From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from hqnvemgate25.nvidia.com (hqnvemgate25.nvidia.com [216.228.121.64]) by mx.groups.io with SMTP id smtpd.web08.816.1603813977469756662 for ; Tue, 27 Oct 2020 08:52:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nvidia.com header.s=n1 header.b=NVc8SE5e; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nvidia.com, ip: 216.228.121.64, mailfrom: jbrasen@nvidia.com) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Tue, 27 Oct 2020 08:53:00 -0700 Received: from HQMAIL105.nvidia.com (172.20.187.12) by HQMAIL111.nvidia.com (172.20.187.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 27 Oct 2020 15:52:51 +0000 Received: from jbrasen-ux.nvidia.com (10.124.1.5) by mail.nvidia.com (172.20.187.12) with Microsoft SMTP Server id 15.0.1473.3 via Frontend Transport; Tue, 27 Oct 2020 15:52:51 +0000 From: "Jeff Brasen" To: CC: , , , Jeff Brasen Subject: [PATCH v2] MdeModulePkg/Gcd: Check memory allocation when initializing memory Date: Tue, 27 Oct 2020 09:52:47 -0600 Message-ID: <828951b3a28adfb8ae0296a356c10ee5d37616ce.1603813842.git.jbrasen@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 X-NVConfidentiality: public Return-Path: jbrasen@nvidia.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1603813980; bh=CW8YPhGGfFhgcLgU26fP21xs0bS7hFHkV88jO0zVCj4=; h=From:To:CC:Subject:Date:Message-ID:X-Mailer:In-Reply-To: References:MIME-Version:X-NVConfidentiality: Content-Transfer-Encoding:Content-Type; b=NVc8SE5eI3Qy4bIZ1WS0UbthvJoC8jiL1a8Z8a7lAYmlNzVSXsmz9KubBqSB8Zxkx Om1P7jt42ktlCN5h/+5e2sGuI2HXdh+0oFduYnwvhplVS4fTEE68GXPGusTnnemZKI 8MxlDpY8AEVjiS6XS6trwV8PPu4X9fdQ1T6d+iVKiYn9yz9v8LrfX5gMfaKDmPx1x1 ECloUr6/ynftKakIexZse3xdCVgyHirkIVTsw6Uk/8VeBLeMYvPkxvuGJXNpKlCJW6 s0EetJrWWQTEzR0EXyvy2StOKzr/qR8KHMIqOUc8H8t1X8jBOCq+wAD7mmK1tJq6M6 B1NlS0PCjZD3Q== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain CoreInitializeMemoryServices was not checking for any existing memory allocation created in the HOB producer phase. If there are memory allocations outside of the region covered by the HOB List then Gcd could select that region for memory which can result in the memory allocation to not be handled and memory overwrites. Signed-off-by: Jeff Brasen --- MdeModulePkg/Core/Dxe/Gcd/Gcd.c | 60 +++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c b/MdeModulePkg/Core/Dxe/Gcd/Gc= d.c index 2d8c076f7113..4a22ee96b758 100644 --- a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c +++ b/MdeModulePkg/Core/Dxe/Gcd/Gcd.c @@ -2097,6 +2097,62 @@ CalculateTotalMemoryBinSizeNeeded ( return TotalSize; } =20 +/** + Find the largest region in the specified region that is not covered by = an existing memory allocation + + @param BaseAddress On input start of the region to check. + On output start of the largest free region. + @param Length On input size of region to check. + On output size of the largest free region. + @param MemoryHob Hob pointer for the first memory allocation pointe= r to check +**/ +VOID +FindLargestFreeRegion ( + IN OUT EFI_PHYSICAL_ADDRESS *BaseAddress, + IN OUT UINT64 *Length, + IN EFI_HOB_MEMORY_ALLOCATION *MemoryHob + ) +{ + EFI_PHYSICAL_ADDRESS TopAddress; + + TopAddress =3D *BaseAddress + *Length; + while (MemoryHob !=3D NULL) { + EFI_PHYSICAL_ADDRESS AllocatedTop; + + AllocatedTop =3D MemoryHob->AllocDescriptor.MemoryBaseAddress + Memory= Hob->AllocDescriptor.MemoryLength; + + if ((MemoryHob->AllocDescriptor.MemoryBaseAddress >=3D *BaseAddress) &= & + (AllocatedTop <=3D TopAddress)) { + EFI_PHYSICAL_ADDRESS LowerBase; + UINT64 LowerSize; + EFI_PHYSICAL_ADDRESS UpperBase; + UINT64 UpperSize; + + LowerBase =3D *BaseAddress; + LowerSize =3D MemoryHob->AllocDescriptor.MemoryBaseAddress - *BaseAd= dress; + UpperBase =3D AllocatedTop; + UpperSize =3D TopAddress - AllocatedTop; + + if (LowerSize !=3D 0) { + FindLargestFreeRegion (&LowerBase, &LowerSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + if (UpperSize !=3D 0) { + FindLargestFreeRegion (&UpperBase, &UpperSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + + if (UpperSize >=3D LowerSize) { + *Length =3D UpperSize; + *BaseAddress =3D UpperBase; + } else { + *Length =3D LowerSize; + *BaseAddress =3D LowerBase; + } + return; + } + MemoryHob =3D GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB= (MemoryHob)); + } +} + /** External function. Initializes memory services based on the memory descriptor HOBs. This function is responsible for priming the memory @@ -2235,6 +2291,7 @@ CoreInitializeMemoryServices ( Attributes =3D PhitResourceHob->ResourceAttribute; BaseAddress =3D PageAlignAddress (PhitHob->EfiMemoryTop); Length =3D PageAlignLength (ResourceHob->PhysicalStart + Resourc= eHob->ResourceLength - BaseAddress); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLOCATI= ON *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, then @@ -2242,6 +2299,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (PhitHob->EfiFreeMemoryBottom); Length =3D PageAlignLength (PhitHob->EfiFreeMemoryTop - BaseAd= dress); + //This region is required to have no memory allocation inside it, sk= ip check for entries in HOB List if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, th= en @@ -2249,6 +2307,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (ResourceHob->PhysicalStart); Length =3D PageAlignLength ((UINT64)((UINTN)*HobStart - Base= Address)); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLO= CATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); } } break; @@ -2312,6 +2371,7 @@ CoreInitializeMemoryServices ( // TestedMemoryBaseAddress =3D PageAlignAddress (ResourceHob->PhysicalS= tart); TestedMemoryLength =3D PageAlignLength (ResourceHob->PhysicalS= tart + ResourceHob->ResourceLength - TestedMemoryBaseAddress); + FindLargestFreeRegion (&TestedMemoryBaseAddress, &TestedMemoryLength= , (EFI_HOB_MEMORY_ALLOCATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)= ); if (TestedMemoryLength < MinimalMemorySizeNeeded) { continue; } --=20 2.25.1