From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web12.9952.1580983414983672660 for ; Thu, 06 Feb 2020 02:03:35 -0800 Authentication-Results: mx.groups.io; dkim=missing; spf=temperror, err=temporary DNS error (domain: intel.com, ip: 192.55.52.151, mailfrom: bob.c.feng@intel.com) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Feb 2020 02:03:34 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,409,1574150400"; d="scan'208";a="231996863" Received: from fmsmsx108.amr.corp.intel.com ([10.18.124.206]) by orsmga003.jf.intel.com with ESMTP; 06 Feb 2020 02:03:33 -0800 Received: from shsmsx603.ccr.corp.intel.com (10.109.6.143) by FMSMSX108.amr.corp.intel.com (10.18.124.206) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 6 Feb 2020 02:03:33 -0800 Received: from shsmsx601.ccr.corp.intel.com (10.109.6.141) by SHSMSX603.ccr.corp.intel.com (10.109.6.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Thu, 6 Feb 2020 18:03:31 +0800 Received: from shsmsx601.ccr.corp.intel.com ([10.109.6.141]) by SHSMSX601.ccr.corp.intel.com ([10.109.6.141]) with mapi id 15.01.1713.004; Thu, 6 Feb 2020 18:03:31 +0800 From: "Bob Feng" To: "Gao, Liming" , "devel@edk2.groups.io" CC: "Oram, Isaac W" Subject: Re: [edk2-platform][patch v3] FitGen: Fix the issue to run in X64 linux machine Thread-Topic: [edk2-platform][patch v3] FitGen: Fix the issue to run in X64 linux machine Thread-Index: AQHV3C1eiheMFJj6L0S36bxjZPewhagN8O5g Date: Thu, 6 Feb 2020 10:03:31 +0000 Message-ID: <74e333fe79664d6897b0619680343461@intel.com> References: <20200205140535.460-1-liming.gao@intel.com> In-Reply-To: <20200205140535.460-1-liming.gao@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNDg4ZjFkZWYtNjlmNS00MWI1LWEwNTYtNWRlNGJkOWQxNmJkIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoid0U5NUx1QklLb2tHUlRUMW9hZTBySmlLMHZXNUhTMHRyZEc5N1A3dlBmMGxUSDFjczZpUlROSWpSQU1BTHFMSCJ9 dlp-version: 11.2.0.6 dlp-product: dlpe-windows x-ctpclassification: CTP_NT dlp-reaction: no-action x-originating-ip: [10.239.127.36] MIME-Version: 1.0 Return-Path: bob.c.feng@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Bob Feng -----Original Message----- From: Gao, Liming =20 Sent: Wednesday, February 5, 2020 10:06 PM To: devel@edk2.groups.io Cc: Feng, Bob C ; Oram, Isaac W Subject: [edk2-platform][patch v3] FitGen: Fix the issue to run in X64 linu= x machine BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2466 Memory allocation (malloc) may return the buffer address be above 4G. Current logic always converts the memory address to UINT32. It will cause m= emory read and free corrupt. This patch uses pointer to store the allocated= memory address. Cc: Bob Feng Cc: Isaac Oram Signed-off-by: Liming Gao --- In v2: update the commit message.=20 In v3: correct Index to access OptionalModule field Silicon/Intel/Tools/Fi= tGen/FitGen.c | 31 ++++++++++++++++++++----------- Silicon/Intel/Tools/Fit= Gen/FitGen.h | 2 +- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/Silicon/Intel/Tools/FitGen/FitGen.c b/Silicon/Intel/Tools/FitG= en/FitGen.c index 833610f2a0..9f1db32a15 100644 --- a/Silicon/Intel/Tools/FitGen/FitGen.c +++ b/Silicon/Intel/Tools/FitGen/FitGen.c @@ -2,7 +2,7 @@ This utility is part of build process for IA32/X64 FD. It generates FIT table. =20 -Copyright (c) 2010-2019, Intel Corporation. All rights reserved.
+Copyright (c) 2010-2020, Intel Corporation. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent =20 **/ @@ -226,9 +226,17 @@ typedef struct { #define FIT_TABLE_TYPE_BIOS_DATA_AREA 13 #define FIT_TABLE_TYPE_CSE_SECURE_BOOT 16 =20 +// +// With OptionalModule Address isn't known until free space has been //=20 +identified and the optional module has been copied into the FLASH //=20 +image buffer (or initialized to be populated later by another program). +// This is very dangerous code as it can truncate 64b pointers to //=20 +allocated memory buffers. The full pointer is in Buffer for that case. +// typedef struct { UINT32 Type; UINT32 Address; + UINT8 *Buffer; // Used by OptionalModule only UINT32 Size; UINT32 Version; // Used by OptionalModule and PortModule only } FIT_TA= BLE_CONTEXT_ENTRY; @@ -575,9 +583,9 @@ Returns: UINT64 FvLength; EFI_GUID *TempGuid; UINT8 *FixPoint; - UINT32 Offset; - UINT32 FileLength; - UINT32 FileOccupiedSize; + UINTN Offset; + UINTN FileLength; + UINTN FileOccupiedSize; =20 // // Find the FFS file @@ -595,7 +603,7 @@ Returns: InitializeFvLib (FvHeader, (UINT32)FvLength); =20 FileHeader =3D (EFI_FFS_FILE_HEADER *)((UINTN)FvHeader + FvHeade= r->HeaderLength); - Offset =3D (UINT32) (UINTN) FileHeader - (UINT32) (UINTN) Fv= Header; + Offset =3D (UINTN) FileHeader - (UINTN) FvHeader; =20 while (Offset < FvLength) { TempGuid =3D (EFI_GUID *)&(FileHeader->Name); @@ -625,7 +633,7 @@ Re= turns: return FixPoint; } FileHeader =3D (EFI_FFS_FILE_HEADER *)((UINTN)FileHeader + FileOccup= iedSize); - Offset =3D (UINT32) (UINTN) FileHeader - (UINT32) (UINTN) FvHeader; + Offset =3D (UINTN) FileHeader - (UINTN) FvHeader; } =20 // @@ -1082,7 +1090,7 @@ Returns: return 0; } gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber]= .Type =3D FIT_TABLE_TYPE_MICROCODE; - gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber]= .Address =3D MicrocodeBase + ((UINT32) (UINTN) MicrocodeBuffer - (UINT32) (= UINTN) MicrocodeFileBuffer); + =20 + gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Address =3D= =20 + MicrocodeBase + (UINT32)((UINTN) MicrocodeBuffer - (UINTN)=20 + MicrocodeFileBuffer); gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber]= .Size =3D MicrocodeSize; gFitTableContext.MicrocodeNumber++; gFitTableContext.FitEntryNumber++; @@ -1110,7 +1118,7 @@ Returns: /// while (MicrocodeBuffer + SlotSize <=3D MicrocodeFileBuffer += MicrocodeFileSize) { gFitTableContext.Microcode[gFitTableContext.MicrocodeNumbe= r].Type =3D FIT_TABLE_TYPE_MICROCODE; - gFitTableContext.Microcode[gFitTableContext.MicrocodeNumbe= r].Address =3D MicrocodeBase + ((UINT32) (UINTN) MicrocodeBuffer - (UINT32)= (UINTN) MicrocodeFileBuffer); + =20 + gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Address =3D= =20 + MicrocodeBase + (UINT32)((UINTN) MicrocodeBuffer - (UINTN)=20 + MicrocodeFileBuffer); gFitTableContext.MicrocodeNumber++; gFitTableContext.FitEntryNumber++; =20 @@ -1428,7 +1436,7 @@ Returns: return 0; } gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Type = =3D FIT_TABLE_TYPE_MICROCODE; - gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Address= =3D MicrocodeBase + ((UINT32) (UINTN) MicrocodeBuffer - (UINT32) (UINTN) M= icrocodeFileBuffer); + =20 + gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Address =3D= =20 + MicrocodeBase + (UINT32)((UINTN) MicrocodeBuffer - (UINTN)=20 + MicrocodeFileBuffer); gFitTableContext.Microcode[gFitTableContext.MicrocodeNumber].Size = =3D MicrocodeSize; gFitTableContext.MicrocodeNumber++; gFitTableContext.FitEntryNumber++; @@ -1557,6 +1565,7 @@ Returns: } gFitTableContext.OptionalModule[gFitTableContext.OptionalModuleNumber]= .Type =3D Type; gFitTableContext.OptionalModule[gFitTableContext.OptionalModuleNumber]= .Address =3D (UINT32) (UINTN) FileBuffer; + =20 + gFitTableContext.OptionalModule[gFitTableContext.OptionalModuleNumber] + .Buffer =3D FileBuffer; gFitTableContext.OptionalModule[gFitTableContext.OptionalModuleNumber]= .Size =3D FileSize; =20 // @@ -1846,8 +1855,8 @@ Returns: } } } - memcpy (OptionalModuleAddress, (VOID *) (UINTN) gFitTableContext.Opt= ionalModule[Index].Address, gFitTableContext.OptionalModule[Index].Size); - free ((VOID *) (UINTN) gFitTableContext.OptionalModule[Index].Addres= s); + memcpy (OptionalModuleAddress, gFitTableContext.OptionalModule[Index= ].Buffer, gFitTableContext.OptionalModule[Index].Size); + free (gFitTableContext.OptionalModule[Index].Buffer); gFitTableContext.OptionalModule[Index].Address =3D MEMORY_TO_FLASH (= OptionalModuleAddress, FvBuffer, FvSize); } // diff --git a/Silicon/Intel/Tools/FitGen/FitGen.h b/Silicon/Intel/Tools/FitG= en/FitGen.h index 9bd3f6824b..ecb5822d32 100644 --- a/Silicon/Intel/Tools/FitGen/FitGen.h +++ b/Silicon/Intel/Tools/FitGen/FitGen.h @@ -31,7 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent // Utility = version information // #define UTILITY_MAJOR_VERSION 0 -#define UTILITY_M= INOR_VERSION 56 +#define UTILITY_MINOR_VERSION 57 #define UTILITY_DATE __DATE__ =20 // -- 2.13.0.windows.1