public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [PATCH] EmbeddedPkg/NonCoherentDmaLib: avoid dereferencing bogus buffer address
@ 2020-06-17 15:38 Ard Biesheuvel
  2020-06-17 16:14 ` Leif Lindholm
  2020-06-17 16:19 ` [edk2-devel] " Andrei Warkentin
  0 siblings, 2 replies; 4+ messages in thread
From: Ard Biesheuvel @ 2020-06-17 15:38 UTC (permalink / raw)
  To: devel
  Cc: leif, pete, awarkentin, jeremy.linton, Samer.El-Haj-Mahmoud,
	Ard Biesheuvel

The bounce buffering code in NonCoherentDmaLib copies data into the
bounce buffer using CopyMem(), but passes Map->HostAddress as the
source of the copy before it has been assigned its correct value.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@arm.com>
---
 EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
index 115345765435..9c8ef5bfb533 100644
--- a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
+++ b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
@@ -225,8 +225,7 @@ DmaMap (
     }
 
     if (Map->Operation == MapOperationBusMasterRead) {
-      CopyMem (Map->BufferAddress, (VOID *)(UINTN)Map->HostAddress,
-        *NumberOfBytes);
+      CopyMem (Map->BufferAddress, (VOID *)(UINTN)HostAddress, *NumberOfBytes);
     }
     mCpu->FlushDataCache (mCpu, (UINTN)Map->BufferAddress, AllocSize,
             EfiCpuFlushTypeWriteBack);
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-06-17 18:31 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-06-17 15:38 [PATCH] EmbeddedPkg/NonCoherentDmaLib: avoid dereferencing bogus buffer address Ard Biesheuvel
2020-06-17 16:14 ` Leif Lindholm
2020-06-17 18:31   ` Ard Biesheuvel
2020-06-17 16:19 ` [edk2-devel] " Andrei Warkentin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox