From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web09.1020.1578957564847238207 for ; Mon, 13 Jan 2020 15:19:24 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: michael.a.kubacki@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Jan 2020 15:19:24 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,430,1571727600"; d="scan'208";a="213143130" Received: from makuback-desk1.amr.corp.intel.com ([10.7.159.162]) by orsmga007.jf.intel.com with ESMTP; 13 Jan 2020 15:19:23 -0800 From: "Kubacki, Michael A" To: devel@edk2.groups.io Cc: Liming Gao , Michael D Kinney , Michael Turner , Jian J Wang , Hao A Wu Subject: [PATCH V1 1/1] MdeModulePkg/Variable: Fix VarErrorFlag RT cache offset calculation Date: Mon, 13 Jan 2020 15:19:08 -0800 Message-Id: <20200113231908.29724-1-michael.a.kubacki@intel.com> X-Mailer: git-send-email 2.16.2.windows.1 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2457 This commit fixes an offset calculation that is used to write the VarErrorFlag UEFI variable to the UEFI variable runtime cache. Currently a physical address is used instead of an offset. This commit changes the offset to zero with a length of the entire non-volatile variable store so the entire non-volatile variable store buffer in SMRAM (with the variable update modification) is copied to the runtime variable cache. This follows the same pattern used in other SynchronizeRuntimeVariableCache () calls for consistency. * Observable symptom: An exception in SMM will most likely occur due to the invalid memory reference when the VarErrorFlag variable is written. The variable is most commonly written when the UEFI variable store is full. * The issue only occurs when the variable runtime cache is enabled by the following PCD being set to TRUE: gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache Fixes: aab3b9b9a1e5e1f3fa966fb1667fc3e6c47e7706 Cc: Liming Gao Cc: Michael D Kinney Cc: Michael Turner Cc: Jian J Wang Cc: Hao A Wu Signed-off-by: Michael Kubacki --- MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c index b0ee5e50d0..d23aea4bc7 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c @@ -16,7 +16,7 @@ VariableServiceSetVariable() should also check authenticate data to avoid buffer overflow, integer overflow. It should also check attribute to avoid authentication bypass. -Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
+Copyright (c) 2006 - 2020, Intel Corporation. All rights reserved.
(C) Copyright 2015-2018 Hewlett Packard Enterprise Development LP
SPDX-License-Identifier: BSD-2-Clause-Patent @@ -335,8 +335,8 @@ RecordVarErrorFlag ( *VarErrFlag = TempFlag; Status = SynchronizeRuntimeVariableCache ( &mVariableModuleGlobal->VariableGlobal.VariableRuntimeCacheContext.VariableRuntimeNvCache, - (UINTN) VarErrFlag - (UINTN) mNvVariableCache + (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase, - sizeof (TempFlag) + 0, + mNvVariableCache->Size ); ASSERT_EFI_ERROR (Status); } -- 2.16.2.windows.1