From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 2170B941808 for ; Fri, 12 Jan 2024 11:38:02 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=TLbjEnBSV88WWP1nxCPesiV0s6aky/HKRwum4eMK4Sg=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding:Content-Type; s=20140610; t=1705059481; v=1; b=sLM79ojPJnPoJDEF0acVD3SwNcKRu8KgBaXRskk0tIM5DpngBe0IaTwlzwrNmMRoibxaMyON /biPdQ1srz+bn7obBFLIvzybqM02rVxbDwyekWe+wnQKbE5PJjBT+FGG1pN3SqW3hZsABvFsrZk ZJyDPHAxFxLC+h6h2RFxe+80= X-Received: by 127.0.0.2 with SMTP id 9HyHYY7687511xEXr16oLm2a; Fri, 12 Jan 2024 03:38:01 -0800 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web11.5199.1705059480029729323 for ; Fri, 12 Jan 2024 03:38:00 -0800 X-Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-5-bSU2PUXmOROv96-jlZaxWg-1; Fri, 12 Jan 2024 06:37:56 -0500 X-MC-Unique: bSU2PUXmOROv96-jlZaxWg-1 X-Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id EDB75106D060; Fri, 12 Jan 2024 11:37:55 +0000 (UTC) X-Received: from dobby.home.kraxel.org (unknown [10.39.194.144]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B6920C1D369; Fri, 12 Jan 2024 11:37:55 +0000 (UTC) X-Received: by dobby.home.kraxel.org (Postfix, from userid 1000) id 839ECABB7E; Fri, 12 Jan 2024 12:37:54 +0100 (CET) From: "Gerd Hoffmann" To: devel@edk2.groups.io Cc: Laszlo Ersek , Gerd Hoffmann , Ard Biesheuvel , Jiewen Yao , oliver@redhat.com Subject: [edk2-devel] [PATCH 1/4] OvmfPkg/VirtNorFlashDxe: fix shadowbuffer reads Date: Fri, 12 Jan 2024 12:37:51 +0100 Message-ID: <20240112113754.14710-2-kraxel@redhat.com> In-Reply-To: <20240112113754.14710-1-kraxel@redhat.com> References: <20240112113754.14710-1-kraxel@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.8 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,kraxel@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: V4JFuIwpQPMuw9yC3yobtQiQx7686176AA= Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII"; x-default=true X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=sLM79ojP; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io In some cases (specifically when the flash update region is small but crosses a multiple of P30_MAX_BUFFER_SIZE_IN_BYTES) NorFlashWriteSingleBlock reads only one instead of two P30_MAX_BUFFER_SIZE_IN_BYTES blocks into the shadow buffer. That leads to random crap being written to the second block, which in turn can corrupt both the variable store and the FTW work space. One observed corruption pattern is finding 0xaf (aka PcdDebugClearMemoryValue) right after the last entry in the FTW log. This should have been 0xff. This patch fixes the calculation. Signed-off-by: Gerd Hoffmann --- OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c index 1afd60ce66eb..cdc809d75e3d 100644 --- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c +++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c @@ -566,7 +566,7 @@ NorFlashWriteSingleBlock ( Instance, Lba, Offset & ~BOUNDARY_OF_32_WORDS, - (*NumBytes | BOUNDARY_OF_32_WORDS) + 1, + (((Offset & BOUNDARY_OF_32_WORDS) + *NumBytes) | BOUNDARY_OF_32_WORDS) + 1, Instance->ShadowBuffer ); if (EFI_ERROR (Status)) { -- 2.43.0 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113717): https://edk2.groups.io/g/devel/message/113717 Mute This Topic: https://groups.io/mt/103680932/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-