From nobody Thu May 16 00:18:13 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+110737+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110737+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1699257188; cv=none; d=zohomail.com; s=zohoarc; b=eu77WaG9USmyf07RDAHdXSENohAXG392jMHf2DB00b55J7UBdoFYTYFGjr+ZeT4wRHRh5FRop055hWwg4bz8PfUoTJcWJBgor2vYA6QjhEQ+s5l8PAbfsVeg8hEMNYBOwRx+G1OScdhAaSHsHvuwjHaSRDuOemV85EWZuwl1lOo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1699257188; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=729KLhr6MgLkCfy3HQp/5aFWaeHyvlDmlawMEFpsqf4=; b=YzJS73XhyBVivMqpz6zfEuHR9wsjQd1wdqXa8ErhyXi/EzBOuxJJxQahRetorpGIphnFaLSobuvjG9v6YtfY5B63/nEwZ8Uv6MbN2MFr2s2Z9+SnxQOVVtFra+Bmbay1V4LTl6IH+4asQOhJGxFuGlS+tT40PJDJPJBQEoOiF64= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110737+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1699257188592630.4971186632872; Sun, 5 Nov 2023 23:53:08 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=WlWgL+ILdXsxk76aiWoK0lzOKgK3eXfL4hsss88sBo4=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1699257188; v=1; b=g6hev0ZeQ8HX/Wabhnq0E7aFPZBCt0XbF3YTlNfgaDe4NIiJFXnm9AlGH2pY+YWTjxQ92KD1 t7+D73sZi3AgyTgsQMGNYBL5ef9RiOJlR+WmfFSdP1yhCgr0vDJdsnzp7X+0bD00/1XOaaQglFM ORni20/gOdoyI/cGGbvlamTM= X-Received: by 127.0.0.2 with SMTP id P0zrYY1788612xGK8m4v7HUC; Sun, 05 Nov 2023 23:53:08 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web11.49168.1699257184993246575 for ; Sun, 05 Nov 2023 23:53:07 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="453535766" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="453535766" X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2023 23:53:07 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="885824595" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="885824595" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga004.jf.intel.com with ESMTP; 05 Nov 2023 23:53:05 -0800 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v4 1/4] StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion Date: Mon, 6 Nov 2023 15:52:56 +0800 Message-Id: <0e4c7373de1592b4349903bbc28aca7ffa46351a.1699253390.git.wei6.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: vfMSmzmVjtDE1YicFPDAUbBOx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1699257188936100005 Content-Type: text/plain; charset="utf-8" MmCoreFfsFindMmDriver() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver() track the section nesting depth against that PCD. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/Dispatcher.c | 5 ----- StandaloneMmPkg/Core/FwVol.c | 16 ++++++++++++-- StandaloneMmPkg/Core/StandaloneMmCore.c | 7 +----- StandaloneMmPkg/Core/StandaloneMmCore.h | 26 +++++++++++++++++++++++ StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 +++ StandaloneMmPkg/StandaloneMmPkg.dec | 5 +++++ 6 files changed, 49 insertions(+), 13 deletions(-) diff --git a/StandaloneMmPkg/Core/Dispatcher.c b/StandaloneMmPkg/Core/Dispa= tcher.c index b1ccba15b060..7b4a3c4c552b 100644 --- a/StandaloneMmPkg/Core/Dispatcher.c +++ b/StandaloneMmPkg/Core/Dispatcher.c @@ -53,11 +53,6 @@ typedef struct { // Function Prototypes // =20 -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - /** Insert InsertedDriverEntry onto the mScheduledQueue. To do this you must add any driver with a before dependency on InsertedDriverEntry firs= t. diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba97..e1e20ffd14ac 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image. =20 @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Calle= rs + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. =20 @retval EFI_SUCCESS Success. @retval EFI_INVALID_PARAMETER Invalid parameter. @@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources. @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. =20 **/ EFI_STATUS MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth ) { EFI_STATUS Status; @@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( =20 DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader)); =20 + if (Depth >=3D PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) { + DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", _= _func__)); + return EFI_ABORTED; + } + if (FvHasBeenProcessed (FwVolHeader)) { return EFI_SUCCESS; } @@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( } =20 InnerFvHeader =3D (VOID *)(Section + 1); - Status =3D MmCoreFfsFindMmDriver (InnerFvHeader); + Status =3D MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core= /StandaloneMmCore.c index d221f1d1115d..1074f309d718 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -9,11 +9,6 @@ =20 #include "StandaloneMmCore.h" =20 -EFI_STATUS -MmCoreFfsFindMmDriver ( - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader - ); - EFI_STATUS MmDispatcher ( VOID @@ -643,7 +638,7 @@ StandaloneMmMain ( // DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCo= rePrivate->StandaloneBfvAddress)); if (gMmCorePrivate->StandaloneBfvAddress !=3D 0) { - MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress); + MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress, 0); MmDispatcher (); } =20 diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.h b/StandaloneMmPkg/Core= /StandaloneMmCore.h index 822d95358c39..da23b8dc3c71 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.h +++ b/StandaloneMmPkg/Core/StandaloneMmCore.h @@ -846,6 +846,32 @@ DumpMmramInfo ( VOID ); =20 +/** + Given the pointer to the Firmware Volume Header find the + MM driver and return its PE32 image. + + @param [in] FwVolHeader Pointer to memory mapped FV + @param [in] Depth Nesting depth of encapsulation sections. Calle= rs + different from MmCoreFfsFindMmDriver() are + responsible for passing in a zero Depth. + + @retval EFI_SUCCESS Success. + @retval EFI_INVALID_PARAMETER Invalid parameter. + @retval EFI_NOT_FOUND Could not find section data. + @retval EFI_OUT_OF_RESOURCES Out of resources. + @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted. + @retval EFI_UNSUPPORTED Operation not supported. + @retval EFI_ABORTED Recursion aborted because Depth has been + greater than or equal to + PcdFwVolMmMaxEncapsulationDepth. + +**/ +EFI_STATUS +MmCoreFfsFindMmDriver ( + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader, + IN UINT32 Depth + ); + extern UINTN mMmramRangeCount; extern EFI_MMRAM_DESCRIPTOR *mMmramRanges; extern EFI_SYSTEM_TABLE *mEfiSystemTable; diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Co= re/StandaloneMmCore.inf index c44b9ff33303..02ecd68f37e2 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ [Guids] gEfiEventExitBootServicesGuid gEfiEventReadyToBootGuid =20 +[Pcd] + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONS= UMES + # # This configuration fails for CLANGPDB, which does not support PIE in the= GCC # sense. Such however is required for ARM family StandaloneMmCore diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/Standalo= neMmPkg.dec index 46784d94e421..c43632d6d8ae 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ [Guids] gEfiStandaloneMmNonSecureBufferGuid =3D { 0xf00497e3, 0xbfa2, 0x41a= 1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }} gEfiArmTfCpuDriverEpDescriptorGuid =3D { 0x6ecbd5a1, 0xc0f8, 0x470= 2, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }} =20 +[PcdsFixedAtBuild, PcdsPatchableInModule] + ## Maximum permitted encapsulation levels of sections in a firmware volu= me, + # in the MM phase. Minimum value is 1. Sections nested more deeply are = rejected. + # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in M= M. + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT= 32|0x00000001 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110737): https://edk2.groups.io/g/devel/message/110737 Mute This Topic: https://groups.io/mt/102415999/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu May 16 00:18:13 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+110738+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110738+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1699257192; cv=none; d=zohomail.com; s=zohoarc; b=HP0LN/G3kjJicy4NxJdOdDeH15HYJBrOs58gHf8j1uFloRy+OxdnWiTFrwrxElKk9ZiOWhQkXjLeJ47vvhhu7pdugOqq+9JBYJ+gti3QSFA2PLkBd2tid9CT+7jjnbBwqbmummw+qzgbcy0vDBGMnzdcOanFE8FnK697sHC97FY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1699257192; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=iCygg1DVMQcqJCu0MHh/kb9MkxZ3RNlqWsSyrif3gzs=; b=CJuL2oLyNqCDX7E2x30BGXPLhir5PwLjjVgole8RRbGNlZ0RiP0J/RDd2jnmiwumi4nRR/z0xtTRYt/zLyPxm/njqXsSN1FkACBHuu3qxt3UrxdM2IR7l7wtl32A60SZpPRmLk/LVxw7wJsdC4HHRwErDE/i3E0x4sheee1pv7U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110738+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 