[edk2-devel] [PATCH v2 1/1] MdePkg/BaseLib: Fix invalid memory access in AArch64 SetJump/LongJump

[Jan Bobek]

Hey guys,

just wondering, are we waiting for more reviews before this is good to
merge?

Best,
-Jan

Kinney, Michael D writes:
> No concerns.
>
> Acked-by: Michael D Kinney <michael.d.kinney at intel.com>
>
> Mike
>
>> -----Original Message-----
>> From: Ard Biesheuvel <ard.biesheuvel at arm.com>
>> Sent: Monday, October 5, 2020 7:33 AM
>> To: Jan Bobek <jbobek at nvidia.com>; devel at edk2.groups.io; Kinney, Michael D <michael.d.kinney at intel.com>; Liming Gao
>> <gaoliming at byosoft.com.cn>
>> Cc: Leif Lindholm <leif at nuviainc.com>; Liu, Zhiguang <zhiguang.liu at intel.com>; Jeff Brasen <jbrasen at nvidia.com>; Ashish Singhal
>> <ashishsingha at nvidia.com>
>> Subject: Re: [PATCH v2 1/1] MdePkg/BaseLib: Fix invalid memory access in AArch64 SetJump/LongJump
>>
>> On 10/1/20 6:15 PM, Jan Bobek wrote:
>> > Correct the memory offsets used in REG_ONE/REG_PAIR macros to
>> > synchronize them with definition of the BASE_LIBRARY_JUMP_BUFFER
>> > structure on AArch64.
>> >
>> > The REG_ONE macro declares only a single 64-bit register be
>> > read/written; however, the subsequent offset is 16 bytes larger,
>> > creating an unused memory gap in the middle of the structure and
>> > causing SetJump/LongJump functions to read/write 8 bytes of memory
>> > past the end of the jump buffer struct.
>> >
>> > Signed-off-by: Jan Bobek <jbobek at nvidia.com>
>>
>> Thanks Jan,
>>
>> Reviewed-by: Ard Biesheuvel <ard.biesheuvel at arm.com>
>>
>> Liming, Michael: any concerns?
>>
>> Thanks,
>>
>>
>> > ---
>> >   MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.S   | 8 ++++----
>> >   MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.asm | 8 ++++----
>> >   2 files changed, 8 insertions(+), 8 deletions(-)
>> >
>> > diff --git a/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.S b/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.S
>> > index 72cea259e913..deefdf526b95 100644
>> > --- a/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.S
>> > +++ b/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.S
>> > @@ -20,10 +20,10 @@ GCC_ASM_EXPORT(InternalLongJump)
>> >           REG_ONE  (x16,      96) /*IP0*/
>> >
>> >   #define FPR_LAYOUT                      \
>> > -        REG_PAIR ( d8,  d9, 112);       \
>> > -        REG_PAIR (d10, d11, 128);       \
>> > -        REG_PAIR (d12, d13, 144);       \
>> > -        REG_PAIR (d14, d15, 160);
>> > +        REG_PAIR ( d8,  d9, 104);       \
>> > +        REG_PAIR (d10, d11, 120);       \
>> > +        REG_PAIR (d12, d13, 136);       \
>> > +        REG_PAIR (d14, d15, 152);
>> >
>> >   #/**
>> >   #  Saves the current CPU context that can be restored with a call to LongJump() and returns 0.#
>> > diff --git a/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.asm b/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.asm
>> > index 20dd0f1b850f..df70f298998e 100644
>> > --- a/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.asm
>> > +++ b/MdePkg/Library/BaseLib/AArch64/SetJumpLongJump.asm
>> > @@ -19,10 +19,10 @@
>> >           REG_ONE  (x16,      #96) /*IP0*/
>> >
>> >   #define FPR_LAYOUT                       \
>> > -        REG_PAIR ( d8,  d9, #112);       \
>> > -        REG_PAIR (d10, d11, #128);       \
>> > -        REG_PAIR (d12, d13, #144);       \
>> > -        REG_PAIR (d14, d15, #160);
>> > +        REG_PAIR ( d8,  d9, #104);       \
>> > +        REG_PAIR (d10, d11, #120);       \
>> > +        REG_PAIR (d12, d13, #136);       \
>> > +        REG_PAIR (d14, d15, #152);
>> >
>> >   ;/**
>> >   ;  Saves the current CPU context that can be restored with a call to LongJump() and returns 0.#
>> >



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#66137): https://edk2.groups.io/g/devel/message/66137
Mute This Topic: https://groups.io/mt/77244029/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-