External email: Use caution opening links or att= achments

FreePageTablesRecursive () traverses the page table tree depth first
to free all pages that it finds, without taking into account the
level at which it is operating.

Since TT_TYPE_TABLE_ENTRY aliases TT_TYPE_BLOCK_ENTRY_LEVEL3, we cannot distinguish table entries from block entries unless we take the level
= into account, and so we may be dereferencing garbage if we happen to
try and free a hierarchy of page tables that has level 3 pages in it.
=
Let's fix this by passing the level into FreePageTablesRecursive (),
and limit the recursion to levels < 3.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c | 18 ++= 3;+++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/ArmPkg/Li= brary/ArmMmuLib/AArch64/ArmMmuLibCore.c
index a43d468b73ca..d78918cf7ba8 100644
--- a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
+++ b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
@@ -142,15 +142,21 @@ ReplaceTableEntry (
STATIC
VOID
FreePageTablesRecursive (
- IN UINT64 *TranslationTable
+ IN UINT64 *TranslationTable,
+ IN UINTN   Level
   )
{
   UINTN   Index;

- for (Index =3D 0; Index < TT_ENTRY_COUNT; Index++) { -    if ((TranslationTable[Index] & TT_TYPE_MASK) =3D=3D= =20TT_TYPE_TABLE_ENTRY) {
-      FreePageTablesRecursive ((VOID *)(UINTN)(= TranslationTable[Index] &
-            =             &= nbsp;           &n= bsp;          TT_ADDRESS_MAS= K_BLOCK_ENTRY));
+ ASSERT (Level <=3D 3);
+
+ if (Level < 3) {
+    for (Index =3D 0; Index < TT_ENTRY_COUNT; Inde= x++) {
+      if ((TranslationTable[Index] & TT= _TYPE_MASK) =3D=3D TT_TYPE_TABLE_ENTRY) {
+        FreePageTablesRecursive (= (VOID *)(UINTN)(TranslationTable[Index] &
+           &n= bsp;           &nb= sp;           &nbs= p;            = ; TT_ADDRESS_MASK_BLOCK_ENTRY),
+           &n= bsp;           &nb= sp;         Level + 1);
+      }
     }
   }
   FreePages (TranslationTable, 1);
@@ -254,7 +260,7 @@ UpdateRegionMappingRecursive (
           // possible = for existing table entries, since we cannot revert the
           // modificat= ions we made to the subhierarchy it represents.)
           //
-          FreePageTablesRec= ursive (TranslationTable);
+          FreePageTable= sRecursive (TranslationTable, Level + 1);
         }
         return Status;
       }
--
2.17.1