summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
18 hoursutil/nvmutil: stricter lseep_loop return offsetLeah Rowe
we currently reset just fine, but a partial success where the previous offset is not the same as the original should also be considered failure. this patch therefore makes the return much stricter, making the code return an error if this occurs, which in nvmutil would then cause a program exit. Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: only use srand on fallback randLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursnvmutil: add missing check to io_argsLeah Rowe
accidentally removed this in a rebase Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: add flock to pledge promisesLeah Rowe
otherwise, gbe.bin locking won't work! Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: tidy up io_argsLeah Rowe
i don't like it grouped together. do it all separate, for clarity. Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: tidy up err()Leah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: re-add io_args()Leah Rowe
unified arg check for prw and rw_file_exact Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: rw_file_exact: check inputs alsoLeah Rowe
we check them in prw, but we used to rely on prw because we called that first. no more. it's correct to also check them here anyway, in case i ever call another function here. Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: rw_over_nrw: err if nrw is zeroLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: rw: safer bound checkLeah Rowe
avoid pointer-range overflow arithmetic. this patch doesn't change behaviour, but makes an overflow impossible. Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil rw: make off_reset a toggleLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: rw_file_exact: explicit castsLeah Rowe
don't do it inside functions. some compilers may be inconsistent, ditto several auditing tools. Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: fix potential overflow in rwLeah Rowe
off is signed, so converting that to unsigned is better than converting rc (unsigned) to signed. i had the right idea, but got it wrong in the earlier version. this should fix potential overflow issues. Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: rw file: guard rc before additionLeah Rowe
otherwise, it could still overflow Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursnvmutil: toggle for fd thread-safety err stateLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hoursutil/nvmutil: clean up pwrite/pread caseLeah Rowe
some unused variables if enabled. hide them. Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hoursutil/nvmutil: partially mitigate fd offset raceLeah Rowe
our fallback pwrite/pread behaviour still does not properly replicate the safety of real pwrite/pread i intend to put this i/o code into a library for use in other programs; nvmutil is single-threaded so this change is largely redundant (but can't hurt) Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hoursutil/nvmutil: tidy up rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hourscommentLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hoursutil/nvmutil: cleanupLeah Rowe
remove ptr casts to ulong. size_t is better. Signed-off-by: Leah Rowe <leah@libreboot.org>
20 hoursnope, use size_tLeah Rowe
despite my cast, size_t is better for mem index Signed-off-by: Leah Rowe <leah@libreboot.org>
21 hoursutil/nvmutil: use ulong on ptr castsLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
21 hoursutil/nvmutil: remove rw_file_onceLeah Rowe
we don't need it anymore. Signed-off-by: Leah Rowe <leah@libreboot.org>
21 hoursutil/nvmutil: move looping logic to rw_file_exactLeah Rowe
rw_file_once was doing what rw_file_exact should be doing _once does what it says: once we were passing an offset (rc) to it that it was not meaningfully using. this makes the code now more robust, especially if we later swap out or break _once - then we don't get weird behaviour (if there is a regression). Signed-off-by: Leah Rowe <leah@libreboot.org>
21 hoursnvmutil: move increment logic to rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursnvmutil: fix redundant checkLeah Rowe
we already check not-zero in the next if Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursutil/nvmutil: cast gbe file size on ptr cmpLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursutil/nvmutil: even safer pointer comparisonLeah Rowe
we assert now that ulong is the size of a pointer, therefore we know that it can fit a pointer reliably. this code is written for c90 spec so lacks uintptr Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursutil/nvmutil: safer pointer comparisonLeah Rowe
technically we're never supposed to do arithmetic on pointers (there's uintptr for that) very anal fix Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursutil/nvmutil: enable arc4random on linuxLeah Rowe
not available on older systems. can just pass the relevant flag in the compiler: HAVE_ARC4RANDOM_BUF=0 at build time if you need the fallback. Signed-off-by: Leah Rowe <leah@libreboot.org>
23 hoursutil/nvmutil: re-add arc4randomLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: 5 retries, not 10Leah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: check if gbe.bin is seekableLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: check inode during post-verifyLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: warn about gbe.bin hard linksLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: guard file replacement attacksLeah Rowe
i already also guard other toctuo attacks :) Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: guard against unlinking fileLeah Rowe
if someone deletes gbe.bin while operating, nvmutil will now abort Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: don't use /dev/urandomLeah Rowe
too over engineered and cumbersome. the new security in prw() makes it brittle, and i'd rather not move checks outside of it. the fallback rand is random enough. Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: fix file checkLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: fix cast checkLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: more aggressive file checkingLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: prevent overflow in rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: verify final offset in pwrite/preadLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
24 hoursutil/nvmutil: check regular file in rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
26 hoursutil/nvmutil: fix if (PWRITE)Leah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
26 hoursutil/nvmutil: don't check o_append in prwLeah Rowe
slow, per call. prw should be generic. do it just for gbe files, once Signed-off-by: Leah Rowe <leah@libreboot.org>
26 hoursutil/nvmutil: configurable eintr/eagainLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
26 hoursutil/nvmutil: configurable retries/preadLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
26 hoursutil/nvmutil: support real pwrite/preadLeah Rowe
build flag Signed-off-by: Leah Rowe <leah@libreboot.org>
27 hoursutil/nvmutil: better commented I/O functionsLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
generated by cgit v1.2.1 (git 2.18.0) at 2026-03-15 18:06:28 +0000