From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 134.134.136.126, mailfrom: zhichao.gao@intel.com) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by groups.io with SMTP; Tue, 25 Jun 2019 08:15:46 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Jun 2019 08:15:45 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,416,1557212400"; d="scan'208";a="182908362" Received: from fieedk001.ccr.corp.intel.com ([10.239.33.119]) by fmsmga001.fm.intel.com with ESMTP; 25 Jun 2019 08:15:44 -0700 From: "Gao, Zhichao" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Liming Gao Subject: [PATCH V2] UefiCpuPkg/MpInitLib: MicrocodeDetect: Ensure checked range is valid Date: Tue, 25 Jun 2019 23:15:41 +0800 Message-Id: <20190625151541.28632-1-zhichao.gao@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1934 V1: Originally, the checksum part would done before verfiy the microcode data. Which meas the checksum would be done for a meaningless data. It would cause a incorrect TotalSize (the size of microcode data), then incorrect checksum and incorrect pointer increasing would happen. To fix this, move the checksum part 1 section in 'if (MicrocodeEntryPoint->HeaderVersion == 0x1)' section for a valid microcode data. V2: 'if (MicrocodeEntryPoint->HeaderVersion == 0x1)' condition doesn't make sure the entry data is a valid microcode. So abandon it. Instead, make sure the checked data is in the microcode data range. Because the DataSize of non microcde data may make (MicrocodeEntryPoint + TotalSize) larger than 0xffffffff. For PEI driver, UINTN is 32bit and the result is overflow and it may be a very small value. That means the checksum check would be done out of the microcode range. Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Liming Gao Signed-off-by: Zhichao Gao --- UefiCpuPkg/Library/MpInitLib/Microcode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/UefiCpuPkg/Library/MpInitLib/Microcode.c b/UefiCpuPkg/Library/MpInitLib/Microcode.c index 4763dcfebe..6c0995cb0d 100644 --- a/UefiCpuPkg/Library/MpInitLib/Microcode.c +++ b/UefiCpuPkg/Library/MpInitLib/Microcode.c @@ -1,7 +1,7 @@ /** @file Implementation of loading microcode on processors. - Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.
+ Copyright (c) 2015 - 2019, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent **/ @@ -170,6 +170,7 @@ MicrocodeDetect ( /// Check overflow and whether TotalSize is aligned with 4 bytes. /// if ( ((UINTN)MicrocodeEntryPoint + TotalSize) > MicrocodeEnd || + ((UINTN)MicrocodeEntryPoint + TotalSize) < (UINTN) CpuMpData->MicrocodePatchAddress || (TotalSize & 0x3) != 0 ) { MicrocodeEntryPoint = (CPU_MICROCODE_HEADER *) (((UINTN) MicrocodeEntryPoint) + SIZE_1KB); -- 2.21.0.windows.1