From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 9196278003C for ; Mon, 30 Oct 2023 07:49:29 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=1H/4a24rSc7Y+WJcHeYtNaBmhgg+PnbmYnBzz2+ccak=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1698652168; v=1; b=eBfOwLDif5gp215YPOAaPGsghgOhvs4so7N8RTZOJy2hlgRUtXv863VwNxb1QT+tVNoumZqN 4sa/zjvUVI3BWv/WNGNJiFZwkO2dE76BKQsWIXXA6bTtrcDiO+Efi5cKiEweNaZknYtnBs09bnf 4wenjwv2c1p4YvGShFXHAxsM= X-Received: by 127.0.0.2 with SMTP id 6EE6YY7687511xSnModRJI2o; Mon, 30 Oct 2023 00:49:28 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.143793.1698652164261209974 for ; Mon, 30 Oct 2023 00:49:27 -0700 X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="419138572" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="419138572" X-Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Oct 2023 00:49:27 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10878"; a="736666722" X-IronPort-AV: E=Sophos;i="6.03,263,1694761200"; d="scan'208";a="736666722" X-Received: from shpfwdbuild003.ccr.corp.intel.com ([10.239.56.82]) by orsmga006.jf.intel.com with ESMTP; 30 Oct 2023 00:49:25 -0700 From: "Xu, Wei6" To: devel@edk2.groups.io Cc: Wei6 Xu , Laszlo Ersek , Ard Biesheuvel , Sami Mujawar , Ray Ni Subject: [edk2-devel] [PATCH v3 1/4] StandaloneMmPkg/Core: Limit FwVol encapsulation section recursion Date: Mon, 30 Oct 2023 15:49:15 +0800 Message-Id: <44a87be85d8b0f475fb30ff9a9a9bf4e2d8f9e26.1698651605.git.wei6.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,wei6.xu@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: x6DoVKYWLCdbXBkXj9M04Clbx7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=eBfOwLDi; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io MmCoreFfsFindMmDriver() is called recursively for encapsulation sections. Currently this recursion is not limited. Introduce a new PCD (fixed-at-build, or patchable-in-module), and make MmCoreFfsFindMmDriver() track the section nesting depth against that PCD. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Signed-off-by: Wei6 Xu --- StandaloneMmPkg/Core/FwVol.c | 16 ++++++++++++++-- StandaloneMmPkg/Core/StandaloneMmCore.c | 5 +++-- StandaloneMmPkg/Core/StandaloneMmCore.inf | 3 +++ StandaloneMmPkg/StandaloneMmPkg.dec | 5 +++++ 4 files changed, 25 insertions(+), 4 deletions(-) diff --git a/StandaloneMmPkg/Core/FwVol.c b/StandaloneMmPkg/Core/FwVol.c index 1f6d7714ba97..e1e20ffd14ac 100644 --- a/StandaloneMmPkg/Core/FwVol.c +++ b/StandaloneMmPkg/Core/FwVol.c @@ -48,6 +48,9 @@ FvIsBeingProcessed ( MM driver and return its PE32 image.=0D =0D @param [in] FwVolHeader Pointer to memory mapped FV=0D + @param [in] Depth Nesting depth of encapsulation sections. Calle= rs=0D + different from MmCoreFfsFindMmDriver() are=0D + responsible for passing in a zero Depth.=0D =0D @retval EFI_SUCCESS Success.=0D @retval EFI_INVALID_PARAMETER Invalid parameter.=0D @@ -55,11 +58,15 @@ FvIsBeingProcessed ( @retval EFI_OUT_OF_RESOURCES Out of resources.=0D @retval EFI_VOLUME_CORRUPTED Firmware volume is corrupted.=0D @retval EFI_UNSUPPORTED Operation not supported.=0D + @retval EFI_ABORTED Recursion aborted because Depth has been= =0D + greater than or equal to=0D + PcdFwVolMmMaxEncapsulationDepth.