Reviewed-by: Andrei Warkentin ________________________________ From: devel@edk2.groups.io on behalf of Ard Biesheuvel via groups.io Sent: Wednesday, June 17, 2020 10:38 AM To: devel@edk2.groups.io Cc: leif@nuviainc.com ; pete@akeo.ie ; Andrei Warkentin ; jeremy.linton@arm.com ; Samer.El-Haj-Mahmoud@arm.com ; Ard Biesheuvel Subject: [edk2-devel] [PATCH] EmbeddedPkg/NonCoherentDmaLib: avoid dereferencing bogus buffer address The bounce buffering code in NonCoherentDmaLib copies data into the bounce buffer using CopyMem(), but passes Map->HostAddress as the source of the copy before it has been assigned its correct value. Signed-off-by: Ard Biesheuvel --- EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c index 115345765435..9c8ef5bfb533 100644 --- a/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c +++ b/EmbeddedPkg/Library/NonCoherentDmaLib/NonCoherentDmaLib.c @@ -225,8 +225,7 @@ DmaMap ( } if (Map->Operation == MapOperationBusMasterRead) { - CopyMem (Map->BufferAddress, (VOID *)(UINTN)Map->HostAddress, - *NumberOfBytes); + CopyMem (Map->BufferAddress, (VOID *)(UINTN)HostAddress, *NumberOfBytes); } mCpu->FlushDataCache (mCpu, (UINTN)Map->BufferAddress, AllocSize, EfiCpuFlushTypeWriteBack); -- 2.27.0 -=-=-=-=-=-= Groups.io Links: You receive all messages sent to this group. View/Reply Online (#61421): https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F61421&data=02%7C01%7Cawarkentin%40vmware.com%7Ce0cab9a2b8a74880b69f08d812d48073%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637280051185406598&sdata=NylhdsdCkUdiGZZB6ya0pCMs8vYFb8tpdjW29q1dJAQ%3D&reserved=0 Mute This Topic: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F74939973%2F4387333&data=02%7C01%7Cawarkentin%40vmware.com%7Ce0cab9a2b8a74880b69f08d812d48073%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637280051185406598&sdata=2Wv1bPYhk2Ac32ItKenF9bmig5t%2FKJuTFVWZacFZvY8%3D&reserved=0 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=02%7C01%7Cawarkentin%40vmware.com%7Ce0cab9a2b8a74880b69f08d812d48073%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637280051185406598&sdata=4Yp5s5IOCF%2BY6OwqcDZmcmgn1crE9MxuL3TnHEGSMsM%3D&reserved=0 [awarkentin@vmware.com] -=-=-=-=-=-=