169925719200095.92109760769665; Sun, 5 Nov 2023 23:53:12 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=cAciaJ/KaZA+GeuOzOA/R20CeGNH+xjGhnj/4jKNn/4=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1699257191; v=1; b=ECwuUYowSFYVu7scFzvzUJuu2Fi7S5imnuBaFOn22UIxdvxomH1xX48SKN1H9iCItMDJNmZp Ose+V7UFlbR8+2+SiJEPf/0tpN31ICdYaThpfsgH1dB0dHzG0yk1we0RAb2beJRaFYjYthBo0IN 5yXA3lQ1DgEvjb6p4C5ce4Sw= X-Received: by 127.0.0.2 with SMTP id gbnMYY1788612xDUtdQfNSqD; Sun, 05 Nov 2023 23:53:11 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web11.49168.1699257184993246575 for ; Sun, 05 Nov 2023 23:53:11 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="453535776" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="453535776" X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2023 23:53:11 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="885824606" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="885824606" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga004.jf.intel.com with ESMTP; 05 Nov 2023 23:53:08 -0800 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v4 2/4] StandaloneMmPkg/Core: Fix potential memory leak issue Date: Mon, 6 Nov 2023 15:52:57 +0800 Message-Id: <0fc3e43cd76b1893282f7152faf1d330be9de02c.1699253390.git.wei6.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: uxjn9LcZY7pbUoAGx2UMcsRgx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1699257193008100001 Content-Type: text/plain; charset="utf-8" In MmCoreFfsFindMmDriver(), - ScratchBuffer is not freed in the error return path that DstBuffer page allocation fails. Free ScratchBuffer before return with error. - If the decoded buffer is identical to the data in InputSection, ExtractGuidedSectionDecode() will change the value of DstBuffer rather than changing the contents of the buffer that DstBuffer points at, in which case freeing DstBuffer is wrong. Introduce a local variable AllocatedDstBuffer for buffer free, free AllocatedDstBuffer immediately if it is not used. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/FwVol.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index e1e20ffd14ac..c3054ef751ed 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -84,6 +84,7 @@ MmCoreFfsFindMmDriver ( UINT32 DstBufferSize; VOID *ScratchBuffer; UINT32 ScratchBufferSize; + VOID *AllocatedDstBuffer; VOID *DstBuffer; UINT16 SectionAttribute; UINT32 AuthenticationStatus; @@ -148,25 +149,35 @@ MmCoreFfsFindMmDriver ( // // Allocate destination buffer, extra one page for adjustment // - DstBuffer =3D (VOID *)(UINTN)AllocatePages (EFI_SIZE_TO_PAGES (DstBuff= erSize)); - if (DstBuffer =3D=3D NULL) { + AllocatedDstBuffer =3D (VOID *)(UINTN)AllocatePages (EFI_SIZE_TO_PAGES= (DstBufferSize)); + if (AllocatedDstBuffer =3D=3D NULL) { + FreePages (ScratchBuffer, EFI_SIZE_TO_PAGES (ScratchBufferSize)); return EFI_OUT_OF_RESOURCES; } =20 // // Call decompress function // - Status =3D ExtractGuidedSectionDecode ( - Section, - &DstBuffer, - ScratchBuffer, - &AuthenticationStatus - ); + DstBuffer =3D AllocatedDstBuffer; + Status =3D ExtractGuidedSectionDecode ( + Section, + &DstBuffer, + ScratchBuffer, + &AuthenticationStatus + ); FreePages (ScratchBuffer, EFI_SIZE_TO_PAGES (ScratchBufferSize)); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } =20 + // + // Free allocated DstBuffer if it is not used + // + if (DstBuffer !=3D AllocatedDstBuffer) { + FreePages (AllocatedDstBuffer, EFI_SIZE_TO_PAGES (DstBufferSize)); + AllocatedDstBuffer =3D NULL; + } + DEBUG (( DEBUG_INFO, "Processing compressed firmware volume (AuthenticationStatus =3D=3D = %x)\n", @@ -210,7 +221,9 @@ MmCoreFfsFindMmDriver ( return EFI_SUCCESS; =20 FreeDstBuffer: - FreePages (DstBuffer, EFI_SIZE_TO_PAGES (DstBufferSize)); + if (AllocatedDstBuffer !