From: "Zeng, Star" <star.zeng@intel.com>
To: Ruiyu Ni <ruiyu.ni@intel.com>, edk2-devel@lists.01.org
Cc: star.zeng@intel.com
Subject: Re: [PATCH 02/11] MdeModulePkg/UsbMass: Fix integer overflow when BlockSize is 1
Date: Tue, 16 Oct 2018 11:19:32 +0800 [thread overview]
Message-ID: <63407d7d-cf64-e652-a77b-63ddd6758937@intel.com> (raw)
In-Reply-To: <20181015063833.61304-3-ruiyu.ni@intel.com>
On 2018/10/15 14:38, Ruiyu Ni wrote:
> UsbBootReadWriteBlocks() and UsbBootReadWriteBlocks16() use a UINT16
> local variable to hold the value of
> USB_BOOT_MAX_CARRY_SIZE (=0x10000) / BlockSize.
> When BlockSize is 1, the UINT16 local variable is set to 0x10000
Ray,
Thanks for the patch.
Is it possible that the BlockSize == 0 or > USB_BOOT_MAX_CARRY_SIZE?
Thanks,
Star
> but the high-16 bits are truncated resulting the final value be 0.
>
> It causes the while-loop in the two functions accesses 0 block in
> each loop, resulting the loop never ends.
>
> The patch fixes the two functions to make sure no integer overflow
> happens.
>
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Steven Shi <steven.shi@intel.com>
> ---
> .../Bus/Usb/UsbMassStorageDxe/UsbMassBoot.c | 27 +++++++++++-----------
> 1 file changed, 14 insertions(+), 13 deletions(-)
>
> diff --git a/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassBoot.c b/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassBoot.c
> index 581571ab45..37fbeedbeb 100644
> --- a/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassBoot.c
> +++ b/MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassBoot.c
> @@ -815,14 +815,14 @@ UsbBootReadWriteBlocks (
> {
> USB_BOOT_READ_WRITE_10_CMD Cmd;
> EFI_STATUS Status;
> - UINT16 Count;
> - UINT16 CountMax;
> + UINT32 Count;
> + UINT32 CountMax;
> UINT32 BlockSize;
> UINT32 ByteSize;
> UINT32 Timeout;
>
> BlockSize = UsbMass->BlockIoMedia.BlockSize;
> - CountMax = (UINT16)(USB_BOOT_MAX_CARRY_SIZE / BlockSize);
> + CountMax = USB_BOOT_MAX_CARRY_SIZE / BlockSize;
> Status = EFI_SUCCESS;
>
> while (TotalBlock > 0) {
> @@ -831,8 +831,9 @@ UsbBootReadWriteBlocks (
> // on the device. We must split the total block because the READ10
> // command only has 16 bit transfer length (in the unit of block).
> //
> - Count = (UINT16)((TotalBlock < CountMax) ? TotalBlock : CountMax);
> - ByteSize = (UINT32)Count * BlockSize;
> + Count = (UINT32)MIN (TotalBlock, CountMax);
> + Count = MIN (MAX_UINT16, Count);
> + ByteSize = Count * BlockSize;
>
> //
> // USB command's upper limit timeout is 5s. [USB2.0-9.2.6.1]
> @@ -847,7 +848,7 @@ UsbBootReadWriteBlocks (
> Cmd.OpCode = Write ? USB_BOOT_WRITE10_OPCODE : USB_BOOT_READ10_OPCODE;
> Cmd.Lun = (UINT8) (USB_BOOT_LUN (UsbMass->Lun));
> WriteUnaligned32 ((UINT32 *) Cmd.Lba, SwapBytes32 (Lba));
> - WriteUnaligned16 ((UINT16 *) Cmd.TransferLen, SwapBytes16 (Count));
> + WriteUnaligned16 ((UINT16 *) Cmd.TransferLen, SwapBytes16 ((UINT16)Count));
>
> Status = UsbBootExecCmdWithRetry (
> UsbMass,
> @@ -867,7 +868,7 @@ UsbBootReadWriteBlocks (
> Lba, Count
> ));
> Lba += Count;
> - Buffer += Count * BlockSize;
> + Buffer += ByteSize;
> TotalBlock -= Count;
> }
>
> @@ -897,22 +898,22 @@ UsbBootReadWriteBlocks16 (
> {
> UINT8 Cmd[16];
> EFI_STATUS Status;
> - UINT16 Count;
> - UINT16 CountMax;
> + UINT32 Count;
> + UINT32 CountMax;
> UINT32 BlockSize;
> UINT32 ByteSize;
> UINT32 Timeout;
>
> BlockSize = UsbMass->BlockIoMedia.BlockSize;
> - CountMax = (UINT16)(USB_BOOT_MAX_CARRY_SIZE / BlockSize);
> + CountMax = USB_BOOT_MAX_CARRY_SIZE / BlockSize;
> Status = EFI_SUCCESS;
>
> while (TotalBlock > 0) {
> //
> // Split the total blocks into smaller pieces.
