* Re: [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue
2023-05-18 6:28 [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue Ranbir Singh
@ 2023-05-18 19:55 ` Chiu, Chasel
2023-05-19 12:29 ` [edk2-devel] " Pedro Falcato
2023-05-30 5:22 ` Chiu, Chasel
2 siblings, 0 replies; 6+ messages in thread
From: Chiu, Chasel @ 2023-05-18 19:55 UTC (permalink / raw)
To: Ranbir Singh, devel@edk2.groups.io
Cc: Desimone, Nathaniel L, Zeng, Star, Ranbir Singh
This fix looks good to me! Thanks Ranbir!
Reviewed-by: Chasel Chiu <chasel.chiu@intel.com>
> -----Original Message-----
> From: Ranbir Singh <rsingh@ventanamicro.com>
> Sent: Wednesday, May 17, 2023 11:29 PM
> To: devel@edk2.groups.io
> Cc: Chiu, Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> <nathaniel.l.desimone@intel.com>; Zeng, Star <star.zeng@intel.com>; Ranbir
> Singh <Ranbir.Singh3@Dell.com>
> Subject: [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN
> Coverity issue
>
> FspData->PerfIdx is getting increased for every call unconditionally
> in the function SetFspMeasurePoint and hence memory access can happen for
> out of bound FspData->PerfData[] array entries also.
>
> Example -
> FspData->PerfData is an array of 32 UINT64 entries. Assume a call
> is made to SetFspMeasurePoint function when the FspData->PerfIdx
> last value is 31. It gets incremented to 32 at line 400.
> Any subsequent call to SetFspMeasurePoint functions leads to
> FspData->PerfData[32] getting accessed which is out of the PerfData
> array as well as the FSP_GLOBAL_DATA structure boundary.
>
> Hence keep array access and index increment inside if block only and return
> invalid performance timestamp when PerfIdx is invalid.
>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4200
> Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> ---
> IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> index a22b0e7825ad..cda2a7b2478e 100644
> --- a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> +++ b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> @@ -377,7 +377,8 @@ GetFspSiliconInitUpdDataPointer (
> @param[in] Id Measurement point ID. - @return performance
> timestamp.+ @return performance timestamp if current PerfIdx is valid,+
> else return 0 as invalid performance timestamp **/ UINT64 EFIAPI@@ -395,9
> +396,10 @@ SetFspMeasurePoint (
> if (FspData->PerfIdx < sizeof (FspData->PerfData) / sizeof (FspData-
> >PerfData[0])) { FspData->PerfData[FspData->PerfIdx] =
> AsmReadTsc (); ((UINT8 *)(&FspData->PerfData[FspData->PerfIdx]))[7] = Id;+
> return FspData->PerfData[(FspData->PerfIdx)++]; } - return FspData-
> >PerfData[(FspData->PerfIdx)++];+ return (UINT64)0x0000000000000000; }
> /**--
> 2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue
2023-05-18 6:28 [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue Ranbir Singh
2023-05-18 19:55 ` Chiu, Chasel
@ 2023-05-19 12:29 ` Pedro Falcato
2023-05-30 3:28 ` Chiu, Chasel
2023-05-30 5:22 ` Chiu, Chasel
2 siblings, 1 reply; 6+ messages in thread
From: Pedro Falcato @ 2023-05-19 12:29 UTC (permalink / raw)
To: devel, rsingh; +Cc: Chasel Chiu, Nate DeSimone, Star Zeng, Ranbir Singh
On Thu, May 18, 2023 at 4:16 PM Ranbir Singh <rsingh@ventanamicro.com> wrote:
>
> FspData->PerfIdx is getting increased for every call unconditionally
> in the function SetFspMeasurePoint and hence memory access can happen
> for out of bound FspData->PerfData[] array entries also.
>
> Example -
> FspData->PerfData is an array of 32 UINT64 entries. Assume a call
> is made to SetFspMeasurePoint function when the FspData->PerfIdx
> last value is 31. It gets incremented to 32 at line 400.
