* [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems
@ 2016-09-13 17:36 Robin Randhawa
2016-09-14 6:34 ` Alexander Graf
2016-10-13 14:34 ` [U-Boot] " Alexander Graf
0 siblings, 2 replies; 4+ messages in thread
From: Robin Randhawa @ 2016-09-13 17:36 UTC (permalink / raw)
To: u-boot
A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.
This is efi_allocate_pool's prototype:
static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
unsigned long size,
void **buffer);
Internally, it invokes efi_allocate_pages as follows:
efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
(void*)buffer);
This is efi_allocate_pages' prototype:
efi_status_t efi_allocate_pages(int type, int memory_type,
unsigned long pages,
uint64_t *memory);
The problem: efi_allocate_pages does this internally:
*memory = addr;
This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.
This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).
Signed-off-by: Robin Randhawa <robin.randhawa@arm.com>
---
lib/efi_loader/efi_boottime.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index be6f5e8..784891b 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size,
void **buffer)
{
efi_status_t r;
+ efi_physical_addr_t t;
EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
- r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);
+ r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
+ *buffer = (void *)(uintptr_t)t;
return EFI_EXIT(r);
}
--
2.9.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems
2016-09-13 17:36 [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems Robin Randhawa
@ 2016-09-14 6:34 ` Alexander Graf
2016-09-14 11:59 ` Robin Randhawa
2016-10-13 14:34 ` [U-Boot] " Alexander Graf
1 sibling, 1 reply; 4+ messages in thread
From: Alexander Graf @ 2016-09-14 6:34 UTC (permalink / raw)
To: u-boot
> On 13 Sep 2016, at 19:36, Robin Randhawa <robin.randhawa@arm.com> wrote:
>
> A type mismatch in the efi_allocate_pool boot service flow causes
> hazardous memory scribbling on 32-bit systems.
>
> This is efi_allocate_pool's prototype:
>
> static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
> unsigned long size,
> void **buffer);
>
> Internally, it invokes efi_allocate_pages as follows:
>
> efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
> (void*)buffer);
>
> This is efi_allocate_pages' prototype:
>
> efi_status_t efi_allocate_pages(int type, int memory_type,
> unsigned long pages,
> uint64_t *memory);
>
> The problem: efi_allocate_pages does this internally:
>
> *memory = addr;
>
> This fix in efi_allocate_pool uses a transitional uintptr_t cast to
> ensure the correct outcome, irrespective of the system's native word
> size.
>
> This was observed when bootefi'ing the EFI instance of FreeBSD's first
> stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
> Cortex-a9).
>
> Signed-off-by: Robin Randhawa <robin.randhawa@arm.com>
Very nice catch!
> ---
> lib/efi_loader/efi_boottime.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
> index be6f5e8..784891b 100644
> --- a/lib/efi_loader/efi_boottime.c
> +++ b/lib/efi_loader/efi_boottime.c
> @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size,
> void **buffer)
> {
> efi_status_t r;
> + efi_physical_addr_t t;
>
> EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
> - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);
> + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
> + *buffer = (void *)(uintptr_t)t;
Can you please double-check that this is the only place the type mismatch happened? For this change however, the fix is already correct:
Reviewed-by: Alexander Graf <agraf@suse.de>
Alex
^ permalink raw reply [flat|nested] 4+ messages in thread
* [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems
2016-09-14 6:34 ` Alexander Graf
@ 2016-09-14 11:59 ` Robin Randhawa
0 siblings, 0 replies; 4+ messages in thread
From: Robin Randhawa @ 2016-09-14 11:59 UTC (permalink / raw)
To: u-boot
Hi Alex.
On Wed 14 Sep 08:34:47 2016, Alexander Graf wrote:
[...]
> Very nice catch!
Thanks!
[...]
> Can you please double-check that this is the only place the type
> mismatch happened?
So I skimmed through the boot and run-time service API implementations
and couldn't spot another instance of a mismatch. Ideally it would be
neat to have an automated way to check for these things - maybe
Coccinelle or something.
> For this change however, the fix is already correct:
>
> Reviewed-by: Alexander Graf <agraf@suse.de>
Thanks,
Robin
^ permalink raw reply [flat|nested] 4+ messages in thread
* [U-Boot] efi_loader: Fix crash on 32-bit systems
2016-09-13 17:36 [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems Robin Randhawa
2016-09-14 6:34 ` Alexander Graf
@ 2016-10-13 14:34 ` Alexander Graf
1 sibling, 0 replies; 4+ messages in thread
From: Alexander Graf @ 2016-10-13 14:34 UTC (permalink / raw)
To: u-boot
> A type mismatch in the efi_allocate_pool boot service flow causes
> hazardous memory scribbling on 32-bit systems.
>
> This is efi_allocate_pool's prototype:
>
> static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
> unsigned long size,
> void **buffer);
>
> Internally, it invokes efi_allocate_pages as follows:
>
> efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
> (void*)buffer);
>
> This is efi_allocate_pages' prototype:
>
> efi_status_t efi_allocate_pages(int type, int memory_type,
> unsigned long pages,
> uint64_t *memory);
>
> The problem: efi_allocate_pages does this internally:
>
> *memory = addr;
>
> This fix in efi_allocate_pool uses a transitional uintptr_t cast to
> ensure the correct outcome, irrespective of the system's native word
> size.
>
> This was observed when bootefi'ing the EFI instance of FreeBSD's first
> stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
> Cortex-a9).
>
> Signed-off-by: Robin Randhawa <robin.randhawa@arm.com>
Thanks, applied to
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-10-13 14:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-13 17:36 [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems Robin Randhawa
2016-09-14 6:34 ` Alexander Graf
2016-09-14 11:59 ` Robin Randhawa
2016-10-13 14:34 ` [U-Boot] " Alexander Graf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.