From nobody Mon May 6 23:59:56 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+66572+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+66572+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=nvidia.com ARC-Seal: i=1; a=rsa-sha256; t=1603491032; cv=none; d=zohomail.com; s=zohoarc; b=fA2A2MeU1PaEMTF4QUBr5OzPga2O37xggEUnvRGvg56c4p5fxFJVCw13cCUHuhVqwFZF5tImXAD8OEkCveg2fHi2xScL9ywmWb7I5qzNtX3y5BR9w2i1Wq4JXqodJ4jlrUOdrn3J8AGy7Ya/ArZacRPEYnj9JKHaHJuNFRt/5Vg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1603491032; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Id:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Sender:Subject:To; bh=WYI8cMik3PZ3XKu7K4Tonb5LYzdTSuknI3XjQs20YdY=; b=L7RRHRlk4a0Ab4+DSpcS4Bpe2PPjJYK0tt/L2om+v+6S6f0q7lfQCsazfnjJat9b7gO3Qd/V3Yf22wZqqbkfBmTFIhFVWLLPWM/aJS0LRnGrpxFtlDdT+xjvLYg2wic6zEaGg6upD0hdZF62LSE1Vp4NeT1JmDkqeLdaCRdbrXw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+66572+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1603491032467151.61312876264174; Fri, 23 Oct 2020 15:10:32 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id jq9tYY1788612x9Rfk8w9MXF; Fri, 23 Oct 2020 15:10:32 -0700 X-Received: from hqnvemgate24.nvidia.com (hqnvemgate24.nvidia.com [216.228.121.143]) by mx.groups.io with SMTP id smtpd.web11.3947.1603491026560785482 for ; Fri, 23 Oct 2020 15:10:26 -0700 X-Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate24.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 23 Oct 2020 15:10:35 -0700 X-Received: from HQMAIL111.nvidia.com (172.20.187.18) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 23 Oct 2020 22:10:22 +0000 X-Received: from jbrasen-ux.nvidia.com (10.124.1.5) by mail.nvidia.com (172.20.187.18) with Microsoft SMTP Server id 15.0.1473.3 via Frontend Transport; Fri, 23 Oct 2020 22:10:22 +0000 From: "Jeff Brasen" To: CC: , , Jeff Brasen Subject: [edk2-devel] [PATCH] MdeModulePkg/Gcd: Check memory allocation when initializing memory Date: Fri, 23 Oct 2020 16:10:07 -0600 Message-ID: <20201023221007.1097763-1-jbrasen@nvidia.com> MIME-Version: 1.0 X-NVConfidentiality: public Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jbrasen@nvidia.com X-Gm-Message-State: 35oysWFYu8SRPFmU7wo72qkBx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1603491032; bh=qvyRBG7ZUZBFSUUnIOWOMY9HcKF9AX0qWs8pJxHL5Xc=; h=CC:Content-Type:Date:From:Reply-To:Subject:To; b=WgjBdkCVUWFDQ1SNYonTTz8yZesD/WhByx5NvtDwTVFpcveeJC9WRxcRw+oa0aEglCy pfsGk6w2raruKczHClIMJgu8JVzX9BGjuAqPtcdI6+7Twxcjq3yAF4Ol8YEqbEn5eTX50 uEa0H3jky4cDnsI+VU8T3xAZ2JEYP7crqvI= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" CoreInitializeMemoryServices was not checking for any existing memory allocation created in the HOB producer phase. If there are memory allocations outside of the region covered by the HOB List then Gcd could select that region for memory which can result in the memory allocation to not be handled and memory overwrites. Signed-off-by: Jeff Brasen --- MdeModulePkg/Core/Dxe/Gcd/Gcd.c | 60 +++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c b/MdeModulePkg/Core/Dxe/Gcd/Gc= d.c index 2d8c076f71..4a22ee96b7 100644 --- a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c +++ b/MdeModulePkg/Core/Dxe/Gcd/Gcd.c @@ -2097,6 +2097,62 @@ CalculateTotalMemoryBinSizeNeeded ( return TotalSize; } =20 +/** + Find the largest region in the specified region that is not covered by = an existing memory allocation + + @param BaseAddress On input start of the region to check. + On output start of the largest free region. + @param Length On input size of region to check. + On output size of the largest free region. + @param MemoryHob Hob pointer for the first memory allocation pointe= r to check +**/ +VOID +FindLargestFreeRegion ( + IN OUT EFI_PHYSICAL_ADDRESS *BaseAddress, + IN OUT UINT64 *Length, + IN EFI_HOB_MEMORY_ALLOCATION *MemoryHob + ) +{ + EFI_PHYSICAL_ADDRESS TopAddress; + + TopAddress =3D *BaseAddress + *Length; + while (MemoryHob !=3D NULL) { + EFI_PHYSICAL_ADDRESS AllocatedTop; + + AllocatedTop =3D MemoryHob->AllocDescriptor.MemoryBaseAddress + Memory= Hob->AllocDescriptor.MemoryLength; + + if ((MemoryHob->AllocDescriptor.MemoryBaseAddress >=3D *BaseAddress) && + (AllocatedTop <=3D TopAddress)) { + EFI_PHYSICAL_ADDRESS LowerBase; + UINT64 LowerSize; + EFI_PHYSICAL_ADDRESS UpperBase; + UINT64 UpperSize; + + LowerBase =3D *BaseAddress; + LowerSize =3D MemoryHob->AllocDescriptor.MemoryBaseAddress - *BaseAd= dress; + UpperBase =3D AllocatedTop; + UpperSize =3D TopAddress - AllocatedTop; + + if (LowerSize !=3D 0) { + FindLargestFreeRegion (&LowerBase, &LowerSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + if (UpperSize !=3D 0) { + FindLargestFreeRegion (&UpperBase, &UpperSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + + if (UpperSize >=3D LowerSize) { + *Length =3D UpperSize; + *BaseAddress =3D UpperBase; + } else { + *Length =3D LowerSize; + *BaseAddress =3D LowerBase; + } + return; + } + MemoryHob =3D GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB= (MemoryHob)); + } +} + /** External function. Initializes memory services based on the memory descriptor HOBs. This function is responsible for priming the memory @@ -2235,6 +2291,7 @@ CoreInitializeMemoryServices ( Attributes =3D PhitResourceHob->ResourceAttribute; BaseAddress =3D PageAlignAddress (PhitHob->EfiMemoryTop); Length =3D PageAlignLength (ResourceHob->PhysicalStart + Resourc= eHob->ResourceLength - BaseAddress); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLOCATI= ON *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, then @@ -2242,6 +2299,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (PhitHob->EfiFreeMemoryBottom); Length =3D PageAlignLength (PhitHob->EfiFreeMemoryTop - BaseAd= dress); + //This region is required to have no memory allocation inside it, sk= ip check for entries in HOB List if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, th= en @@ -2249,6 +2307,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (ResourceHob->PhysicalStart); Length =3D PageAlignLength ((UINT64)((UINTN)*HobStart - Base= Address)); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLO= CATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); } } break; @@ -2312,6 +2371,7 @@ CoreInitializeMemoryServices ( // TestedMemoryBaseAddress =3D PageAlignAddress (ResourceHob->PhysicalS= tart); TestedMemoryLength =3D PageAlignLength (ResourceHob->PhysicalS= tart + ResourceHob->ResourceLength - TestedMemoryBaseAddress); + FindLargestFreeRegion (&TestedMemoryBaseAddress, &TestedMemoryLength= , (EFI_HOB_MEMORY_ALLOCATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)= ); if (TestedMemoryLength < MinimalMemorySizeNeeded) { continue; } --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#66572): https://edk2.groups.io/g/devel/message/66572 Mute This Topic: https://groups.io/mt/77762677/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-