> Any subsequent call to SetFspMeasurePoint functions leads to
> FspData->PerfData[32] getting accessed which is out of the PerfData
> array as well as the FSP_GLOBAL_DATA structure boundary.
>
> Hence keep array access and index increment inside if block only and
> return invalid performance timestamp when PerfIdx is invalid.
>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4200
> Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> ---
> IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> index a22b0e7825ad..cda2a7b2478e 100644
> --- a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> +++ b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> @@ -377,7 +377,8 @@ GetFspSiliconInitUpdDataPointer (
>
> @param[in] Id Measurement point ID.
>
> - @return performance timestamp.
> + @return performance timestamp if current PerfIdx is valid,
> + else return 0 as invalid performance timestamp
> **/
> UINT64
> EFIAPI
> @@ -395,9 +396,10 @@ SetFspMeasurePoint (
> if (FspData->PerfIdx < sizeof (FspData->PerfData) / sizeof (FspData->PerfData[0])) {
> FspData->PerfData[FspData->PerfIdx] = AsmReadTsc ();
> ((UINT8 *)(&FspData->PerfData[FspData->PerfIdx]))[7] = Id;
> + return FspData->PerfData[(FspData->PerfIdx)++];
> }
>
> - return FspData->PerfData[(FspData->PerfIdx)++];
> + return (UINT64)0x0000000000000000;
return 0;
Works just as well. You also don't need a cast.
https://godbolt.org/z/e5vvGcWWo
--
Pedro
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue
2023-05-19 12:29 ` [edk2-devel] " Pedro Falcato
@ 2023-05-30 3:28 ` Chiu, Chasel
2023-05-30 3:35 ` Ranbir Singh
0 siblings, 1 reply; 6+ messages in thread
From: Chiu, Chasel @ 2023-05-30 3:28 UTC (permalink / raw)
To: devel@edk2.groups.io, pedro.falcato@gmail.com,
rsingh@ventanamicro.com
Cc: Desimone, Nathaniel L, Zeng, Star, Ranbir Singh
That’s good suggestion Pedro!
Ranbir, would you like me to modify your patch to "return 0" during merging?
Thanks,
Chasel
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Pedro
> Falcato
> Sent: Friday, May 19, 2023 5:29 AM
> To: devel@edk2.groups.io; rsingh@ventanamicro.com
> Cc: Chiu, Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> <nathaniel.l.desimone@intel.com>; Zeng, Star <star.zeng@intel.com>; Ranbir
> Singh <Ranbir.Singh3@dell.com>
> Subject: Re: [edk2-devel] [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib:
> Fix OVERRUN Coverity issue
>
> On Thu, May 18, 2023 at 4:16 PM Ranbir Singh <rsingh@ventanamicro.com>
> wrote:
> >
> > FspData->PerfIdx is getting increased for every call unconditionally
> > in the function SetFspMeasurePoint and hence memory access can happen
> > for out of bound FspData->PerfData[] array entries also.
> >
> > Example -
> > FspData->PerfData is an array of 32 UINT64 entries. Assume a call
> > is made to SetFspMeasurePoint function when the FspData->PerfIdx
> > last value is 31. It gets incremented to 32 at line 400.
> > Any subsequent call to SetFspMeasurePoint functions leads to
> > FspData->PerfData[32] getting accessed which is out of the PerfData
> > array as well as the FSP_GLOBAL_DATA structure boundary.
> >
> > Hence keep array access and index increment inside if block only and
> > return invalid performance timestamp when PerfIdx is invalid.
> >
> > Cc: Chasel Chiu <chasel.chiu@intel.com>
> > Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> > Cc: Star Zeng <star.zeng@intel.com>
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4200
> > Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> > Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> > ---
> > IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > index a22b0e7825ad..cda2a7b2478e 100644
> > --- a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > +++ b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > @@ -377,7 +377,8 @@ GetFspSiliconInitUpdDataPointer (
> >
> > @param[in] Id Measurement point ID.
> >
> > - @return performance timestamp.
