum) for (c = 0; c < 3; c++) { val16 = nvm_word(c, partnum); - printf("%02x:%02x", val16 & 0xff, val16 >> 8); + printf("%02x:%02x", + (unsigned int)(val16 & 0xff), + (unsigned int)(val16 >> 8)); if (c == 2) printf("\n"); else @@ -1254,7 +1298,9 @@ hexdump(size_t partnum) val16 = nvm_word((row << 3) + c, partnum); if (c == 4) printf(" "); - printf(" %02x %02x", val16 & 0xff, val16 >> 8); + printf(" %02x %02x", + (unsigned int)(val16 & 0xff), + (unsigned int)(val16 >> 8)); } printf("\n"); } @@ -1312,6 +1358,8 @@ gbe_cat_buf(uint8_t *b) static void write_gbe_file(void) { + struct stat gbe_st; + size_t p; size_t partnum; uint8_t update_checksum; @@ -1322,6 +1370,15 @@ write_gbe_file(void) update_checksum = command[cmd_index].chksum_write; override_part_modified(); + + if (fstat(gbe_fd, &gbe_st) == -1) + err(errno, "%s: re-check", fname); + + if (gbe_st.st_size != gbe_file_size) + err(errno, "%s: file size changed before write", fname); + + if (!S_ISREG(gbe_st.st_mode)) + err(errno, "%s: file type changed before write", fname); for (p = 0; p < 2; p++) { partnum = p ^ command[cmd_index].invert; @@ -1456,7 +1513,11 @@ rw_gbe_file_part(size_t p, int rw_type, uint8_t *mem_offset; - if (rw_type == IO_WRITE || rw_type == IO_PWRITE) + if (rw_type < IO_PREAD || rw_type > IO_PWRITE) + err(errno, "%s: %s: part %lu: invalid rw_type, %d", + fname, rw_type_str, (unsigned long)p, rw_type); + + if (rw_type == IO_PWRITE) invert = 0; /* @@ -1526,7 +1587,7 @@ gbe_x_offset(size_t p, const char *f_op, const char *d_type, /* * Read or write the exact contents of a file, * along with a buffer, (if applicable) offset, - * and number of bytes to be read. It unified + * and number of bytes to be read. It unifies * the functionality of read(), pread(), write() * and pwrite(), with retry-on-EINTR and also * prevents infinite loop on zero-reads. @@ -1539,33 +1600,21 @@ gbe_x_offset(size_t p, const char *f_op, const char *d_type, * be used on sockets or pipes, because 0-byte * reads are treated like fatal errors. This * means that EOF is also considered fatal. - * - * WARNING: Do not use O_APPEND on open() when - * using this function. If you do, POSIX allows - * write() to ignore the current file offset and - * write at EOF, which means that our use of - * lseek in prw() does not guarantee writing at - * a specified offset. So if using IO_PWRITE or - * IO_PREAD, make sure not to pass a file descriptor - * with the O_APPEND flag. Alternatively, modify - * do_rw() to directly use pwrite() and pread() - * instead of prw(). */ static ssize_t -rw_file_exact(int fd, uint8_t *mem, size_t len, +rw_file_exact(int fd, uint8_t *mem, size_t nrw, off_t off, int rw_type) { ssize_t rv; size_t rc; - if (fd < 0 || !len || len > (size_t)SSIZE_MAX - || (unsigned int)rw_type > IO_PWRITE) { + if (io_args(fd, nrw, off, rw_type) == -1) { errno = EIO; return -1; } - for (rc = 0, rv = 0; rc < len; ) { - if ((rv = rw_file_once(fd, mem, len, off, rw_type, rc)) <= 0) + for (rc = 0, rv = 0; rc < nrw; ) { + if ((rv = rw_file_once(fd, mem, nrw, off, rw_type, rc)) <= 0) return -1; rc += (size_t)rv; @@ -1579,18 +1628,18 @@ rw_file_exact(int fd, uint8_t *mem, size_t len, * Use rw_file_exact for guaranteed length. */ static ssize_t -rw_file_once(int fd, uint8_t *mem, size_t len, +rw_file_once(int fd, uint8_t *mem, size_t nrw, off_t off, int rw_type, size_t rc) { ssize_t rv; size_t retries_on_zero = 0; size_t max_retries = 10; -read_again: - if ((unsigned int)rw_type > IO_PWRITE) + if (io_args(fd, nrw, off, rw_type) == -1) goto err_rw_file_once; - rv = do_rw(fd, mem + rc, len - rc, off + rc, rw_type); +read_again: + rv = do_rw(fd, mem + rc, nrw - rc, off + rc, rw_type); if (rv < 0 && errno == EINTR) goto read_again; @@ -1599,7 +1648,7 @@ read_again: return -1; if ((size_t)rv > SSIZE_MAX /* theoretical buggy libc */ - || (size_t)rv > (len - rc))/* don't overflow */ + || (size_t)rv > (nrw - rc))/* don't overflow */ goto err_rw_file_once; if (rv != 0) @@ -1615,17 +1664,21 @@ err_rw_file_once: static ssize_t do_rw(int fd, uint8_t *mem, - size_t len, off_t off, int rw_type) + size_t nrw, off_t off, int rw_type) { + if (io_args(fd, nrw, off, rw_type) == -1) + goto err_do_rw; + if (rw_type == IO_READ) - return read(fd, mem, len); + return read(fd, mem, nrw); if (rw_type == IO_WRITE) - return write(fd, mem, len); + return write(fd, mem, nrw); if (rw_type == IO_PREAD || rw_type == IO_PWRITE) - return prw(fd, mem, len, off, rw_type); + return prw(fd, mem, nrw, off, rw_type); +err_do_rw: errno = EIO; return -1; } @@ -1647,16 +1700,32 @@ prw(int fd, void *mem, size_t nrw, ssize_t r; int saved_errno; int prw_type; + int flags; + + if (io_args(fd, nrw, off, rw_type) == -1) + goto err_prw; prw_type = rw_type ^ IO_PREAD; - if ((unsigned int)prw_type > IO_WRITE) { - errno = EIO; + if ((unsigned int)prw_type > IO_WRITE) + goto err_prw; + + flags = fcntl(fd, F_GETFL); + if (flags == -1) return -1; - } + + /* + * O_APPEND must not be used, because this + * allows POSIX write() to ignore the + * current write offset and write at EOF, + * which would therefore break pread/pwrite + */ + if (flags & O_APPEND) + goto err_prw; if ((off_orig = lseek_eintr(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) return -1; + if (lseek_eintr(fd, off, SEEK_SET) == (off_t)-1) return -1; @@ -1668,11 +1737,42 @@ prw(int fd, void *mem, size_t nrw, if (lseek_eintr(fd, off_orig, SEEK_SET) == (off_t)-1) { if (r < 0) errno = saved_errno; + return -1; } errno = saved_errno; return r; + +err_prw: + errno = EIO; + return -1; +} + +static int +io_args(int fd, size_t nrw, + off_t off, int rw_type) +{ + if (off != 0 + && off != gbe_file_offset(1, "i/o check")) + goto err_io_args; + + if (nrw != GBE_PART_SIZE && + nrw != NVM_SIZE && + nrw != NUM_RANDOM_BYTES) + goto err_io_args; + + if (fd < 0 + || !nrw /* prevent zero read request */ + || nrw > (size_t)SSIZE_MAX /* prevent overflow */ + || (unsigned int)rw_type > IO_PWRITE) + goto err_io_args; + + return 0; + +err_io_args: + errno = EIO; + return -1; } static off_t |