From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from hqnvemgate24.nvidia.com (hqnvemgate24.nvidia.com [216.228.121.143]) by mx.groups.io with SMTP id smtpd.web11.3947.1603491026560785482 for ; Fri, 23 Oct 2020 15:10:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nvidia.com header.s=n1 header.b=HgxDVW4D; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nvidia.com, ip: 216.228.121.143, mailfrom: jbrasen@nvidia.com) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate24.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Fri, 23 Oct 2020 15:10:35 -0700 Received: from HQMAIL111.nvidia.com (172.20.187.18) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 23 Oct 2020 22:10:22 +0000 Received: from jbrasen-ux.nvidia.com (10.124.1.5) by mail.nvidia.com (172.20.187.18) with Microsoft SMTP Server id 15.0.1473.3 via Frontend Transport; Fri, 23 Oct 2020 22:10:22 +0000 From: "Jeff Brasen" To: CC: , , Jeff Brasen Subject: [PATCH] MdeModulePkg/Gcd: Check memory allocation when initializing memory Date: Fri, 23 Oct 2020 16:10:07 -0600 Message-ID: <20201023221007.1097763-1-jbrasen@nvidia.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-NVConfidentiality: public Return-Path: jbrasen@nvidia.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1603491035; bh=FGU6HK0w0XGdaG0Q+aDkyDub8Si7DTu8JNzYO5/LHPE=; h=From:To:CC:Subject:Date:Message-ID:X-Mailer:MIME-Version: X-NVConfidentiality:Content-Transfer-Encoding:Content-Type; b=HgxDVW4DSMOGm4xdIPIz/SaLr8n6zoGycDq0/DlJfFnHOEbAPR5k9MRcUGOEx0Y8w Ic9fnAGGisM1tQz+ehIWXphDmrvQLiX5Jln3hEjMoJAxfIGzMCF7jXKfKCjrF9tCEp N0eLEcvUTyZHuH1qUhDJxr0vBGlzkvRJoY1gIZVCPzBaO/fQKoNF3x9LyaRR4t2iAS CoKJFQlFb4rcYKphwlxcl5bzU1693MdIGVd7wusE/QFpMKPs6D68XdJA70qOu1eiVx mcj0coXgXZ0WgL7z9dBakmwzmGsqS7dl03IhV02777nr0vJSueYkJ3paSrQbSVIEYq x9CzEtqhHkiYw== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain CoreInitializeMemoryServices was not checking for any existing memory allocation created in the HOB producer phase. If there are memory allocations outside of the region covered by the HOB List then Gcd could select that region for memory which can result in the memory allocation to not be handled and memory overwrites. Signed-off-by: Jeff Brasen --- MdeModulePkg/Core/Dxe/Gcd/Gcd.c | 60 +++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c b/MdeModulePkg/Core/Dxe/Gcd/Gc= d.c index 2d8c076f71..4a22ee96b7 100644 --- a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c +++ b/MdeModulePkg/Core/Dxe/Gcd/Gcd.c @@ -2097,6 +2097,62 @@ CalculateTotalMemoryBinSizeNeeded ( return TotalSize;=0D }=0D =0D +/**=0D + Find the largest region in the specified region that is not covered by = an existing memory allocation=0D +=0D + @param BaseAddress On input start of the region to check.=0D + On output start of the largest free region.=0D + @param Length On input size of region to check.=0D + On output size of the largest free region.=0D + @param MemoryHob Hob pointer for the first memory allocation pointe= r to check=0D +**/=0D +VOID=0D +FindLargestFreeRegion (=0D + IN OUT EFI_PHYSICAL_ADDRESS *BaseAddress,=0D + IN OUT UINT64 *Length,=0D + IN EFI_HOB_MEMORY_ALLOCATION *MemoryHob=0D + )=0D +{=0D + EFI_PHYSICAL_ADDRESS TopAddress;=0D +=0D + TopAddress =3D *BaseAddress + *Length;=0D + while (MemoryHob !=3D NULL) {=0D + EFI_PHYSICAL_ADDRESS AllocatedTop;=0D +=0D + AllocatedTop =3D MemoryHob->AllocDescriptor.MemoryBaseAddress + Memory= Hob->AllocDescriptor.MemoryLength;=0D +=0D + if ((MemoryHob->AllocDescriptor.MemoryBaseAddress >=3D *BaseAddress) &= &=0D + (AllocatedTop <=3D TopAddress)) {=0D + EFI_PHYSICAL_ADDRESS LowerBase;=0D + UINT64 LowerSize;=0D + EFI_PHYSICAL_ADDRESS UpperBase;=0D + UINT64 UpperSize;=0D +=0D + LowerBase =3D *BaseAddress;=0D + LowerSize =3D MemoryHob->AllocDescriptor.MemoryBaseAddress - *BaseAd= dress;=0D + UpperBase =3D AllocatedTop;=0D + UpperSize =3D TopAddress - AllocatedTop;=0D +=0D + if (LowerSize !=3D 0) {=0D + FindLargestFreeRegion (&LowerBase, &LowerSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob)));=0D + }=0D + if (UpperSize !=3D 0) {=0D + FindLargestFreeRegion (&UpperBase, &UpperSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob)));=0D + }=0D +=0D + if (UpperSize >=3D LowerSize) {=0D + *Length =3D UpperSize;=0D + *BaseAddress =3D UpperBase;=0D + } else {=0D + *Length =3D LowerSize;=0D + *BaseAddress =3D LowerBase;=0D + }=0D + return;=0D + }=0D + MemoryHob =3D GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB= (MemoryHob));=0D + }=0D +}=0D +=0D /**=0D External function. Initializes memory services based on the memory=0D descriptor HOBs. This function is responsible for priming the memory=0D @@ -2235,6 +2291,7 @@ CoreInitializeMemoryServices ( Attributes =3D PhitResourceHob->ResourceAttribute;=0D BaseAddress =3D PageAlignAddress (PhitHob->EfiMemoryTop);=0D Length =3D PageAlignLength (ResourceHob->PhysicalStart + Resourc= eHob->ResourceLength - BaseAddress);=0D + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLOCATI= ON *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION));=0D if (Length < MinimalMemorySizeNeeded) {=0D //=0D // If that range is not large enough to intialize the DXE Core, then= =0D @@ -2242,6 +2299,7 @@ CoreInitializeMemoryServices ( //=0D BaseAddress =3D PageAlignAddress (PhitHob->EfiFreeMemoryBottom);=0D Length =3D PageAlignLength (PhitHob->EfiFreeMemoryTop - BaseAd= dress);=0D + //This region is required to have no memory allocation inside it, sk= ip check for entries in HOB List=0D if (Length < MinimalMemorySizeNeeded) {=0D //=0D // If that range is not large enough to intialize the DXE Core, th= en=0D @@ -2249,6 +2307,7 @@ CoreInitializeMemoryServices ( //=0D BaseAddress =3D PageAlignAddress (ResourceHob->PhysicalStart);=0D Length =3D PageAlignLength ((UINT64)((UINTN)*HobStart - Base= Address));=0D + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLO= CATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION));=0D }=0D }=0D break;=0D @@ -2312,6 +2371,7 @@ CoreInitializeMemoryServices ( //=0D TestedMemoryBaseAddress =3D PageAlignAddress (ResourceHob->PhysicalS= tart);=0D TestedMemoryLength =3D PageAlignLength (ResourceHob->PhysicalS= tart + ResourceHob->ResourceLength - TestedMemoryBaseAddress);=0D + FindLargestFreeRegion (&TestedMemoryBaseAddress, &TestedMemoryLength= , (EFI_HOB_MEMORY_ALLOCATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)= );=0D if (TestedMemoryLength < MinimalMemorySizeNeeded) {=0D continue;=0D }=0D --=20 2.25.1