> > + @return performance timestamp if current PerfIdx is valid,
> > + else return 0 as invalid performance timestamp
> > **/
> > UINT64
> > EFIAPI
> > @@ -395,9 +396,10 @@ SetFspMeasurePoint (
> > if (FspData->PerfIdx < sizeof (FspData->PerfData) / sizeof (FspData-
> >PerfData[0])) {
> > FspData->PerfData[FspData->PerfIdx] = AsmReadTsc ();
> > ((UINT8 *)(&FspData->PerfData[FspData->PerfIdx]))[7] = Id;
> > + return FspData->PerfData[(FspData->PerfIdx)++];
> > }
> >
> > - return FspData->PerfData[(FspData->PerfIdx)++];
> > + return (UINT64)0x0000000000000000;
>
> return 0;
>
> Works just as well. You also don't need a cast.
>
> https://godbolt.org/z/e5vvGcWWo
>
> --
> Pedro
>
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [edk2-devel] [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue
2023-05-30 3:28 ` Chiu, Chasel
@ 2023-05-30 3:35 ` Ranbir Singh
0 siblings, 0 replies; 6+ messages in thread
From: Ranbir Singh @ 2023-05-30 3:35 UTC (permalink / raw)
To: Chiu, Chasel
Cc: devel@edk2.groups.io, pedro.falcato@gmail.com,
Desimone, Nathaniel L, Zeng, Star, Ranbir Singh
[-- Attachment #1: Type: text/plain, Size: 3535 bytes --]
Yes Chasel - please do so while merging, thanks!
On Tue, May 30, 2023 at 8:58 AM Chiu, Chasel <chasel.chiu@intel.com> wrote:
>
> That’s good suggestion Pedro!
> Ranbir, would you like me to modify your patch to "return 0" during
> merging?
>
> Thanks,
> Chasel
>
>
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Pedro
> > Falcato
> > Sent: Friday, May 19, 2023 5:29 AM
> > To: devel@edk2.groups.io; rsingh@ventanamicro.com
> > Cc: Chiu, Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> > <nathaniel.l.desimone@intel.com>; Zeng, Star <star.zeng@intel.com>;
> Ranbir
> > Singh <Ranbir.Singh3@dell.com>
> > Subject: Re: [edk2-devel] [PATCH 1/1]
> IntelFsp2Pkg/Library/BaseFspCommonLib:
> > Fix OVERRUN Coverity issue
> >
> > On Thu, May 18, 2023 at 4:16 PM Ranbir Singh <rsingh@ventanamicro.com>
> > wrote:
> > >
> > > FspData->PerfIdx is getting increased for every call unconditionally
> > > in the function SetFspMeasurePoint and hence memory access can happen
> > > for out of bound FspData->PerfData[] array entries also.
> > >
> > > Example -
> > > FspData->PerfData is an array of 32 UINT64 entries. Assume a call
> > > is made to SetFspMeasurePoint function when the FspData->PerfIdx
> > > last value is 31. It gets incremented to 32 at line 400.
> > > Any subsequent call to SetFspMeasurePoint functions leads to
> > > FspData->PerfData[32] getting accessed which is out of the PerfData
> > > array as well as the FSP_GLOBAL_DATA structure boundary.
> > >
> > > Hence keep array access and index increment inside if block only and
> > > return invalid performance timestamp when PerfIdx is invalid.
> > >
> > > Cc: Chasel Chiu <chasel.chiu@intel.com>
> > > Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> > > Cc: Star Zeng <star.zeng@intel.com>
> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4200
> > > Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> > > Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> > > ---
> > > IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c | 6 ++++--
> > > 1 file changed, 4 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > > b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > > index a22b0e7825ad..cda2a7b2478e 100644
> > > --- a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > > +++ b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> > > @@ -377,7 +377,8 @@ GetFspSiliconInitUpdDataPointer (
> > >
> > > @param[in] Id Measurement point ID.
> > >
> > > - @return performance timestamp.