=3D NULL) { + FreePages (AllocatedDstBuffer, EFI_SIZE_TO_PAGES (DstBufferSize)); + } =20 return Status; } --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110738): https://edk2.groups.io/g/devel/message/110738 Mute This Topic: https://groups.io/mt/102416000/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu May 16 00:18:13 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+110739+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110739+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1699257196; cv=none; d=zohomail.com; s=zohoarc; b=L9ueZ9JVnTMXdXqiROI0QAPwpu66xlDCDypO5FQbZrVaSRsrM4cfws7l5jlNOMHd/wDENtC2Uh3dGZCntasry5jCfIXgjRK06a3LB66ThWsQa5I6sfaOC4017EtQ+g+u6vS8ER5HOqn2bNiMQ57gIUCwt9WhM4X6usCZEAT9dZ0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1699257196; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=FEx+cddqPfTPhqGnyK+vDZDryc6CQX0xI+Qzmi7OSxY=; b=DeGOK54xnEtegkavr3/+/7qiNmE6RWdPvQov2A+G3ZC6hcn+1zy0tmce7zNuryo+rjn1auHmMQMPen8A+4ekMMLRBBzRaHqaKCk10j0UIJwDVqqGbRgb0kS73B3ooJFJekhK8DR+BVGaGeYW6XioTfiRfJAb4cM40DYJw8Y0Gbo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110739+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1699257196012158.53371186711774; Sun, 5 Nov 2023 23:53:16 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=fm5sXqnulGCDME6ugEVR/oSxdhXjBrnCdYZAZ8mVJ5I=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1699257195; v=1; b=Kk6kZqv3QulU7wuebnQ6ISJji4SxrY4KSf5PnCD1pUymsrJIoyfuCWfz5yesl/mK9PoDzrcb uh8dcIqgR0DhM3k5Qi6T+O6POjFpVgmXQ+fUMh8eZNUmPGq6iPxUiRVy3dZHBe41gb8BGlQUMSe +WyXi0fBIsax2ptauHlIMVnQ= X-Received: by 127.0.0.2 with SMTP id LEtwYY1788612x42aPSWnuCc; Sun, 05 Nov 2023 23:53:15 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web11.49168.1699257184993246575 for ; Sun, 05 Nov 2023 23:53:15 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="453535789" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="453535789" X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2023 23:53:15 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="885824615" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="885824615" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga004.jf.intel.com with ESMTP; 05 Nov 2023 23:53:12 -0800 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v4 3/4] StandaloneMmPkg/Core: Fix issue that offset calculation might be wrong Date: Mon, 6 Nov 2023 15:52:58 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: lIeewQlv5kIlnOG3bwT7sxI6x1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1699257196901100001 Content-Type: text/plain; charset="utf-8" MmCoreFfsFindMmDriver() assumes FileHeader is EFI_FFS_FILE_HEADER. If FileHeader is an EFI_FFS_FILE_HEADER2, 'FileHeader + 1' will get a wrong section address. Use FfsFindSection to get the section directly, instead of 'FileHeader + 1' to avoid this issue. MmCoreFfsFindMmDriver() also assumes section is EFI_COMMON_SECTION_HEADER. If Section is EFI_COMMON_SECTION_HEADER2, 'Section + 1' will get a wrong wrong InnerFvHeader adress. Add section head detection and calculate the address accordingly. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/FwVol.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index c3054ef751ed..4d2b63a448e7 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -79,8 +79,6 @@ MmCoreFfsFindMmDriver ( UINTN DepexSize; UINTN Index; EFI_COMMON_SECTION_HEADER *Section; - VOID *SectionData; - UINTN SectionDataSize; UINT32 DstBufferSize; VOID *ScratchBuffer; UINT32 ScratchBufferSize; @@ -117,23 +115,21 @@ MmCoreFfsFindMmDriver ( break; } =20 - Status =3D FfsFindSectionData ( + Status =3D FfsFindSection ( EFI_SECTION_GUID_DEFINED, FileHeader, - &SectionData, - &SectionDataSize + &Section ); if (EFI_ERROR (Status)) { break; } =20 - Section =3D (EFI_COMMON_SECTION_HEADER *)(FileHeader + 1); - Status =3D ExtractGuidedSectionGetInfo ( - Section, - &DstBufferSize, - &ScratchBufferSize, - &SectionAttribute - ); + Status =3D ExtractGuidedSectionGetInfo ( + Section, + &DstBufferSize, + &ScratchBufferSize, + &SectionAttribute + ); if (EFI_ERROR (Status)) { break; } @@ -194,8 +190,13 @@ MmCoreFfsFindMmDriver ( goto FreeDstBuffer; } =20 - InnerFvHeader =3D (VOID *)(Section + 1); - Status =3D MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); + if (IS_SECTION2 (Section)) { + InnerFvHeader =3D (VOID *)((EFI_COMMON_SECTION_HEADER2 *)Section + 1= ); + } else { + InnerFvHeader =3D (VOID *)(Section + 1); + } + + Status =3D MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); if (EFI_ERROR (Status)) { goto FreeDstBuffer; } --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110739): https://edk2.groups.io/g/devel/message/110739 Mute This Topic: https://groups.io/mt/102416001/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Thu May 16 00:18:13 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+110740+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110740+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1699257200; cv=none; d=zohomail.com; s=zohoarc; b=k0RaGRYgG6T8OQWeRGRJPr9hD1hUi+ZlV8YCBamnniqBfl3jbI1bx4KSJ+sW/zUveSQyv1CHp5+QuaOJMYHTKffOZdHsC07hJZTydvIsqXcEhX8kOXlauBlcajUg/MwYi5Z6KWTvXQZsqiVbg/3Rn/Vm5V2y5Mwx7uA59A6uttE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1699257200; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=HOPCoYEju6rss5TksrNqG6JnsvlySDb7OW0zh0tzHyo=; b=ZT8kyajcbw8iwMSvJhhyLhXZ3Uxqsw9PzEHNtJdlHeplWzPcR4GPVUumklUNlBkvLLVShDTmkGGQx2xMeVkr6ZRKys9wzFxoUmL9VxV8yhRUCQx0gORpvtYPdKGbbuaWVXAtUCE/jMYR09oPb13aQ8jmGuZer6pkDWStRGpZLm8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+110740+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1699257200572223.64323125755368; Sun, 5 Nov 2023 23:53:20 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=2uvCDFlecGTOqGU/l7UgM4uKy5BcXTUOy80JYncy0Iw=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1699257200; v=1; b=YL2noS3NbnxJp9te8jm1K/+WBWf5qi/9h2bBHueYvoHRMxuPEFWXP74VjQ3ssGxsQuX5P2TX Pem5YYS0BQIr/giIOhgzZ1WuCW6TvkSuCJ43ioyuRHI1khUafaGLBVKbS3TOOf0j1mWh+tRD0GE JRCuBxIB+a5cXeL9KclBr4VI= X-Received: by 127.0.0.2 with SMTP id WPljYY1788612x0XYNSCFWFt; Sun, 05 Nov 2023 23:53:20 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [134.134.136.31]) by mx.groups.io with SMTP id smtpd.web11.49168.1699257184993246575 for ; Sun, 05 Nov 2023 23:53:19 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="453535802" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="453535802" X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Nov 2023 23:53:19 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10885"; a="885824623" X-IronPort-AV: E=Sophos;i="6.03,280,1694761200"; d="scan'208";a="885824623" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga004.jf.intel.com with ESMTP; 05 Nov 2023 23:53:17 -0800 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v4 4/4] StandaloneMmPkg/Core: Fix the failure to find uncompressed inner FV Date: Mon, 6 Nov 2023 15:52:59 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: 4sCE4doIGqp5I8TdaFVtfTzZx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1699257200925100001 Content-Type: text/plain; charset="utf-8" The MmCoreFfsFindMmDriver only checks for encapsulated compressed FVs. When an inner FV is uncompressed, StandaloneMmCore will miss the FV and all the MM drivers in the FV will not be dispatched. Add checks for uncompressed inner FV to fix this issue. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu Reviewed-by: Laszlo Ersek --- StandaloneMmPkg/Core/FwVol.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 4d2b63a448e7..07500cee41f3 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -79,6 +79,8 @@ MmCoreFfsFindMmDriver ( UINTN DepexSize; UINTN Index; EFI_COMMON_SECTION_HEADER *Section; + VOID *SectionData; + UINTN SectionDataSize; UINT32 DstBufferSize; VOID *ScratchBuffer; UINT32 ScratchBufferSize; @@ -115,6 +117,26 @@ MmCoreFfsFindMmDriver ( break; } =20 + // + // Check uncompressed firmware volumes + // + Status =3D FfsFindSectionData ( + EFI_SECTION_FIRMWARE_VOLUME_IMAGE, + FileHeader, + &SectionData, + &SectionDataSize + ); + if (!EFI_ERROR (Status)) { + if (SectionDataSize > sizeof (EFI_FIRMWARE_VOLUME_HEADER)) { + InnerFvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)SectionData; + MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1); + continue; + } + } + + // + // Check compressed firmware volumes + // Status =3D FfsFindSection ( EFI_SECTION_GUID_DEFINED, FileHeader, --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110740): https://edk2.groups.io/g/devel/message/110740 Mute This Topic: https://groups.io/mt/102416011/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-