From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.byosoft.com.cn (mail.byosoft.com.cn [58.240.74.242]) by mx.groups.io with SMTP id smtpd.web10.4698.1647566459051068873 for ; Thu, 17 Mar 2022 18:21:00 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=none, err=permanent DNS error (domain: byosoft.com.cn, ip: 58.240.74.242, mailfrom: gaoliming@byosoft.com.cn) Received: from DESKTOPS6D0PVI ([101.224.116.119]) (envelope-sender ) by 192.168.6.13 with ESMTP for ; Fri, 18 Mar 2022 09:20:53 +0800 X-WM-Sender: gaoliming@byosoft.com.cn X-Originating-IP: 101.224.116.119 X-WM-AuthFlag: YES X-WM-AuthUser: gaoliming@byosoft.com.cn From: "gaoliming" To: , Cc: "'Jiewen Yao'" , "'Eric Dong'" , "'Ray Ni'" , "'Jian J Wang'" References: <20220316035954.1146-1-kuqin12@gmail.com> <20220316035954.1146-2-kuqin12@gmail.com> In-Reply-To: <20220316035954.1146-2-kuqin12@gmail.com> Subject: =?UTF-8?B?5Zue5aSNOiBbZWRrMi1kZXZlbF0gW1BBVENIIHYxIDEvMV0gTWRlTW9kdWxlUGtnOiBQaVNtbUNvcmU6IEluc3BlY3QgbWVtb3J5IGd1YXJkZWQgd2l0aCBwb29sIGhlYWRlcnM=?= Date: Fri, 18 Mar 2022 09:20:56 +0800 Message-ID: <018301d83a66$6b769b80$4263d280$@byosoft.com.cn> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQFF5TukRQYtvBmYwT7b1vo9dR2mAQJid8VUrdXui9A= Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: quoted-printable Content-Language: zh-cn Reviewed-by: Liming Gao > -----=D3=CA=BC=FE=D4=AD=BC=FE----- > =B7=A2=BC=FE=C8=CB: devel@edk2.groups.io =B4=FA=B1= =ED Kun Qin > =B7=A2=CB=CD=CA=B1=BC=E4: 2022=C4=EA3=D4=C216=C8=D5 12:00 > =CA=D5=BC=FE=C8=CB: devel@edk2.groups.io > =B3=AD=CB=CD: Jiewen Yao ; Eric Dong ; > Ray Ni ; Jian J Wang ; Liming Ga= o > > =D6=F7=CC=E2: [edk2-devel] [PATCH v1 1/1] MdeModulePkg: PiSmmCore: Inspec= t > memory guarded with pool headers >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3488 >=20 > Current free pool routine from PiSmmCore will inspect memory guard status > for target buffer without considering pool headers. This could lead to > `IsMemoryGuarded` function to return incorrect results. >=20 > In that sense, allocating a 0 sized pool could cause an allocated buffer > directly points into a guard page, which is legal. However, trying to > free this pool will cause the routine changed in this commit to read XP > pages, which leads to page fault. >=20 > This change will inspect memory guarded with pool headers. This can avoid > errors when a pool content happens to be on a page boundary. >=20 > Cc: Jiewen Yao > Cc: Eric Dong > Cc: Ray Ni > Cc: Jian J Wang > Cc: Liming Gao >=20 > Signed-off-by: Kun Qin > --- > MdeModulePkg/Core/PiSmmCore/Pool.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) >=20 > diff --git a/MdeModulePkg/Core/PiSmmCore/Pool.c > b/MdeModulePkg/Core/PiSmmCore/Pool.c > index 96ebe811c669..e1ff40a8ea55 100644 > --- a/MdeModulePkg/Core/PiSmmCore/Pool.c > +++ b/MdeModulePkg/Core/PiSmmCore/Pool.c > @@ -382,11 +382,6 @@ SmmInternalFreePool ( > return EFI_INVALID_PARAMETER; > } >=20 > - MemoryGuarded =3D IsHeapGuardEnabled () && > - IsMemoryGuarded > ((EFI_PHYSICAL_ADDRESS)(UINTN)Buffer); > - HasPoolTail =3D !(MemoryGuarded && > - ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) =3D=3D > 0)); > - > FreePoolHdr =3D (FREE_POOL_HEADER *)((POOL_HEADER *)Buffer - 1); > ASSERT (FreePoolHdr->Header.Signature =3D=3D POOL_HEAD_SIGNATURE); > ASSERT (!FreePoolHdr->Header.Available); > @@ -394,6 +389,11 @@ SmmInternalFreePool ( > return EFI_INVALID_PARAMETER; > } >=20 > + MemoryGuarded =3D IsHeapGuardEnabled () && > + IsMemoryGuarded > ((EFI_PHYSICAL_ADDRESS)(UINTN)FreePoolHdr); > + HasPoolTail =3D !(MemoryGuarded && > + ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) =3D=3D > 0)); > + > if (HasPoolTail) { > PoolTail =3D HEAD_TO_TAIL (&FreePoolHdr->Header); > ASSERT (PoolTail->Signature =3D=3D POOL_TAIL_SIGNATURE); > -- > 2.35.1.windows.2 >=20 >=20 >=20 >=20 >=20