> > > + @return performance timestamp if current PerfIdx is valid,
> > > + else return 0 as invalid performance timestamp
> > > **/
> > > UINT64
> > > EFIAPI
> > > @@ -395,9 +396,10 @@ SetFspMeasurePoint (
> > > if (FspData->PerfIdx < sizeof (FspData->PerfData) / sizeof (FspData-
> > >PerfData[0])) {
> > > FspData->PerfData[FspData->PerfIdx] = AsmReadTsc
> ();
> > > ((UINT8 *)(&FspData->PerfData[FspData->PerfIdx]))[7] = Id;
> > > + return FspData->PerfData[(FspData->PerfIdx)++];
> > > }
> > >
> > > - return FspData->PerfData[(FspData->PerfIdx)++];
> > > + return (UINT64)0x0000000000000000;
> >
> > return 0;
> >
> > Works just as well. You also don't need a cast.
> >
> > https://godbolt.org/z/e5vvGcWWo
> >
> > --
> > Pedro
> >
> >
> >
> >
>
>
[-- Attachment #2: Type: text/html, Size: 5520 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue
2023-05-18 6:28 [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN Coverity issue Ranbir Singh
2023-05-18 19:55 ` Chiu, Chasel
2023-05-19 12:29 ` [edk2-devel] " Pedro Falcato
@ 2023-05-30 5:22 ` Chiu, Chasel
2 siblings, 0 replies; 6+ messages in thread
From: Chiu, Chasel @ 2023-05-30 5:22 UTC (permalink / raw)
To: Ranbir Singh, devel@edk2.groups.io
Cc: Desimone, Nathaniel L, Zeng, Star, Ranbir Singh, Pedro Falcato
Patch merged:
https://github.com/tianocore/edk2/commit/48c53994e649d51a388dc414944c9a9b717a1c3c
Thanks,
Chasel
> -----Original Message-----
> From: Ranbir Singh <rsingh@ventanamicro.com>
> Sent: Wednesday, May 17, 2023 11:29 PM
> To: devel@edk2.groups.io
> Cc: Chiu, Chasel <chasel.chiu@intel.com>; Desimone, Nathaniel L
> <nathaniel.l.desimone@intel.com>; Zeng, Star <star.zeng@intel.com>; Ranbir
> Singh <Ranbir.Singh3@Dell.com>
> Subject: [PATCH 1/1] IntelFsp2Pkg/Library/BaseFspCommonLib: Fix OVERRUN
> Coverity issue
>
> FspData->PerfIdx is getting increased for every call unconditionally
> in the function SetFspMeasurePoint and hence memory access can happen for
> out of bound FspData->PerfData[] array entries also.
>
> Example -
> FspData->PerfData is an array of 32 UINT64 entries. Assume a call
> is made to SetFspMeasurePoint function when the FspData->PerfIdx
> last value is 31. It gets incremented to 32 at line 400.
> Any subsequent call to SetFspMeasurePoint functions leads to
> FspData->PerfData[32] getting accessed which is out of the PerfData
> array as well as the FSP_GLOBAL_DATA structure boundary.
>
> Hence keep array access and index increment inside if block only and return
> invalid performance timestamp when PerfIdx is invalid.
>
> Cc: Chasel Chiu <chasel.chiu@intel.com>
> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4200
> Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> ---
> IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> index a22b0e7825ad..cda2a7b2478e 100644
> --- a/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> +++ b/IntelFsp2Pkg/Library/BaseFspCommonLib/FspCommonLib.c
> @@ -377,7 +377,8 @@ GetFspSiliconInitUpdDataPointer (
> @param[in] Id Measurement point ID. - @return performance
> timestamp.+ @return performance timestamp if current PerfIdx is valid,+
> else return 0 as invalid performance timestamp **/ UINT64 EFIAPI@@ -395,9
> +396,10 @@ SetFspMeasurePoint (
> if (FspData->PerfIdx < sizeof (FspData->PerfData) / sizeof (FspData-
> >PerfData[0])) { FspData->PerfData[FspData->PerfIdx] =
> AsmReadTsc (); ((UINT8 *)(&FspData->PerfData[FspData->PerfIdx]))[7] = Id;+
> return FspData->PerfData[(FspData->PerfIdx)++]; } - return FspData-
> >PerfData[(FspData->PerfIdx)++];+ return (UINT64)0x0000000000000000; }
> /**--
> 2.34.1
^ permalink raw reply [flat|nested] 6+ messages in thread