=0D =0D **/=0D EFI_STATUS=0D MmCoreFfsFindMmDriver (=0D - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader=0D + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader,=0D + IN UINT32 Depth=0D )=0D {=0D EFI_STATUS Status;=0D @@ -84,6 +91,11 @@ MmCoreFfsFindMmDriver ( =0D DEBUG ((DEBUG_INFO, "MmCoreFfsFindMmDriver - 0x%x\n", FwVolHeader));=0D =0D + if (Depth >=3D PcdGet32 (PcdFwVolMmMaxEncapsulationDepth)) {=0D + DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", _= _func__));=0D + return EFI_ABORTED;=0D + }=0D +=0D if (FvHasBeenProcessed (FwVolHeader)) {=0D return EFI_SUCCESS;=0D }=0D @@ -172,7 +184,7 @@ MmCoreFfsFindMmDriver ( }=0D =0D InnerFvHeader =3D (VOID *)(Section + 1);=0D - Status =3D MmCoreFfsFindMmDriver (InnerFvHeader);=0D + Status =3D MmCoreFfsFindMmDriver (InnerFvHeader, Depth + 1);=0D if (EFI_ERROR (Status)) {=0D goto FreeDstBuffer;=0D }=0D diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.c b/StandaloneMmPkg/Core= /StandaloneMmCore.c index d221f1d1115d..523ea0a632a1 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.c +++ b/StandaloneMmPkg/Core/StandaloneMmCore.c @@ -11,7 +11,8 @@ =0D EFI_STATUS=0D MmCoreFfsFindMmDriver (=0D - IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader=0D + IN EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader,=0D + IN UINT32 Depth=0D );=0D =0D EFI_STATUS=0D @@ -643,7 +644,7 @@ StandaloneMmMain ( //=0D DEBUG ((DEBUG_INFO, "Mm Dispatch StandaloneBfvAddress - 0x%08x\n", gMmCo= rePrivate->StandaloneBfvAddress));=0D if (gMmCorePrivate->StandaloneBfvAddress !=3D 0) {=0D - MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress);=0D + MmCoreFfsFindMmDriver ((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)gMmCorePri= vate->StandaloneBfvAddress, 0);=0D MmDispatcher ();=0D }=0D =0D diff --git a/StandaloneMmPkg/Core/StandaloneMmCore.inf b/StandaloneMmPkg/Co= re/StandaloneMmCore.inf index c44b9ff33303..02ecd68f37e2 100644 --- a/StandaloneMmPkg/Core/StandaloneMmCore.inf +++ b/StandaloneMmPkg/Core/StandaloneMmCore.inf @@ -76,6 +76,9 @@ [Guids] gEfiEventExitBootServicesGuid=0D gEfiEventReadyToBootGuid=0D =0D +[Pcd]=0D + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth ##CONS= UMES=0D +=0D #=0D # This configuration fails for CLANGPDB, which does not support PIE in the= GCC=0D # sense. Such however is required for ARM family StandaloneMmCore=0D diff --git a/StandaloneMmPkg/StandaloneMmPkg.dec b/StandaloneMmPkg/Standalo= neMmPkg.dec index 46784d94e421..c43632d6d8ae 100644 --- a/StandaloneMmPkg/StandaloneMmPkg.dec +++ b/StandaloneMmPkg/StandaloneMmPkg.dec @@ -48,3 +48,8 @@ [Guids] gEfiStandaloneMmNonSecureBufferGuid =3D { 0xf00497e3, 0xbfa2, 0x41a= 1, { 0x9d, 0x29, 0x54, 0xc2, 0xe9, 0x37, 0x21, 0xc5 }}=0D gEfiArmTfCpuDriverEpDescriptorGuid =3D { 0x6ecbd5a1, 0xc0f8, 0x470= 2, { 0x83, 0x01, 0x4f, 0xc2, 0xc5, 0x47, 0x0a, 0x51 }}=0D =0D +[PcdsFixedAtBuild, PcdsPatchableInModule]=0D + ## Maximum permitted encapsulation levels of sections in a firmware volu= me,=0D + # in the MM phase. Minimum value is 1. Sections nested more deeply are = rejected.=0D + # @Prompt Maximum permitted FwVol section nesting depth (exclusive) in M= M.=0D + gStandaloneMmPkgTokenSpaceGuid.PcdFwVolMmMaxEncapsulationDepth|0x10|UINT= 32|0x00000001=0D --=20 2.29.2.windows.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110297): https://edk2.groups.io/g/devel/message/110297 Mute This Topic: https://groups.io/mt/102270546/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-