[edk2-devel] [PATCH v1 1/1] MdeModulePkg: PiSmmCore: Inspect memory guarded with pool headers
Wang, Jian J
jian.j.wang at intel.com
Fri Apr 22 05:47:08 UTC 2022
It looks good to me. Thanks for fixing it.
Reviewed-by: Jian J Wang <jian.j.wang at intel.com>
Regards,
Jian
> -----Original Message-----
> From: devel at edk2.groups.io <devel at edk2.groups.io> On Behalf Of Kun Qin
> Sent: Wednesday, March 16, 2022 12:00 PM
> To: devel at edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao at intel.com>; Dong, Eric <eric.dong at intel.com>; Ni,
> Ray <ray.ni at intel.com>; Wang, Jian J <jian.j.wang at intel.com>; Gao, Liming
> <gaoliming at byosoft.com.cn>
> Subject: [edk2-devel] [PATCH v1 1/1] MdeModulePkg: PiSmmCore: Inspect
> memory guarded with pool headers
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3488
>
> Current free pool routine from PiSmmCore will inspect memory guard status
> for target buffer without considering pool headers. This could lead to
> `IsMemoryGuarded` function to return incorrect results.
>
> In that sense, allocating a 0 sized pool could cause an allocated buffer
> directly points into a guard page, which is legal. However, trying to
> free this pool will cause the routine changed in this commit to read XP
> pages, which leads to page fault.
>
> This change will inspect memory guarded with pool headers. This can avoid
> errors when a pool content happens to be on a page boundary.
>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Eric Dong <eric.dong at intel.com>
> Cc: Ray Ni <ray.ni at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Liming Gao <gaoliming at byosoft.com.cn>
>
> Signed-off-by: Kun Qin <kuqin12 at gmail.com>
> ---
> MdeModulePkg/Core/PiSmmCore/Pool.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/MdeModulePkg/Core/PiSmmCore/Pool.c
> b/MdeModulePkg/Core/PiSmmCore/Pool.c
> index 96ebe811c669..e1ff40a8ea55 100644
> --- a/MdeModulePkg/Core/PiSmmCore/Pool.c
> +++ b/MdeModulePkg/Core/PiSmmCore/Pool.c
> @@ -382,11 +382,6 @@ SmmInternalFreePool (
> return EFI_INVALID_PARAMETER;
> }
>
> - MemoryGuarded = IsHeapGuardEnabled () &&
> - IsMemoryGuarded ((EFI_PHYSICAL_ADDRESS)(UINTN)Buffer);
> - HasPoolTail = !(MemoryGuarded &&
> - ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) == 0));
> -
> FreePoolHdr = (FREE_POOL_HEADER *)((POOL_HEADER *)Buffer - 1);
> ASSERT (FreePoolHdr->Header.Signature == POOL_HEAD_SIGNATURE);
> ASSERT (!FreePoolHdr->Header.Available);
> @@ -394,6 +389,11 @@ SmmInternalFreePool (
> return EFI_INVALID_PARAMETER;
> }
>
> + MemoryGuarded = IsHeapGuardEnabled () &&
> + IsMemoryGuarded ((EFI_PHYSICAL_ADDRESS)(UINTN)FreePoolHdr);
> + HasPoolTail = !(MemoryGuarded &&
> + ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) == 0));
> +
> if (HasPoolTail) {
> PoolTail = HEAD_TO_TAIL (&FreePoolHdr->Header);
> ASSERT (PoolTail->Signature == POOL_TAIL_SIGNATURE);
> --
> 2.35.1.windows.2
>
>
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#89209): https://edk2.groups.io/g/devel/message/89209
Mute This Topic: https://groups.io/mt/89815350/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list