> //
> - Count = (UINT16)((TotalBlock < CountMax) ? TotalBlock : CountMax);
> - ByteSize = (UINT32)Count * BlockSize;
> + Count = (UINT32)MIN (TotalBlock, CountMax);
> + ByteSize = Count * BlockSize;
>
> //
> // USB command's upper limit timeout is 5s. [USB2.0-9.2.6.1]
> @@ -947,7 +948,7 @@ UsbBootReadWriteBlocks16 (
> Lba, Count
> ));
> Lba += Count;
> - Buffer += Count * BlockSize;
> + Buffer += ByteSize;
> TotalBlock -= Count;
> }
>
>
next prev parent reply other threads:[~2018-10-16 3:20 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-15 6:38 [PATCH 00/11] Need to validate data from HW Ruiyu Ni
2018-10-15 6:38 ` [PATCH 01/11] MdeModulePkg/UsbMass: Merge UsbBoot(Read|Write)Blocks(16) Ruiyu Ni
2018-10-16 3:06 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 02/11] MdeModulePkg/UsbMass: Fix integer overflow when BlockSize is 1 Ruiyu Ni
2018-10-16 3:19 ` Zeng, Star [this message]
2018-10-16 3:32 ` Ni, Ruiyu
2018-10-15 6:38 ` [PATCH 03/11] MdeModulePkg/UsbBus: Fix out-of-bound read access to descriptors Ruiyu Ni
2018-10-16 3:38 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 04/11] MdeModulePkg/UsbBus: Reject descriptor whose length is bad Ruiyu Ni
2018-10-16 3:42 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 05/11] MdeModulePkg/Usb: Make sure data from HW is no more than expected Ruiyu Ni
2018-10-15 11:29 ` Wu, Hao A
2018-10-16 4:26 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 06/11] SourceLevelDebugPkg/Usb3: Make sure data from HW can fit in buffer Ruiyu Ni
2018-10-15 11:31 ` Wu, Hao A
2018-10-15 6:38 ` [PATCH 07/11] MdeModulePkg/UsbKb: Don't access key codes when length is wrong Ruiyu Ni
2018-10-16 4:52 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 08/11] MdeModulePkg/AbsPointer: " Ruiyu Ni
2018-10-16 5:01 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 09/11] MdeModulePkg/UsbMouse: " Ruiyu Ni
2018-10-16 5:03 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 10/11] MdeModulePkg/UsbBus: Deny when the string descriptor length is odd Ruiyu Ni
2018-10-16 5:11 ` Zeng, Star
2018-10-15 6:38 ` [PATCH 11/11] MdeModulePkg/Bus/Ufs: Ensure device not return more data than expected Ruiyu Ni
2018-10-16 5:27 ` Zeng, Star
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=63407d7d-cf64-e652-a77b-63ddd6758937@intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox