MmCoreFfsFindMmDriver() assumes FileHeader is EFI_FFS_FILE_HEADER.
If FileHeader is an EFI_FFS_FILE_HEADER2, 'FileHeader + 1' will get a
wrong section address. Use FfsFindSection to get the section directly,
instead of 'FileHeader + 1' to avoid this issue.
MmCoreFfsFindMmDriver() also assumes section is EFI_COMMON_SECTION_HEADER.
If Section is EFI_COMMON_SECTION_HEADER2, 'Section + 1' will get a wrong
wrong InnerFvHeader adress. Add section head detection and calculate the
address accordingly.
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Ray Ni <ray.ni@intel.com>
Signed-off-by: Wei6 Xu <wei6.xu@intel.com>
---
StandaloneMmPkg/Core/FwVol.c | 29 +++++++++++++++--------------
1 file changed, 15 insertions(+), 14 deletions(-)
diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c
index c3054ef751ed..4d2b63a448e7 100644
--- a/StandaloneMmPkg/Core/FwVol.c
+++ b/StandaloneMmPkg/Core/FwVol.c
@@ -79,8 +79,6 @@ MmCoreFfsFindMmDriver (
UINTN DepexSize;
UINTN Index;
EFI_COMMON_SECTION_HEADER *Section;
- VOID *SectionData;
- UINTN SectionDataSize;
UINT32 DstBufferSize;
VOID *ScratchBuffer;
UINT32 ScratchBufferSize;
@@ -117,23 +115,21 @@ MmCoreFfsFindMmDriver (
break;
}
- Status = FfsFindSectionData (
+ Status = FfsFindSection (
EFI_SECTION_GUID_DEFINED,
FileHeader,
- &SectionData,
- &SectionDataSize
+ &Section
);
if (EFI_ERROR (Status)) {
break;
}
- Section = (EFI_COMMON_SECTION_HEADER *)(FileHeader + 1);
- Status = ExtractGuidedSectionGetInfo (
- Section,
- &DstBufferSize,
- &ScratchBufferSize,
- &SectionAttribute
- );
+ Status = ExtractGuidedSectionGetInfo (
+ Section,
+ &DstBufferSize,
+ &ScratchBufferSize,
+ &SectionAttribute
+ );
if (EFI_ERROR (Status)) {
break;
}
@@ -194,8 +190,13 @@ MmCoreFfsFindMmDriver (
goto FreeDstBuffer;
}
- InnerFvHeader = (VOID *)(Section + 1);
- Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);
+ if (IS_SECTION2 (Section)) {
+ InnerFvHeader = (VOID *)((EFI_COMMON_SECTION_HEADER2 *)Section + 1);
+ } else {
+ InnerFvHeader = (VOID *)(Section + 1);
+ }
+
+ Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);
if (EFI_ERROR (Status)) {
goto FreeDstBuffer;
}
--
2.29.2.windows.2
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110739): https://edk2.groups.io/g/devel/message/110739
Mute This Topic: https://groups.io/mt/102416001/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
On 11/6/23 08:52, Xu, Wei6 wrote:
> MmCoreFfsFindMmDriver() assumes FileHeader is EFI_FFS_FILE_HEADER.
> If FileHeader is an EFI_FFS_FILE_HEADER2, 'FileHeader + 1' will get a
> wrong section address. Use FfsFindSection to get the section directly,
> instead of 'FileHeader + 1' to avoid this issue.
> MmCoreFfsFindMmDriver() also assumes section is EFI_COMMON_SECTION_HEADER.
> If Section is EFI_COMMON_SECTION_HEADER2, 'Section + 1' will get a wrong
> wrong InnerFvHeader adress. Add section head detection and calculate the
> address accordingly.
>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Sami Mujawar <sami.mujawar@arm.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Signed-off-by: Wei6 Xu <wei6.xu@intel.com>
> ---
> StandaloneMmPkg/Core/FwVol.c | 29 +++++++++++++++--------------
> 1 file changed, 15 insertions(+), 14 deletions(-)
>
> diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c
> index c3054ef751ed..4d2b63a448e7 100644
> --- a/StandaloneMmPkg/Core/FwVol.c
> +++ b/StandaloneMmPkg/Core/FwVol.c
> @@ -79,8 +79,6 @@ MmCoreFfsFindMmDriver (
> UINTN DepexSize;
> UINTN Index;
> EFI_COMMON_SECTION_HEADER *Section;
> - VOID *SectionData;
> - UINTN SectionDataSize;
> UINT32 DstBufferSize;
> VOID *ScratchBuffer;
> UINT32 ScratchBufferSize;
> @@ -117,23 +115,21 @@ MmCoreFfsFindMmDriver (
> break;
> }
>
> - Status = FfsFindSectionData (
> + Status = FfsFindSection (
> EFI_SECTION_GUID_DEFINED,
> FileHeader,
> - &SectionData,
> - &SectionDataSize
> + &Section
> );
> if (EFI_ERROR (Status)) {
> break;
> }
>
> - Section = (EFI_COMMON_SECTION_HEADER *)(FileHeader + 1);
> - Status = ExtractGuidedSectionGetInfo (
> - Section,
> - &DstBufferSize,
> - &ScratchBufferSize,
> - &SectionAttribute
> - );
> + Status = ExtractGuidedSectionGetInfo (
> + Section,
> + &DstBufferSize,
> + &ScratchBufferSize,
> + &SectionAttribute
> + );
> if (EFI_ERROR (Status)) {
> break;
> }
> @@ -194,8 +190,13 @@ MmCoreFfsFindMmDriver (
> goto FreeDstBuffer;
> }
>
> - InnerFvHeader = (VOID *)(Section + 1);
> - Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);
> + if (IS_SECTION2 (Section)) {
> + InnerFvHeader = (VOID *)((EFI_COMMON_SECTION_HEADER2 *)Section + 1);
> + } else {
> + InnerFvHeader = (VOID *)(Section + 1);
> + }
> +
> + Status = MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);
> if (EFI_ERROR (Status)) {
> goto FreeDstBuffer;
> }
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110923): https://edk2.groups.io/g/devel/message/110923
Mute This Topic: https://groups.io/mt/102416001/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/leave/3901457/1787277/102458076/xyzzy [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2026 Red Hat, Inc.