Re: [PATCH] MdeModulePkg/NonDiscoverable: fix memory override bug

["Zeng, Star" <star.zeng@intel.com>]

Just pushed at 710d9e69fae6753a1a826aa18dd37bcadd3e0c3e.

Thanks,
Star
-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Heyi Guo
Sent: Tuesday, November 7, 2017 5:33 PM
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ni, Ruiyu <ruiyu.ni@intel.com>; edk2-devel@lists.01.org; Dong, Eric <eric.dong@intel.com>; Zeng, Star <star.zeng@intel.com>; linaro-uefi <linaro-uefi@lists.linaro.org>
Subject: Re: [edk2] [PATCH] MdeModulePkg/NonDiscoverable: fix memory override bug

Hi Ray,

We had Ard's R-B already; could you help to commit it?

Thanks and regards,

Heyi


在 10/30/2017 4:14 PM, Ard Biesheuvel 写道:
> On 30 October 2017 at 05:47, Heyi Guo <heyi.guo@linaro.org> wrote:
>> For PciIoPciRead interface, memory prior to Buffer would be written 
>> with zeros if Offset was larger than sizeof (Dev->ConfigSpace), which 
>> would cause serious system exception.
>>
>> So we add a pre-check branch to avoid memory override.
>>
>> Cc: Star Zeng <star.zeng@intel.com>
>> Cc: Eric Dong <eric.dong@intel.com>
>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>> Cc: Ruiyu Ni <ruiyu.ni@intel.com>
>> Contributed-under: TianoCore Contribution Agreement 1.1
>> Signed-off-by: Heyi Guo <heyi.guo@linaro.org>
> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>
>> ---
>>   .../Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git 
>> a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePci
>> DeviceIo.c 
>> b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePci
>> DeviceIo.c
>> index c836ad6..0e42ae4 100644
>> --- 
>> a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePci
>> DeviceIo.c
>> +++ b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverabl
>> +++ ePciDeviceIo.c
>> @@ -465,6 +465,11 @@ PciIoPciRead (
>>     Address = (UINT8 *)&Dev->ConfigSpace + Offset;
>>     Length = Count << ((UINTN)Width & 0x3);
>>
>> +  if (Offset >= sizeof (Dev->ConfigSpace)) {
>> +    ZeroMem (Buffer, Length);
>> +    return EFI_SUCCESS;
>> +  }
>> +
>>     if (Offset + Length > sizeof (Dev->ConfigSpace)) {
>>       //
>>       // Read all zeroes for config space accesses beyond the first
>> --
>> 1.9.1
>>

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel