From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by mx.groups.io with SMTP id smtpd.web11.797.1577154792916608503 for ; Mon, 23 Dec 2019 18:33:13 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.93, mailfrom: ray.ni@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 Dec 2019 18:33:12 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,350,1571727600"; d="scan'208";a="417436130" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by fmsmga005.fm.intel.com with ESMTP; 23 Dec 2019 18:33:12 -0800 Received: from fmsmsx124.amr.corp.intel.com (10.18.125.39) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 23 Dec 2019 18:33:12 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by fmsmsx124.amr.corp.intel.com (10.18.125.39) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 23 Dec 2019 18:33:11 -0800 Received: from shsmsx104.ccr.corp.intel.com ([169.254.5.90]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.222]) with mapi id 14.03.0439.000; Tue, 24 Dec 2019 10:33:09 +0800 From: "Ni, Ray" To: "Dong, Eric" , "devel@edk2.groups.io" CC: Laszlo Ersek Subject: Re: [PATCH v3 2/2] UefiCpuPkg/PiSmmCpuDxeSmm: Fix buffer overflow issue. Thread-Topic: [PATCH v3 2/2] UefiCpuPkg/PiSmmCpuDxeSmm: Fix buffer overflow issue. Thread-Index: AQHVuWh9PZo7cPr6p0SiGGfCe+GRwKfIkVnA Date: Tue, 24 Dec 2019 02:33:08 +0000 Message-ID: <734D49CCEBEEF84792F5B80ED585239D5C3A9D46@SHSMSX104.ccr.corp.intel.com> References: <20191223081037.1565-1-eric.dong@intel.com> <20191223081037.1565-3-eric.dong@intel.com> In-Reply-To: <20191223081037.1565-3-eric.dong@intel.com> Accept-Language: en-US, zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: ray.ni@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Eric, I am curious how the SMM CPU driver ran well with the buffer overflow issue= ? Can you please explain the details? Thanks, Ray > -----Original Message----- > From: Dong, Eric > Sent: Monday, December 23, 2019 4:11 PM > To: devel@edk2.groups.io > Cc: Ni, Ray ; Laszlo Ersek > Subject: [PATCH v3 2/2] UefiCpuPkg/PiSmmCpuDxeSmm: Fix buffer overflow > issue. >=20 > The size for the array of mSmmMpSyncData->CpuData[] is 0 ~ > mMaxNumberOfCpus -1. But current code may use > mSmmMpSyncData->CpuData[mMaxNumberOfCpus]. >=20 > This patch fixed this issue. >=20 > Reviewed-by: Ray Ni > Cc: Laszlo Ersek > Signed-off-by: Eric Dong > --- > UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) >=20 > diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c > b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c > index 35951cc43e..4808045f71 100644 > --- a/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c > +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/MpService.c > @@ -137,7 +137,7 @@ ReleaseAllAPs ( > { >=20 > UINTN Index; >=20 >=20 >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (IsPresentAp (Index)) { >=20 > ReleaseSemaphore (mSmmMpSyncData->CpuData[Index].Run); >=20 > } >=20 > @@ -170,7 +170,7 @@ AllCpusInSmmWithExceptions ( >=20 >=20 > CpuData =3D mSmmMpSyncData->CpuData; >=20 > ProcessorInfo =3D gSmmCpuPrivate->ProcessorInfo; >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (!(*(CpuData[Index].Present)) && ProcessorInfo[Index].ProcessorId= !=3D > INVALID_APIC_ID) { >=20 > if (((Exceptions & ARRIVAL_EXCEPTION_DELAYED) !=3D 0) && > SmmCpuFeaturesGetSmmRegister (Index, SmmRegSmmDelayed) !=3D 0) { >=20 > continue; >=20 > @@ -305,7 +305,7 @@ SmmWaitForApArrival ( > // >=20 > // Send SMI IPIs to bring outside processors in >=20 > // >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (!(*(mSmmMpSyncData->CpuData[Index].Present)) && > gSmmCpuPrivate->ProcessorInfo[Index].ProcessorId !=3D INVALID_APIC_ID) { >=20 > SendSmiIpi ((UINT32)gSmmCpuPrivate- > >ProcessorInfo[Index].ProcessorId); >=20 > } >=20 > @@ -361,7 +361,7 @@ WaitForAllAPsNotBusy ( > { >=20 > UINTN Index; >=20 >=20 >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > // >=20 > // Ignore BSP and APs which not call in SMM. >=20 > // >=20 > @@ -617,7 +617,7 @@ BSPHandler ( > // >=20 > while (TRUE) { >=20 > PresentCount =3D 0; >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (*(mSmmMpSyncData->CpuData[Index].Present)) { >=20 > PresentCount ++; >=20 > } >=20 > @@ -1301,7 +1301,7 @@ InternalSmmStartupAllAPs ( > } >=20 >=20 >=20 > CpuCount =3D 0; >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (IsPresentAp (Index)) { >=20 > CpuCount ++; >=20 >=20 >=20 > @@ -1333,13 +1333,13 @@ InternalSmmStartupAllAPs ( > // Here code always use AcquireSpinLock instead of AcquireSpinLockOrFa= il > for not >=20 > // block mode. >=20 > // >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (IsPresentAp (Index)) { >=20 > AcquireSpinLock (mSmmMpSyncData->CpuData[Index].Busy); >=20 > } >=20 > } >=20 >=20 >=20 > - for (Index =3D mMaxNumberOfCpus; Index-- > 0;) { >=20 > + for (Index =3D 0; Index < mMaxNumberOfCpus; Index++) { >=20 > if (IsPresentAp (Index)) { >=20 > mSmmMpSyncData->CpuData[Index].Procedure =3D > (EFI_AP_PROCEDURE2) Procedure; >=20 > mSmmMpSyncData->CpuData[Index].Parameter =3D ProcedureArguments; >=20 > -- > 2.23.0.windows.1