From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail04.groups.io (mail04.groups.io [45.79.224.9]) by spool.mail.gandi.net (Postfix) with ESMTPS id 4112CAC0A43 for ; Tue, 16 Apr 2024 02:41:35 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=8cCm8yExjM7LOYzMs2qRa+vxICVg/NhlJ/ybbNKjDRk=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240206; t=1713235293; v=1; b=QyNTomKr5HzztLMHHJHjjnM/mIcVry5Q6MPGm+I+PQl4bhIV34Bs0rgixedfWvbbYeKvFfmH 981OXwh42Q697/GGTPQhuXOu+9GYydRm8i5agXJGmQ3Xwcy3VNps682AfyFT0vFm3RUErclBXhx ikoIgdwUSQA2/HQc5Kbk4r57lJ5QEU7dov62MQoEy6QgmrjWjFVskyYisOESwoR5SfbFN95KQxe Hs2ifjOOvTNyFzpKBVyuDFg8jmFDRXCQfaHw36C6xeVne57B6tfmGk1V2AvF+LowcCe6CdPlqW4 f+PpV8sRf2Lapmqnu6N9Fp4PgSwRguaJhynZaQ4+YCQaw== X-Received: by 127.0.0.2 with SMTP id u2vzYY7687511x1SL8dOSCOS; Mon, 15 Apr 2024 19:41:33 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) by mx.groups.io with SMTP id smtpd.web10.11001.1713235276662353128 for ; Mon, 15 Apr 2024 19:41:28 -0700 X-CSE-ConnectionGUID: sCIFPawdQK6LoHnaZ7W6XA== X-CSE-MsgGUID: Ra1jize0RAKGw+1y6byG2Q== X-IronPort-AV: E=McAfee;i="6600,9927,11045"; a="9205588" X-IronPort-AV: E=Sophos;i="6.07,204,1708416000"; d="scan'208";a="9205588" X-Received: from orviesa001.jf.intel.com ([10.64.159.141]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2024 19:41:28 -0700 X-CSE-ConnectionGUID: aGzKZnKfRGWRfHGiKrhSBw== X-CSE-MsgGUID: R9W9guNYQ5+Rnr8ZPegLjg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.07,204,1708416000"; d="scan'208";a="59553325" X-Received: from shwdesfp01.ccr.corp.intel.com ([10.239.158.151]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Apr 2024 19:41:26 -0700 From: "Zhiguang Liu" To: devel@edk2.groups.io Cc: Zhiguang Liu , Liming Gao , Jiaxin Wu , Ray Ni , Laszlo Ersek Subject: [edk2-devel] [PATCH v4 5/6] MdeModulePkg/SMM: Support to unregister SMI handler in SMI handlers Date: Tue, 16 Apr 2024 10:41:07 +0800 Message-Id: <20240416024108.1358-6-zhiguang.liu@intel.com> In-Reply-To: <20240416024108.1358-1-zhiguang.liu@intel.com> References: <20240416024108.1358-1-zhiguang.liu@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Mon, 15 Apr 2024 19:41:28 -0700 Resent-From: zhiguang.liu@intel.com Reply-To: devel@edk2.groups.io,zhiguang.liu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: aHX1pKe1XHJwq6btrUxsxLiQx7686176AA= Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=QyNTomKr; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.9 as permitted sender) smtp.mailfrom=bounce@groups.io This patch fix a use-after-free issue where unregistering an SMI handler could lead to the deletion of the SMI_HANDLER while it is still in use by SmiManage(). The fix involves modifying SmiHandlerUnRegister() to detect whether it is being called from within the SmiManage() stack. If so, the removal of the SMI_HANDLER is deferred until SmiManage() has finished executing. Additionally, due to the possibility of recursive SmiManage() calls, the unregistration and subsequent removal of the SMI_HANDLER are ensured to occur only after the outermost SmiManage() invocation has completed. Cc: Liming Gao Cc: Jiaxin Wu Cc: Ray Ni Cc: Laszlo Ersek Signed-off-by: Zhiguang Liu --- MdeModulePkg/Core/PiSmmCore/PiSmmCore.h | 1 + MdeModulePkg/Core/PiSmmCore/Smi.c | 164 ++++++++++++++++++++---- 2 files changed, 139 insertions(+), 26 deletions(-) diff --git a/MdeModulePkg/Core/PiSmmCore/PiSmmCore.h b/MdeModulePkg/Core/PiSmmCore/PiSmmCore.h index b8a490a8c3..60073c78b4 100644 --- a/MdeModulePkg/Core/PiSmmCore/PiSmmCore.h +++ b/MdeModulePkg/Core/PiSmmCore/PiSmmCore.h @@ -93,6 +93,7 @@ typedef struct { SMI_ENTRY *SmiEntry; VOID *Context; // for profile UINTN ContextSize; // for profile + BOOLEAN ToRemove; // To remove this SMI_HANDLER later } SMI_HANDLER; // diff --git a/MdeModulePkg/Core/PiSmmCore/Smi.c b/MdeModulePkg/Core/PiSmmCore/Smi.c index 2985f989c3..a84a1f48d3 100644 --- a/MdeModulePkg/Core/PiSmmCore/Smi.c +++ b/MdeModulePkg/Core/PiSmmCore/Smi.c @@ -8,6 +8,11 @@ #include "PiSmmCore.h" +// +// mSmiManageCallingDepth is used to track the depth of recursive calls of SmiManage. +// +UINTN mSmiManageCallingDepth = 0; + LIST_ENTRY mSmiEntryList = INITIALIZE_LIST_HEAD_VARIABLE (mSmiEntryList); SMI_ENTRY mRootSmiEntry = { @@ -79,6 +84,40 @@ SmmCoreFindSmiEntry ( return SmiEntry; } +/** + Remove SmiHandler and free the memory it used. + If SmiEntry is empty, remove SmiEntry and free the memory it used. + + @param SmiHandler Points to SMI handler. + @param SmiEntry Points to SMI Entry or NULL for root SMI handlers. + + @retval TRUE SmiEntry is removed. + @retval FALSE SmiEntry is not removed. +**/ +BOOLEAN +RemoveSmiHandler ( + IN SMI_HANDLER *SmiHandler, + IN SMI_ENTRY *SmiEntry + ) +{ + ASSERT (SmiHandler->ToRemove); + RemoveEntryList (&SmiHandler->Link); + FreePool (SmiHandler); + + // + // Remove the SMI_ENTRY if all handlers have been removed. + // + if (SmiEntry != NULL) { + if (IsListEmpty (&SmiEntry->SmiHandlers)) { + RemoveEntryList (&SmiEntry->AllEntries); + FreePool (SmiEntry); + return TRUE; + } + } + + return FALSE; +} + /** Manage SMI of a particular type. @@ -104,15 +143,17 @@ SmiManage ( { LIST_ENTRY *Link; LIST_ENTRY *Head; + LIST_ENTRY *EntryLink; SMI_ENTRY *SmiEntry; SMI_HANDLER *SmiHandler; - BOOLEAN SuccessReturn; + EFI_STATUS ReturnStatus; + BOOLEAN WillReturn; EFI_STATUS Status; PERF_FUNCTION_BEGIN (); - - Status = EFI_NOT_FOUND; - SuccessReturn = FALSE; + mSmiManageCallingDepth++; + Status = EFI_NOT_FOUND; + ReturnStatus = Status; if (HandlerType == NULL) { // // Root SMI handler @@ -152,7 +193,16 @@ SmiManage ( // if (HandlerType != NULL) { PERF_FUNCTION_END (); - return EFI_INTERRUPT_PENDING; + ReturnStatus = EFI_INTERRUPT_PENDING; + WillReturn = TRUE; + } else { + // + // If any other handler's result sets ReturnStatus as EFI_SUCCESS, the return status + // will be EFI_SUCCESS. + // + if (ReturnStatus != EFI_SUCCESS) { + ReturnStatus = Status; + } } break; @@ -165,10 +215,10 @@ SmiManage ( // if (HandlerType != NULL) { PERF_FUNCTION_END (); - return EFI_SUCCESS; + WillReturn = TRUE; } - SuccessReturn = TRUE; + ReturnStatus = EFI_SUCCESS; break; case EFI_WARN_INTERRUPT_SOURCE_QUIESCED: @@ -176,7 +226,7 @@ SmiManage ( // If at least one of the handlers returns EFI_WARN_INTERRUPT_SOURCE_QUIESCED // then the function will return EFI_SUCCESS. // - SuccessReturn = TRUE; + ReturnStatus = EFI_SUCCESS; break; case EFI_WARN_INTERRUPT_SOURCE_PENDING: @@ -184,6 +234,10 @@ SmiManage ( // If all the handlers returned EFI_WARN_INTERRUPT_SOURCE_PENDING // then EFI_WARN_INTERRUPT_SOURCE_PENDING will be returned. // + if (ReturnStatus != EFI_SUCCESS) { + ReturnStatus = Status; + } + break; default: @@ -193,14 +247,74 @@ SmiManage ( ASSERT (FALSE); break; } + + if (WillReturn) { + break; + } } - if (SuccessReturn) { - Status = EFI_SUCCESS; + ASSERT (mSmiManageCallingDepth > 0); + mSmiManageCallingDepth--; + + // + // SmiHandlerUnRegister() calls from SMI handlers are deferred till this point. + // Before returned from SmiManage, delete the SmiHandler which is + // marked as ToRemove. + // Note that SmiManage can be called recursively. + // + if (mSmiManageCallingDepth == 0) { + // + // Go through all SmiHandler in root SMI handlers + // + for ( Link = GetFirstNode (&mRootSmiEntry.SmiHandlers) + ; !IsNull (&mRootSmiEntry.SmiHandlers, Link); + ) + { + // + // SmiHandler might be removed in below, so cache the next link in Link + // + SmiHandler = CR (Link, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); + Link = GetNextNode (&mRootSmiEntry.SmiHandlers, Link); + if (SmiHandler->ToRemove) { + // + // Remove SmiHandler if the ToRemove is set. + // + RemoveSmiHandler (SmiHandler, NULL); + } + } + + // + // Go through all SmiHandler in non-root SMI handlers + // + for ( EntryLink = GetFirstNode (&mSmiEntryList) + ; !IsNull (&mSmiEntryList, EntryLink); + ) + { + // + // SmiEntry might be removed in below, so cache the next link in EntryLink + // + SmiEntry = CR (EntryLink, SMI_ENTRY, AllEntries, SMI_ENTRY_SIGNATURE); + EntryLink = GetNextNode (&mSmiEntryList, EntryLink); + for ( Link = GetFirstNode (&SmiEntry->SmiHandlers) + ; !IsNull (&SmiEntry->SmiHandlers, Link); + ) + { + // + // SmiHandler might be removed in below, so cache the next link in Link + // + SmiHandler = CR (Link, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE); + Link = GetNextNode (&SmiEntry->SmiHandlers, Link); + if (SmiHandler->ToRemove) { + if (RemoveSmiHandler (SmiHandler, SmiEntry)) { + break; + } + } + } + } } PERF_FUNCTION_END (); - return Status; + return ReturnStatus; } /** @@ -238,6 +352,7 @@ SmiHandlerRegister ( SmiHandler->Signature = SMI_HANDLER_SIGNATURE; SmiHandler->Handler = Handler; SmiHandler->CallerAddr = (UINTN)RETURN_ADDRESS (0); + SmiHandler->ToRemove = FALSE; if (HandlerType == NULL) { // @@ -318,30 +433,27 @@ SmiHandlerUnRegister ( } } - if ((EFI_HANDLE)SmiHandler != DispatchHandle) { + if (SmiHandler == NULL) { return EFI_INVALID_PARAMETER; } - SmiEntry = SmiHandler->SmiEntry; - - RemoveEntryList (&SmiHandler->Link); - FreePool (SmiHandler); + ASSERT ((EFI_HANDLE)SmiHandler == DispatchHandle); + SmiHandler->ToRemove = TRUE; - if (SmiEntry == NULL) { + if (mSmiManageCallingDepth > 0) { // - // This is root SMI handler + // This function is called from SmiManage() + // Do not delete or remove SmiHandler or SmiEntry now. + // SmiManage will handle it later // return EFI_SUCCESS; } - if (IsListEmpty (&SmiEntry->SmiHandlers)) { - // - // No handler registered for this interrupt now, remove the SMI_ENTRY - // - RemoveEntryList (&SmiEntry->AllEntries); - - FreePool (SmiEntry); - } + SmiEntry = SmiHandler->SmiEntry; + // + // For root SMI handler, use NULL for SmiEntry + // + RemoveSmiHandler (SmiHandler, (SmiEntry == &mRootSmiEntry) ? NULL : SmiEntry); return EFI_SUCCESS; } -- 2.31.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#117822): https://edk2.groups.io/g/devel/message/117822 Mute This Topic: https://groups.io/mt/105550121/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-