summaryrefslogtreecommitdiff
path: root/util/nvmutil
AgeCommit message (Collapse)Author
12 hoursset errnoLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
12 hoursutil/nvmutil: stricter return in preadLeah Rowe
we were returning if verified is not off, but we were not doing the check soon enough. now it's clearer: just after either a reset, or we found out offset doesn't match, we return sooner. otherwise, we read, and we verify again right after. in the old code, we verified twice in a row. this is just more optimal, for error handling. Signed-off-by: Leah Rowe <leah@libreboot.org>
12 hoursno, break insteadLeah Rowe
in the last patch, i return, which then avoids resetting the offset. prw is very careful not to return early. Signed-off-by: Leah Rowe <leah@libreboot.org>
12 hoursutil/nvmutil pread: rw_over_nrw exit, not setLeah Rowe
otherwise, if it's -1 and errno happens to be EINTR or EAGAIN, we might loop on what is a real error. this bug fixes that edge case. Signed-off-by: Leah Rowe <leah@libreboot.org>
12 hoursnvmutil: stronger race-condition check on prwLeah Rowe
do it per read, in the fallback pread/pwrite per read/write that is Signed-off-by: Leah Rowe <leah@libreboot.org>
12 hoursutil/nvmutil: fix theoretical buffer overflowLeah Rowe
i already guard offsets in io_args, but it's best to be thorough here. Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursutil/nvmutil: prevent underflow in comparisonLeah Rowe
we already check before that rv is not negative, and it starts at zero, but it's good to guard it here just in case (for future re-factoring). if rv is negative, it could convert (casted to size_t) to a huge number (we don't want that). Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hourscommentLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursutil/nvmutil: extra race-condition check in prwLeah Rowe
even with OFF_RESET, we still want some error checking. if the check fails again immediately after, then it suggests that another program really is modifying the file, so we should stop. the first check is done on the theory that another program *was* working on it, but now isn't. once again, this isn't perfect. use read pread/pwrite if you need thread safety (and even then, you still need to actually check your code) Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursutil/nvmutil: safer xstrxcmp() - overflow fixLeah Rowe
if a points to a buffer shorter than maxlen, and the string is not null-terminated early, the loop may read may overflow e.g. char buf[3] = {'a', 'b', 'c'}; xstrxcmp(buf, "abc", 50); this is undefined behaviour, and a bug. C allows reading past arrays only if the memory exists, but we can't guarantee that to fix it, we check the condition for return, namely NULL character, before using the character again. This avoids reading further from a multiple times so we exit as soon as we encounter NULL this also avoids multiple reads from memory, though a compiler would optimise that anyway Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursphrasingLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursutil/nvmutil: stricter rw_gbe_file_exactLeah Rowe
we repeat these stteps later, but it's still good to be exact here. these lower functions can change. Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hourscastLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hourscommentLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
13 hoursutil/nvmutil: stricter lseep_loop return offsetLeah Rowe
we currently reset just fine, but a partial success where the previous offset is not the same as the original should also be considered failure. this patch therefore makes the return much stricter, making the code return an error if this occurs, which in nvmutil would then cause a program exit. Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: only use srand on fallback randLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursnvmutil: add missing check to io_argsLeah Rowe
accidentally removed this in a rebase Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: add flock to pledge promisesLeah Rowe
otherwise, gbe.bin locking won't work! Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: tidy up io_argsLeah Rowe
i don't like it grouped together. do it all separate, for clarity. Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: tidy up err()Leah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: re-add io_args()Leah Rowe
unified arg check for prw and rw_file_exact Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: rw_file_exact: check inputs alsoLeah Rowe
we check them in prw, but we used to rely on prw because we called that first. no more. it's correct to also check them here anyway, in case i ever call another function here. Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: rw_over_nrw: err if nrw is zeroLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: rw: safer bound checkLeah Rowe
avoid pointer-range overflow arithmetic. this patch doesn't change behaviour, but makes an overflow impossible. Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil rw: make off_reset a toggleLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
14 hoursutil/nvmutil: rw_file_exact: explicit castsLeah Rowe
don't do it inside functions. some compilers may be inconsistent, ditto several auditing tools. Signed-off-by: Leah Rowe <leah@libreboot.org>
15 hoursutil/nvmutil: fix potential overflow in rwLeah Rowe
off is signed, so converting that to unsigned is better than converting rc (unsigned) to signed. i had the right idea, but got it wrong in the earlier version. this should fix potential overflow issues. Signed-off-by: Leah Rowe <leah@libreboot.org>
15 hoursutil/nvmutil: rw file: guard rc before additionLeah Rowe
otherwise, it could still overflow Signed-off-by: Leah Rowe <leah@libreboot.org>
15 hoursnvmutil: toggle for fd thread-safety err stateLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
15 hoursutil/nvmutil: clean up pwrite/pread caseLeah Rowe
some unused variables if enabled. hide them. Signed-off-by: Leah Rowe <leah@libreboot.org>
15 hoursutil/nvmutil: partially mitigate fd offset raceLeah Rowe
our fallback pwrite/pread behaviour still does not properly replicate the safety of real pwrite/pread i intend to put this i/o code into a library for use in other programs; nvmutil is single-threaded so this change is largely redundant (but can't hurt) Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursutil/nvmutil: tidy up rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hourscommentLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursutil/nvmutil: cleanupLeah Rowe
remove ptr casts to ulong. size_t is better. Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursnope, use size_tLeah Rowe
despite my cast, size_t is better for mem index Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursutil/nvmutil: use ulong on ptr castsLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursutil/nvmutil: remove rw_file_onceLeah Rowe
we don't need it anymore. Signed-off-by: Leah Rowe <leah@libreboot.org>
16 hoursutil/nvmutil: move looping logic to rw_file_exactLeah Rowe
rw_file_once was doing what rw_file_exact should be doing _once does what it says: once we were passing an offset (rc) to it that it was not meaningfully using. this makes the code now more robust, especially if we later swap out or break _once - then we don't get weird behaviour (if there is a regression). Signed-off-by: Leah Rowe <leah@libreboot.org>
17 hoursnvmutil: move increment logic to rw_file_exactLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursnvmutil: fix redundant checkLeah Rowe
we already check not-zero in the next if Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: cast gbe file size on ptr cmpLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: even safer pointer comparisonLeah Rowe
we assert now that ulong is the size of a pointer, therefore we know that it can fit a pointer reliably. this code is written for c90 spec so lacks uintptr Signed-off-by: Leah Rowe <leah@libreboot.org>
18 hoursutil/nvmutil: safer pointer comparisonLeah Rowe
technically we're never supposed to do arithmetic on pointers (there's uintptr for that) very anal fix Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: enable arc4random on linuxLeah Rowe
not available on older systems. can just pass the relevant flag in the compiler: HAVE_ARC4RANDOM_BUF=0 at build time if you need the fallback. Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: re-add arc4randomLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: 5 retries, not 10Leah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: check if gbe.bin is seekableLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: check inode during post-verifyLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: warn about gbe.bin hard linksLeah Rowe
Signed-off-by: Leah Rowe <leah@libreboot.org>
19 hoursutil/nvmutil: guard file replacement attacksLeah Rowe
i already also guard other toctuo attacks :) Signed-off-by: Leah Rowe <leah@libreboot.org>
generated by cgit v1.2.1 (git 2.18.0) at 2026-03-15 13:38:56 +0000