From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.151; helo=mga17.intel.com; envelope-from=ruiyu.ni@intel.com; receiver=edk2-devel@lists.01.org Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 4F5DD21A02937 for ; Mon, 24 Sep 2018 23:22:20 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Sep 2018 23:22:19 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,301,1534834800"; d="scan'208";a="91651461" Received: from ray-dev.ccr.corp.intel.com ([10.239.9.8]) by fmsmga004.fm.intel.com with ESMTP; 24 Sep 2018 23:20:22 -0700 From: Ruiyu Ni To: edk2-devel@lists.01.org Cc: Star Zeng Date: Tue, 25 Sep 2018 14:21:14 +0800 Message-Id: <20180925062117.34772-2-ruiyu.ni@intel.com> X-Mailer: git-send-email 2.16.1.windows.1 In-Reply-To: <20180925062117.34772-1-ruiyu.ni@intel.com> References: <20180925062117.34772-1-ruiyu.ni@intel.com> Subject: [PATCH v2 1/4] MdeModulePkg/PciHostBridge: Enhance boundary check in Io/Mem.Read/Write X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Sep 2018 06:22:20 -0000 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Cc: Star Zeng Reviewed-by: Laszlo Ersek Reviewed-by: Garrett Kirkendall --- .../Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c | 28 ++++++++++++++++++---- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c b/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c index f8a1239ceb..2c373e41de 100644 --- a/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c +++ b/MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciRootBridgeIo.c @@ -301,6 +301,8 @@ CreateRootBridge ( @retval EFI_INVALID_PARAMETER Buffer is NULL. + @retval EFI_INVALID_PARAMETER Address or Count is invalid. + @retval EFI_UNSUPPORTED The Buffer is not aligned for the given Width. @retval EFI_UNSUPPORTED The address range specified by Address, Width, @@ -321,6 +323,7 @@ RootBridgeIoCheckParameter ( UINT64 Base; UINT64 Limit; UINT32 Size; + UINT64 Length; // // Check to see if Buffer is NULL @@ -337,7 +340,7 @@ RootBridgeIoCheckParameter ( } // - // For FIFO type, the target address won't increase during the access, + // For FIFO type, the device address won't increase during the access, // so treat Count as 1 // if (Width >= EfiPciWidthFifoUint8 && Width <= EfiPciWidthFifoUint64) { @@ -347,6 +350,13 @@ RootBridgeIoCheckParameter ( Width = (EFI_PCI_ROOT_BRIDGE_IO_PROTOCOL_WIDTH) (Width & 0x03); Size = 1 << Width; + // + // Make sure (Count * Size) doesn't exceed MAX_UINT64 + // + if (Count > DivU64x32 (MAX_UINT64, Size)) { + return EFI_INVALID_PARAMETER; + } + // // Check to see if Address is aligned // @@ -354,6 +364,14 @@ RootBridgeIoCheckParameter ( return EFI_UNSUPPORTED; } + // + // Make sure (Address + Count * Size) doesn't exceed MAX_UINT64 + // + Length = MultU64x32 (Count, Size); + if (Address > MAX_UINT64 - Length) { + return EFI_INVALID_PARAMETER; + } + RootBridge = ROOT_BRIDGE_FROM_THIS (This); // @@ -372,7 +390,7 @@ RootBridgeIoCheckParameter ( // // Allow Legacy IO access // - if (Address + MultU64x32 (Count, Size) <= 0x1000) { + if (Address + Length <= 0x1000) { if ((RootBridge->Attributes & ( EFI_PCI_ATTRIBUTE_ISA_IO | EFI_PCI_ATTRIBUTE_VGA_PALETTE_IO | EFI_PCI_ATTRIBUTE_VGA_IO | EFI_PCI_ATTRIBUTE_IDE_PRIMARY_IO | EFI_PCI_ATTRIBUTE_IDE_SECONDARY_IO | @@ -386,7 +404,7 @@ RootBridgeIoCheckParameter ( // // Allow Legacy MMIO access // - if ((Address >= 0xA0000) && (Address + MultU64x32 (Count, Size)) <= 0xC0000) { + if ((Address >= 0xA0000) && (Address + Length) <= 0xC0000) { if ((RootBridge->Attributes & EFI_PCI_ATTRIBUTE_VGA_MEMORY) != 0) { return EFI_SUCCESS; } @@ -395,7 +413,7 @@ RootBridgeIoCheckParameter ( // By comparing the Address against Limit we know which range to be used // for checking // - if (Address + MultU64x32 (Count, Size) <= RootBridge->Mem.Limit + 1) { + if (Address + Length <= RootBridge->Mem.Limit + 1) { Base = RootBridge->Mem.Base; Limit = RootBridge->Mem.Limit; } else { @@ -427,7 +445,7 @@ RootBridgeIoCheckParameter ( return EFI_INVALID_PARAMETER; } - if (Address + MultU64x32 (Count, Size) > Limit + 1) { + if (Address + Length > Limit + 1) { return EFI_INVALID_PARAMETER; } -- 2.16.1.windows.1