From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.132.183.28; helo=mx1.redhat.com; envelope-from=lersek@redhat.com; receiver=edk2-devel@lists.01.org Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 541A6223CCEEF for ; Thu, 1 Feb 2018 08:06:46 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 59B2D19CF78; Thu, 1 Feb 2018 16:12:23 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-121-206.rdu2.redhat.com [10.10.121.206]) by smtp.corp.redhat.com (Postfix) with ESMTP id 15CD366FFD; Thu, 1 Feb 2018 16:12:21 +0000 (UTC) To: Ruiyu Ni , edk2-devel@lists.01.org Cc: Jiewen Yao , Star Zeng References: <20180201101539.320452-1-ruiyu.ni@intel.com> From: Laszlo Ersek Message-ID: <1bde96c6-7ca3-0ee8-9990-6e0ca17026fe@redhat.com> Date: Thu, 1 Feb 2018 17:12:20 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <20180201101539.320452-1-ruiyu.ni@intel.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Thu, 01 Feb 2018 16:12:23 +0000 (UTC) Subject: Re: [PATCH] MdeModulePkg/SmmCore: Fix hang due to already-freed memory deference X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Feb 2018 16:06:46 -0000 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Hello Ray, On 02/01/18 11:15, Ruiyu Ni wrote: > SmiHandlerUnRegister() validates the DispatchHandle by checking > whether the first 32bit matches to a certain signature > (SMI_HANDLER_SIGNATURE). > But if a caller calls *UnRegister() twice and the memory freed by > first call still contains the signature, the second hang may hang. > > The patch fixes this issue by locating the DispatchHandle > in all SMI handlers, instead of checking the signature. > > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Ruiyu Ni > Cc: Jiewen Yao > Cc: Star Zeng > --- > MdeModulePkg/Core/PiSmmCore/Smi.c | 37 ++++++++++++++++++++++++++++++++----- > 1 file changed, 32 insertions(+), 5 deletions(-) I'm mildly curious: can we just zero out the signature when the de-registration / freeing happens? Otherwise, the nested loop added below will penalize (performance-wise) correctly written client code as well. > diff --git a/MdeModulePkg/Core/PiSmmCore/Smi.c > b/MdeModulePkg/Core/PiSmmCore/Smi.c > index ad483a1877ce..6596ea9560d1 100644 > --- a/MdeModulePkg/Core/PiSmmCore/Smi.c > +++ b/MdeModulePkg/Core/PiSmmCore/Smi.c > @@ -290,6 +290,7 @@ SmiHandlerUnRegister ( > SmiEntry = SmiHandler->SmiEntry; > > RemoveEntryList (&SmiHandler->Link); > + SmiHandler->Signature = 0; > FreePool (SmiHandler); > > if (SmiEntry == NULL) { Generally, if client code violates an interface contract, then the called function is not responsible for catching the error and preventing undefined behavior. For "quality of service", we can go to certain lengths nonetheless, but it should hopefully not hurt valid client code. For example, I seem to remember that the list data structure implementation checks the internal consistency (which can be costly) only if a PCD is set to a certain value. Is that right? Is it an option here? (If the above zeroing is not good for some reason.) Anyway, I'm asking mainly for my own education. Thanks! Laszlo > diff --git a/MdeModulePkg/Core/PiSmmCore/Smi.c b/MdeModulePkg/Core/PiSmmCore/Smi.c > index ad483a1877..0c09e7fa10 100644 > --- a/MdeModulePkg/Core/PiSmmCore/Smi.c > +++ b/MdeModulePkg/Core/PiSmmCore/Smi.c > @@ -1,7 +1,7 @@ > /** @file > SMI management. > > - Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.
> + Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.
> This program and the accompanying materials are licensed and made available > under the terms and conditions of the BSD License which accompanies this > distribution. The full text of the license may be found at > @@ -276,14 +276,41 @@ SmiHandlerUnRegister ( > { > SMI_HANDLER *SmiHandler; > SMI_ENTRY *SmiEntry; > + LIST_ENTRY *EntryLink; > + LIST_ENTRY *HandlerLink; > > - SmiHandler = (SMI_HANDLER *) DispatchHandle; > - > - if (SmiHandler == NULL) { > + if (DispatchHandle == NULL) { > return EFI_INVALID_PARAMETER; > } > > - if (SmiHandler->Signature != SMI_HANDLER_SIGNATURE) { > + // > + // Look for it in root SMI handlers > + // > + SmiHandler = NULL; > + for ( HandlerLink = GetFirstNode (&mRootSmiEntry.SmiHandlers) > + ; !IsNull (&mRootSmiEntry.SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle) > + ; HandlerLink = GetNextNode (&mRootSmiEntry.SmiHandlers, HandlerLink) > + ) { > + SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); > + } > + > + // > + // Look for it in non-root SMI handlers > + // > + for ( EntryLink = GetFirstNode (&mSmiEntryList) > + ; !IsNull (&mSmiEntryList, EntryLink) && (SmiHandler != DispatchHandle) > + ; EntryLink = GetNextNode (&mSmiEntryList, EntryLink) > + ) { > + SmiEntry = CR (EntryLink, SMI_ENTRY, AllEntries, SMI_ENTRY_SIGNATURE); > + for ( HandlerLink = GetFirstNode (&SmiEntry->SmiHandlers) > + ; !IsNull (&SmiEntry->SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle) > + ; HandlerLink = GetNextNode (&SmiEntry->SmiHandlers, HandlerLink) > + ) { > + SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); > + } > + } > + > + if (SmiHandler != DispatchHandle) { > return EFI_INVALID_PARAMETER; > } > >