Re: [PATCH] EmbeddedPkg/NonCoherentDmaLib: avoid dereferencing bogus buffer address

["Leif Lindholm" <leif@nuviainc.com>]

On Wed, Jun 17, 2020 at 17:38:24 +0200, Ard Biesheuvel wrote:
> The bounce buffering code in NonCoherentDmaLib copies data into the
> bounce buffer using CopyMem(), but passes Map->HostAddress as the
> source of the copy before it has been assigned its correct value.

Whoops.

> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@arm.com>

Reviewed-by: Leif Lindholm <leif@nuviainc.com>

> ---
>  EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
> index 115345765435..9c8ef5bfb533 100644
> --- a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
> +++ b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c
> @@ -225,8 +225,7 @@ DmaMap (
>      }
>  
>      if (Map->Operation == MapOperationBusMasterRead) {
> -      CopyMem (Map->BufferAddress, (VOID *)(UINTN)Map->HostAddress,
> -        *NumberOfBytes);
> +      CopyMem (Map->BufferAddress, (VOID *)(UINTN)HostAddress, *NumberOfBytes);
>      }
>      mCpu->FlushDataCache (mCpu, (UINTN)Map->BufferAddress, AllocSize,
>              EfiCpuFlushTypeWriteBack);
> -- 
> 2.27.0
>