<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">Reviewed-by:
Ashish Singhal <ashishsingha@nvidia.com></span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; background-color: rgb(255, 255, 255); display: inline !important">Tested-by:
Ashish Singhal <ashishsingha@nvidia.com></span><br>
</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Ard Biesheuvel <ard.biesheuvel@linaro.org><br>
<b>Sent:</b> Wednesday, March 25, 2020 9:29 AM<br>
<b>To:</b> devel@edk2.groups.io <devel@edk2.groups.io><br>
<b>Cc:</b> Ard Biesheuvel <ard.biesheuvel@linaro.org>; Laszlo Ersek <lersek@redhat.com>; Leif Lindholm <leif@nuviainc.com>; Ashish Singhal <ashishsingha@nvidia.com><br>
<b>Subject:</b> [PATCH v3 1/3] ArmPkg/ArmMmuLib AARCH64: limit recursion when freeing page tables</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">External email: Use caution opening links or attachments<br>
<br>
<br>
FreePageTablesRecursive () traverses the page table tree depth first<br>
to free all pages that it finds, without taking into account the<br>
level at which it is operating.<br>
<br>
Since TT_TYPE_TABLE_ENTRY aliases TT_TYPE_BLOCK_ENTRY_LEVEL3, we cannot<br>
distinguish table entries from block entries unless we take the level<br>
into account, and so we may be dereferencing garbage if we happen to<br>
try and free a hierarchy of page tables that has level 3 pages in it.<br>
<br>
Let's fix this by passing the level into FreePageTablesRecursive (),<br>
and limit the recursion to levels < 3.<br>
<br>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org><br>
---<br>
ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c | 18 ++++++++++++------<br>
1 file changed, 12 insertions(+), 6 deletions(-)<br>
<br>
diff --git a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c<br>
index a43d468b73ca..d78918cf7ba8 100644<br>
--- a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c<br>
+++ b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c<br>
@@ -142,15 +142,21 @@ ReplaceTableEntry (<br>
STATIC<br>
VOID<br>
FreePageTablesRecursive (<br>
- IN UINT64 *TranslationTable<br>
+ IN UINT64 *TranslationTable,<br>
+ IN UINTN Level<br>
)<br>
{<br>
UINTN Index;<br>
<br>
- for (Index = 0; Index < TT_ENTRY_COUNT; Index++) {<br>
- if ((TranslationTable[Index] & TT_TYPE_MASK) == TT_TYPE_TABLE_ENTRY) {<br>
- FreePageTablesRecursive ((VOID *)(UINTN)(TranslationTable[Index] &<br>
- TT_ADDRESS_MASK_BLOCK_ENTRY));<br>
+ ASSERT (Level <= 3);<br>
+<br>
+ if (Level < 3) {<br>
+ for (Index = 0; Index < TT_ENTRY_COUNT; Index++) {<br>
+ if ((TranslationTable[Index] & TT_TYPE_MASK) == TT_TYPE_TABLE_ENTRY) {<br>
+ FreePageTablesRecursive ((VOID *)(UINTN)(TranslationTable[Index] &<br>
+ TT_ADDRESS_MASK_BLOCK_ENTRY),<br>
+ Level + 1);<br>
+ }<br>
}<br>
}<br>
FreePages (TranslationTable, 1);<br>
@@ -254,7 +260,7 @@ UpdateRegionMappingRecursive (<br>
// possible for existing table entries, since we cannot revert the<br>
// modifications we made to the subhierarchy it represents.)<br>
//<br>
- FreePageTablesRecursive (TranslationTable);<br>
+ FreePageTablesRecursive (TranslationTable, Level + 1);<br>
}<br>
return Status;<br>
}<br>
--<br>
2.17.1<br>
<br>
</div>
</span></font></div>
<DIV>
<HR>
</DIV>
<DIV>This email message is for the sole use of the intended recipient(s) and may
contain confidential information. Any unauthorized review, use, disclosure
or distribution is prohibited. If you are not the intended recipient,
please contact the sender by reply email and destroy all copies of the original
message. </DIV>
<DIV>
<HR>
</DIV>
</body>
</html>
<div width="1" style="color:white;clear:both">_._,_._,_</div>
<hr>
Groups.io Links:<p>
You receive all messages sent to this group.
<p>
<a target="_blank" href="https://edk2.groups.io/g/devel/message/56304">View/Reply Online (#56304)</a> |
|
<a target="_blank" href="https://groups.io/mt/72543072/1813853">Mute This Topic</a>
| <a href="https://edk2.groups.io/g/devel/post">New Topic</a><br>
<br>
<a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> |
<a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> |
<a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a>
[edk2-devel-archive@redhat.com]<br>
<div width="1" style="color:white;clear:both">_._,_._,_</div>