From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.byosoft.com.cn (mail.byosoft.com.cn [58.240.74.242]) by mx.groups.io with SMTP id smtpd.web09.2778.1652402336403441945 for ; Thu, 12 May 2022 17:38:57 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=none, err=permanent DNS error (domain: byosoft.com.cn, ip: 58.240.74.242, mailfrom: gaoliming@byosoft.com.cn) Received: from DESKTOPS6D0PVI ([101.224.116.119]) (envelope-sender ) by 192.168.6.13 with ESMTP for ; Fri, 13 May 2022 08:38:49 +0800 X-WM-Sender: gaoliming@byosoft.com.cn X-Originating-IP: 101.224.116.119 X-WM-AuthFlag: YES X-WM-AuthUser: gaoliming@byosoft.com.cn From: "gaoliming" To: , Cc: "'Jiewen Yao'" , "'Eric Dong'" , "'Ray Ni'" , "'Jian J Wang'" References: <20220426004746.190-1-kuqin12@gmail.com> <16E94BCEA778D83E.21521@groups.io> <4a986954-f9db-e9ad-0d8b-5ed08097ede3@gmail.com> In-Reply-To: <4a986954-f9db-e9ad-0d8b-5ed08097ede3@gmail.com> Subject: =?UTF-8?B?5Zue5aSNOiBbZWRrMi1kZXZlbF0gW1BBVENIIHYyIDEvMV0gTWRlTW9kdWxlUGtnOiBQaVNtbUNvcmU6IEluc3BlY3QgbWVtb3J5IGd1YXJkZWQgd2l0aCBwb29sIGhlYWRlcnM=?= Date: Fri, 13 May 2022 08:38:43 +0800 Message-ID: <043f01d86661$d2a46680$77ed3380$@byosoft.com.cn> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQHoz5OZetpFYsh5bzTJQNKp9UTuVAFj0kmDAQjrYBas57zMYA== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Language: zh-cn Kun: This patch is reviewed before soft feature freeze. I agree to merge it fo= r this stable tag.=20 Here is PR https://github.com/tianocore/edk2/pull/2881 Thanks Liming > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > =E5=8F=91=E4=BB=B6=E4=BA=BA: devel@edk2.groups.io = =E4=BB=A3=E8=A1=A8 Kun Qin > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: 2022=E5=B9=B45=E6=9C=8813=E6=97=A5 = 8:23 > =E6=94=B6=E4=BB=B6=E4=BA=BA: devel@edk2.groups.io > =E6=8A=84=E9=80=81: Jiewen Yao ; Eric Dong ; > Ray Ni ; Jian J Wang ; Liming Ga= o > > =E4=B8=BB=E9=A2=98: Re: [edk2-devel] [PATCH v2 1/1] MdeModulePkg: PiSmmCo= re: Inspect > memory guarded with pool headers >=20 > Hi maintainers, >=20 > This patch was reviewed and sent a while back, could you please help me > to merge in this change, if no further feedback? >=20 > Thanks in advance, > Kun >=20 > On 4/25/2022 5:47 PM, Kun Qin via groups.io wrote: > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3488 > > > > Current free pool routine from PiSmmCore will inspect memory guard stat= us > > for target buffer without considering pool headers. This could lead to > > `IsMemoryGuarded` function to return incorrect results. > > > > In that sense, allocating a 0 sized pool could cause an allocated buffe= r > > directly points into a guard page, which is legal. However, trying to > > free this pool will cause the routine changed in this commit to read XP > > pages, which leads to page fault. > > > > This change will inspect memory guarded with pool headers. This can avo= id > > errors when a pool content happens to be on a page boundary. > > > > Cc: Jiewen Yao > > Cc: Eric Dong > > Cc: Ray Ni > > Cc: Jian J Wang > > Cc: Liming Gao > > > > Signed-off-by: Kun Qin > > Reviewed-by: Jian J Wang > > Reviewed-by: Liming Gao > > --- > > > > Notes: > > v2: > > - Added reviewed-by tag [Jian] > > - Added reviewed-by tag [Liming] > > > > MdeModulePkg/Core/PiSmmCore/Pool.c | 10 +++++----- > > 1 file changed, 5 insertions(+), 5 deletions(-) > > > > diff --git a/MdeModulePkg/Core/PiSmmCore/Pool.c > b/MdeModulePkg/Core/PiSmmCore/Pool.c > > index 96ebe811c669..e1ff40a8ea55 100644 > > --- a/MdeModulePkg/Core/PiSmmCore/Pool.c > > +++ b/MdeModulePkg/Core/PiSmmCore/Pool.c > > @@ -382,11 +382,6 @@ SmmInternalFreePool ( > > return EFI_INVALID_PARAMETER; > > } > > > > - MemoryGuarded =3D IsHeapGuardEnabled () && > > - IsMemoryGuarded > ((EFI_PHYSICAL_ADDRESS)(UINTN)Buffer); > > - HasPoolTail =3D !(MemoryGuarded && > > - ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) =3D=3D > 0)); > > - > > FreePoolHdr =3D (FREE_POOL_HEADER *)((POOL_HEADER *)Buffer - 1); > > ASSERT (FreePoolHdr->Header.Signature =3D=3D > POOL_HEAD_SIGNATURE); > > ASSERT (!FreePoolHdr->Header.Available); > > @@ -394,6 +389,11 @@ SmmInternalFreePool ( > > return EFI_INVALID_PARAMETER; > > } > > > > + MemoryGuarded =3D IsHeapGuardEnabled () && > > + IsMemoryGuarded > ((EFI_PHYSICAL_ADDRESS)(UINTN)FreePoolHdr); > > + HasPoolTail =3D !(MemoryGuarded && > > + ((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) =3D=3D > 0)); > > + > > if (HasPoolTail) { > > PoolTail =3D HEAD_TO_TAIL (&FreePoolHdr->Header); > > ASSERT (PoolTail->Signature =3D=3D POOL_TAIL_SIGNATURE); >=20 >=20 >=20 >=20