[PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

[PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

[Srish Srinivasan]

Inside grub_util_fd_open, a failure while creating an IO
request or opening a device frees ret (the fd) before its
MsgPort is deleted. This leads to a use-after-free scenario.

Fix this by freeing ret after its MsgPort has been deleted.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
 grub-core/osdep/aros/hostdisk.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/grub-core/osdep/aros/hostdisk.c b/grub-core/osdep/aros/hostdisk.c
index 08723bd45..c75474933 100644
--- a/grub-core/osdep/aros/hostdisk.c
+++ b/grub-core/osdep/aros/hostdisk.c
@@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
 						 sizeof(struct IOExtTD));
   if (!ret->ioreq)
     {
-      free (ret);
       DeleteMsgPort (ret->mp);
+      free (ret);
       return NULL;
     }
 
@@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
   if (OpenDevice ((unsigned char *) tmp, unit,
 		  (struct IORequest *) ret->ioreq, flags))
     {
-      free (tmp);
-      free (ret);
       DeleteMsgPort (ret->mp);
+      free (ret);
+      free (tmp);
       return NULL;
     }
   free (tmp);
-- 
2.43.0

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

[Avnish Chouhan]

On 2025-12-08 22:30, grub-devel-request@gnu.org wrote:
> Message: 1
> Date: Mon,  8 Dec 2025 15:51:29 +0530
> From: Srish Srinivasan <ssrish@linux.ibm.com>
> To: grub-devel@gnu.org
> Cc: daniel.kiper@oracle.com, sudhakar@linux.ibm.com,
> 	sridharm@linux.ibm.com, ssrish@linux.ibm.com
> Subject: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort
> 	deletion
> Message-ID: <20251208102129.705955-1-ssrish@linux.ibm.com>
> 
> Inside grub_util_fd_open, a failure while creating an IO
> request or opening a device frees ret (the fd) before its
> MsgPort is deleted. This leads to a use-after-free scenario.
> 
> Fix this by freeing ret after its MsgPort has been deleted.

Hi Srish,

Suggestion on commit message:

"In function grub_util_fd_open(), if creating an I/O request or opening 
a device fails. 'ret' (the file descriptor) will be freed before its 
associated MsgPort is deleted, resulting in a use-after-free condition.

Fixing this issue by freeing 'ret' after its associated MsgPort has been 
deleted."

> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>

Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>

Regards,
Avnish Chouhan

> ---
>  grub-core/osdep/aros/hostdisk.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/grub-core/osdep/aros/hostdisk.c 
> b/grub-core/osdep/aros/hostdisk.c
> index 08723bd45..c75474933 100644
> --- a/grub-core/osdep/aros/hostdisk.c
> +++ b/grub-core/osdep/aros/hostdisk.c
> @@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
>  						 sizeof(struct IOExtTD));
>    if (!ret->ioreq)
>      {
> -      free (ret);
>        DeleteMsgPort (ret->mp);
> +      free (ret);
>        return NULL;
>      }
> 
> @@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
>    if (OpenDevice ((unsigned char *) tmp, unit,
>  		  (struct IORequest *) ret->ioreq, flags))
>      {
> -      free (tmp);
> -      free (ret);
>        DeleteMsgPort (ret->mp);
> +      free (ret);
> +      free (tmp);
>        return NULL;
>      }
>    free (tmp);
> --
> 2.43.0

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

[Sudhakar Kuppusamy]

> On 8 Dec 2025, at 3:51 PM, Srish Srinivasan <ssrish@linux.ibm.com> wrote:
> 
> Inside grub_util_fd_open, a failure while creating an IO
> request or opening a device frees ret (the fd) before its
> MsgPort is deleted. This leads to a use-after-free scenario.
> 
> Fix this by freeing ret after its MsgPort has been deleted.
> 
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>

Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

Thanks,
Sudhakar  
> ---
> grub-core/osdep/aros/hostdisk.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/grub-core/osdep/aros/hostdisk.c b/grub-core/osdep/aros/hostdisk.c
> index 08723bd45..c75474933 100644
> --- a/grub-core/osdep/aros/hostdisk.c
> +++ b/grub-core/osdep/aros/hostdisk.c
> @@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
> sizeof(struct IOExtTD));
>   if (!ret->ioreq)
>     {
> -      free (ret);
>       DeleteMsgPort (ret->mp);
> +      free (ret);
>       return NULL;
>     }
> 
> @@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
>   if (OpenDevice ((unsigned char *) tmp, unit,
>  (struct IORequest *) ret->ioreq, flags))
>     {
> -      free (tmp);
> -      free (ret);
>       DeleteMsgPort (ret->mp);
> +      free (ret);
> +      free (tmp);
>       return NULL;
>     }
>   free (tmp);
> -- 
> 2.43.0


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

[Daniel Kiper]

On Mon, Dec 08, 2025 at 03:51:29PM +0530, Srish Srinivasan wrote:
> Inside grub_util_fd_open, a failure while creating an IO
> request or opening a device frees ret (the fd) before its
> MsgPort is deleted. This leads to a use-after-free scenario.
>
> Fix this by freeing ret after its MsgPort has been deleted.
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>

Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Daniel

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel