From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from hqnvemgate25.nvidia.com (hqnvemgate25.nvidia.com [216.228.121.64]) by mx.groups.io with SMTP id smtpd.web08.543.1603906515442843093 for ; Wed, 28 Oct 2020 10:35:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nvidia.com header.s=n1 header.b=kU4iRXie; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nvidia.com, ip: 216.228.121.64, mailfrom: jbrasen@nvidia.com) Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Wed, 28 Oct 2020 10:35:18 -0700 Received: from HQMAIL109.nvidia.com (172.20.187.15) by HQMAIL111.nvidia.com (172.20.187.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 28 Oct 2020 17:35:11 +0000 Received: from jbrasen-ux.nvidia.com (172.20.13.39) by mail.nvidia.com (172.20.187.15) with Microsoft SMTP Server id 15.0.1473.3 via Frontend Transport; Wed, 28 Oct 2020 17:35:11 +0000 From: "Jeff Brasen" To: CC: , , , Jeff Brasen Subject: [PATCH v3 1/1] MdeModulePkg/Gcd: Check memory allocation when initializing memory Date: Wed, 28 Oct 2020 11:35:02 -0600 Message-ID: X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-NVConfidentiality: public Return-Path: jbrasen@nvidia.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1603906518; bh=TOychD/TE0pDzzszL2bgsqeV9D8k2EuW7noov31ce4c=; h=From:To:CC:Subject:Date:Message-ID:X-Mailer:MIME-Version: X-NVConfidentiality:Content-Transfer-Encoding:Content-Type; b=kU4iRXieG9crVWVXWmdfTbBAmjFm0CkEHDn4897XyUp3t5yDGZFvUVQ39ppFEuvLb jZoVZt8KexYeSfZDsB4D2uKsuUKOTFjxhXIBC/otrFLaM15Wav93T7dBmtuxSBdhNo /thQyAAKvpjEVvek6Eg8SlGaY6WzoSw/2mkjbrqmwiuzFy+4XzGj9uo9HCRY0lLc7A w5ndW7QqphlHsmjpzkX56lATLJgRcEa60s/7WL7QieCb2R/8zNl5GwJWXZodvII8D3 uHkt3OqJNdJlQdS+r5+bLTmUTbiEPmIjrHg49sav6aDT3A41ppWXJqOE63Qt3bM/Xn bAZ3KZrYPLGSg== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain CoreInitializeMemoryServices was not checking for any existing memory allocation created in the HOB producer phase. If there are memory allocations outside of the region covered by the HOB List then Gcd could select that region for memory which can result in the memory allocation to not be handled and memory overwrites. Signed-off-by: Jeff Brasen --- MdeModulePkg/Core/Dxe/Gcd/Gcd.c | 58 +++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c b/MdeModulePkg/Core/Dxe/Gcd/Gc= d.c index 2d8c076f7113..51b082b7e7eb 100644 --- a/MdeModulePkg/Core/Dxe/Gcd/Gcd.c +++ b/MdeModulePkg/Core/Dxe/Gcd/Gcd.c @@ -2097,6 +2097,60 @@ CalculateTotalMemoryBinSizeNeeded ( return TotalSize; } =20 +/** + Find the largest region in the specified region that is not covered by = an existing memory allocation + + @param BaseAddress On input start of the region to check. + On output start of the largest free region. + @param Length On input size of region to check. + On output size of the largest free region. + @param MemoryHob Hob pointer for the first memory allocation pointe= r to check +**/ +VOID +FindLargestFreeRegion ( + IN OUT EFI_PHYSICAL_ADDRESS *BaseAddress, + IN OUT UINT64 *Length, + IN EFI_HOB_MEMORY_ALLOCATION *MemoryHob + ) +{ + EFI_PHYSICAL_ADDRESS TopAddress; + EFI_PHYSICAL_ADDRESS AllocatedTop; + EFI_PHYSICAL_ADDRESS LowerBase; + UINT64 LowerSize; + EFI_PHYSICAL_ADDRESS UpperBase; + UINT64 UpperSize; + + TopAddress =3D *BaseAddress + *Length; + while (MemoryHob !=3D NULL) { + AllocatedTop =3D MemoryHob->AllocDescriptor.MemoryBaseAddress + Memory= Hob->AllocDescriptor.MemoryLength; + + if ((MemoryHob->AllocDescriptor.MemoryBaseAddress >=3D *BaseAddress) &= & + (AllocatedTop <=3D TopAddress)) { + LowerBase =3D *BaseAddress; + LowerSize =3D MemoryHob->AllocDescriptor.MemoryBaseAddress - *BaseAd= dress; + UpperBase =3D AllocatedTop; + UpperSize =3D TopAddress - AllocatedTop; + + if (LowerSize !=3D 0) { + FindLargestFreeRegion (&LowerBase, &LowerSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + if (UpperSize !=3D 0) { + FindLargestFreeRegion (&UpperBase, &UpperSize, (EFI_HOB_MEMORY_ALL= OCATION *) GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB (Memory= Hob))); + } + + if (UpperSize >=3D LowerSize) { + *Length =3D UpperSize; + *BaseAddress =3D UpperBase; + } else { + *Length =3D LowerSize; + *BaseAddress =3D LowerBase; + } + return; + } + MemoryHob =3D GetNextHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, GET_NEXT_HOB= (MemoryHob)); + } +} + /** External function. Initializes memory services based on the memory descriptor HOBs. This function is responsible for priming the memory @@ -2235,6 +2289,7 @@ CoreInitializeMemoryServices ( Attributes =3D PhitResourceHob->ResourceAttribute; BaseAddress =3D PageAlignAddress (PhitHob->EfiMemoryTop); Length =3D PageAlignLength (ResourceHob->PhysicalStart + Resourc= eHob->ResourceLength - BaseAddress); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLOCATI= ON *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, then @@ -2242,6 +2297,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (PhitHob->EfiFreeMemoryBottom); Length =3D PageAlignLength (PhitHob->EfiFreeMemoryTop - BaseAd= dress); + //This region is required to have no memory allocation inside it, sk= ip check for entries in HOB List if (Length < MinimalMemorySizeNeeded) { // // If that range is not large enough to intialize the DXE Core, th= en @@ -2249,6 +2305,7 @@ CoreInitializeMemoryServices ( // BaseAddress =3D PageAlignAddress (ResourceHob->PhysicalStart); Length =3D PageAlignLength ((UINT64)((UINTN)*HobStart - Base= Address)); + FindLargestFreeRegion (&BaseAddress, &Length, (EFI_HOB_MEMORY_ALLO= CATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)); } } break; @@ -2312,6 +2369,7 @@ CoreInitializeMemoryServices ( // TestedMemoryBaseAddress =3D PageAlignAddress (ResourceHob->PhysicalS= tart); TestedMemoryLength =3D PageAlignLength (ResourceHob->PhysicalS= tart + ResourceHob->ResourceLength - TestedMemoryBaseAddress); + FindLargestFreeRegion (&TestedMemoryBaseAddress, &TestedMemoryLength= , (EFI_HOB_MEMORY_ALLOCATION *)GetFirstHob (EFI_HOB_TYPE_MEMORY_ALLOCATION)= ); if (TestedMemoryLength < MinimalMemorySizeNeeded) { continue; } --=20 2.25.1