Message ID | 20160913173653.81188-1-robin.randhawa@arm.com |
---|---|
State | Accepted |
Commit | 991d62fa73a35598a8939a83dd84369168220d35 |
Delegated to: | Alexander Graf |
Headers | show |
> On 13 Sep 2016, at 19:36, Robin Randhawa <robin.randhawa@arm.com> wrote: > > A type mismatch in the efi_allocate_pool boot service flow causes > hazardous memory scribbling on 32-bit systems. > > This is efi_allocate_pool's prototype: > > static efi_status_t EFIAPI efi_allocate_pool(int pool_type, > unsigned long size, > void **buffer); > > Internally, it invokes efi_allocate_pages as follows: > > efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, > (void*)buffer); > > This is efi_allocate_pages' prototype: > > efi_status_t efi_allocate_pages(int type, int memory_type, > unsigned long pages, > uint64_t *memory); > > The problem: efi_allocate_pages does this internally: > > *memory = addr; > > This fix in efi_allocate_pool uses a transitional uintptr_t cast to > ensure the correct outcome, irrespective of the system's native word > size. > > This was observed when bootefi'ing the EFI instance of FreeBSD's first > stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + > Cortex-a9). > > Signed-off-by: Robin Randhawa <robin.randhawa@arm.com> Very nice catch! > --- > lib/efi_loader/efi_boottime.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c > index be6f5e8..784891b 100644 > --- a/lib/efi_loader/efi_boottime.c > +++ b/lib/efi_loader/efi_boottime.c > @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, > void **buffer) > { > efi_status_t r; > + efi_physical_addr_t t; > > EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer); > - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); > + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t); > + *buffer = (void *)(uintptr_t)t; Can you please double-check that this is the only place the type mismatch happened? For this change however, the fix is already correct: Reviewed-by: Alexander Graf <agraf@suse.de> Alex
Hi Alex. On Wed 14 Sep 08:34:47 2016, Alexander Graf wrote: [...] > Very nice catch! Thanks! [...] > Can you please double-check that this is the only place the type > mismatch happened? So I skimmed through the boot and run-time service API implementations and couldn't spot another instance of a mismatch. Ideally it would be neat to have an automated way to check for these things - maybe Coccinelle or something. > For this change however, the fix is already correct: > > Reviewed-by: Alexander Graf <agraf@suse.de> Thanks, Robin
> A type mismatch in the efi_allocate_pool boot service flow causes > hazardous memory scribbling on 32-bit systems. > > This is efi_allocate_pool's prototype: > > static efi_status_t EFIAPI efi_allocate_pool(int pool_type, > unsigned long size, > void **buffer); > > Internally, it invokes efi_allocate_pages as follows: > > efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, > (void*)buffer); > > This is efi_allocate_pages' prototype: > > efi_status_t efi_allocate_pages(int type, int memory_type, > unsigned long pages, > uint64_t *memory); > > The problem: efi_allocate_pages does this internally: > > *memory = addr; > > This fix in efi_allocate_pool uses a transitional uintptr_t cast to > ensure the correct outcome, irrespective of the system's native word > size. > > This was observed when bootefi'ing the EFI instance of FreeBSD's first > stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + > Cortex-a9). > > Signed-off-by: Robin Randhawa <robin.randhawa@arm.com> Thanks, applied to
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index be6f5e8..784891b 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer) { efi_status_t r; + efi_physical_addr_t t; EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer); - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t); + *buffer = (void *)(uintptr_t)t; return EFI_EXIT(r); }
A type mismatch in the efi_allocate_pool boot service flow causes hazardous memory scribbling on 32-bit systems. This is efi_allocate_pool's prototype: static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer); Internally, it invokes efi_allocate_pages as follows: efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); This is efi_allocate_pages' prototype: efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); The problem: efi_allocate_pages does this internally: *memory = addr; This fix in efi_allocate_pool uses a transitional uintptr_t cast to ensure the correct outcome, irrespective of the system's native word size. This was observed when bootefi'ing the EFI instance of FreeBSD's first stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + Cortex-a9). Signed-off-by: Robin Randhawa <robin.randhawa@arm.com> --- lib/efi_loader/efi_boottime.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)