[edk2-devel] [PATCH v2 2/2] UefiCpuPkg/PiSmmCpuDxeSmm: Fix buffer overflow issue.
Ni, Ray
ray.ni at intel.com
Mon Dec 23 07:39:46 UTC 2019
Reviewed-by: Ray Ni <ray.ni at intel.com>
> -----Original Message-----
> From: Dong, Eric <eric.dong at intel.com>
> Sent: Monday, December 23, 2019 2:48 PM
> To: devel at edk2.groups.io
> Cc: Ni, Ray <ray.ni at intel.com>; Laszlo Ersek <lersek at redhat.com>
> Subject: [PATCH v2 2/2] UefiCpuPkg/PiSmmCpuDxeSmm: Fix buffer overflow
> issue.
>
> The size for the array of mSmmMpSyncData->CpuData[] is 0 ~
> mMaxNumberOfCpus -1. But current code may use
> mSmmMpSyncData->CpuData[mMaxNumberOfCpus].
>
> This patch fixed this issue.
>
> Cc: Ray Ni <ray.ni at intel.com>
> Cc: Laszlo Ersek <lersek at redhat.com>
> Signed-off-by: Eric Dong <eric.dong at intel.com>
> ---
> UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> index 5ad12db980..e5324f8f84 100644
> --- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c
> @@ -137,7 +137,7 @@ ReleaseAllAPs (
> {
>
> UINTN Index;
>
>
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (IsPresentAp (Index)) {
>
> ReleaseSemaphore (mSmmMpSyncData->CpuData[Index].Run);
>
> }
>
> @@ -170,7 +170,7 @@ AllCpusInSmmWithExceptions (
>
>
> CpuData = mSmmMpSyncData->CpuData;
>
> ProcessorInfo = gSmmCpuPrivate->ProcessorInfo;
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (!(*(CpuData[Index].Present)) && ProcessorInfo[Index].ProcessorId !=
> INVALID_APIC_ID) {
>
> if (((Exceptions & ARRIVAL_EXCEPTION_DELAYED) != 0) &&
> SmmCpuFeaturesGetSmmRegister (Index, SmmRegSmmDelayed) != 0) {
>
> continue;
>
> @@ -305,7 +305,7 @@ SmmWaitForApArrival (
> //
>
> // Send SMI IPIs to bring outside processors in
>
> //
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (!(*(mSmmMpSyncData->CpuData[Index].Present)) &&
> gSmmCpuPrivate->ProcessorInfo[Index].ProcessorId != INVALID_APIC_ID) {
>
> SendSmiIpi ((UINT32)gSmmCpuPrivate-
> >ProcessorInfo[Index].ProcessorId);
>
> }
>
> @@ -361,7 +361,7 @@ WaitForAllAPsNotBusy (
> {
>
> UINTN Index;
>
>
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> //
>
> // Ignore BSP and APs which not call in SMM.
>
> //
>
> @@ -619,7 +619,7 @@ BSPHandler (
> //
>
> while (TRUE) {
>
> PresentCount = 0;
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (*(mSmmMpSyncData->CpuData[Index].Present)) {
>
> PresentCount ++;
>
> }
>
> @@ -1303,7 +1303,7 @@ InternalSmmStartupAllAPs (
> }
>
>
>
> CpuCount = 0;
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (IsPresentAp (Index)) {
>
> CpuCount ++;
>
>
>
> @@ -1335,13 +1335,13 @@ InternalSmmStartupAllAPs (
> // Here code always use AcquireSpinLock instead of AcquireSpinLockOrFail
> for not
>
> // block mode.
>
> //
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (IsPresentAp (Index)) {
>
> AcquireSpinLock (mSmmMpSyncData->CpuData[Index].Busy);
>
> }
>
> }
>
>
>
> - for (Index = mMaxNumberOfCpus; Index-- > 0;) {
>
> + for (Index = 0; Index < mMaxNumberOfCpus; Index++) {
>
> if (IsPresentAp (Index)) {
>
> mSmmMpSyncData->CpuData[Index].Procedure =
> (EFI_AP_PROCEDURE2) Procedure;
>
> mSmmMpSyncData->CpuData[Index].Parameter = ProcedureArguments;
>
> --
> 2.23.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#52498): https://edk2.groups.io/g/devel/message/52498
Mute This Topic: https://groups.io/mt/69226061/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list