Re: [edk2-devel] [patch v2 5/5] ShellPkg: Unload image on EFI_SECURITY_VIOLATION

["Philippe Mathieu-Daudé" <philmd@redhat.com>]

On 9/18/19 5:05 AM, Dandan Bi wrote:
> For the LoadImage() boot service, with EFI_SECURITY_VIOLATION retval,
> the Image was loaded and an ImageHandle was created with a valid
> EFI_LOADED_IMAGE_PROTOCOL, but the image can not be started right now.
> This follows UEFI Spec.
> 
> But if the caller of LoadImage() doesn't have the option to defer
> the execution of an image, we can not treat EFI_SECURITY_VIOLATION
> like any other LoadImage() error, we should unload image for the
> EFI_SECURITY_VIOLATION to avoid resource leak.
> 
> This patch is to do error handling for EFI_SECURITY_VIOLATION explicitly
> for the callers in ShellPkg which don't have the policy to defer the
> execution of the image.
> 
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Zhichao Gao <zhichao.gao@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1992
> Signed-off-by: Dandan Bi <dandan.bi@intel.com>
> Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
> ---
>  ShellPkg/Application/Shell/ShellManParser.c           |  9 +++++++++
>  .../Library/UefiShellDebug1CommandsLib/LoadPciRom.c   | 11 ++++++++++-
>  ShellPkg/Library/UefiShellLevel2CommandsLib/Load.c    | 11 ++++++++++-
>  3 files changed, 29 insertions(+), 2 deletions(-)
> 
> diff --git a/ShellPkg/Application/Shell/ShellManParser.c b/ShellPkg/Application/Shell/ShellManParser.c
> index 6909f29441..4d5a5668aa 100644
> --- a/ShellPkg/Application/Shell/ShellManParser.c
> +++ b/ShellPkg/Application/Shell/ShellManParser.c
> @@ -643,10 +643,19 @@ ProcessManFile(
>        goto Done;
>      }
>      DevPath = ShellInfoObject.NewEfiShellProtocol->GetDevicePathFromFilePath(CmdFilePathName);
>      Status      = gBS->LoadImage(FALSE, gImageHandle, DevPath, NULL, 0, &CmdFileImgHandle);
>      if(EFI_ERROR(Status)) {
> +      //
> +      // With EFI_SECURITY_VIOLATION retval, the Image was loaded and an ImageHandle was created
> +      // with a valid EFI_LOADED_IMAGE_PROTOCOL, but the image can not be started right now.
> +      // If the caller doesn't have the option to defer the execution of an image, we should
> +      // unload image for the EFI_SECURITY_VIOLATION to avoid the resource leak.
> +      //
> +      if (Status == EFI_SECURITY_VIOLATION) {
> +        gBS->UnloadImage (CmdFileImgHandle);
> +      }

OK

>        *HelpText = NULL;
>        goto Done;
>      }
>      Status = gBS->OpenProtocol(
>                      CmdFileImgHandle,
> diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/LoadPciRom.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/LoadPciRom.c
> index 1b169d0d3c..5b6cba17f3 100644
> --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/LoadPciRom.c
> +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/LoadPciRom.c
> @@ -1,10 +1,10 @@
>  /** @file
>    Main file for LoadPciRom shell Debug1 function.
>  
>    (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
> -  Copyright (c) 2005 - 2018, Intel Corporation. All rights reserved.<BR>
> +  Copyright (c) 2005 - 2019, Intel Corporation. All rights reserved.<BR>
>    SPDX-License-Identifier: BSD-2-Clause-Patent
>  
>  **/
>  
>  #include "UefiShellDebug1CommandsLib.h"
> @@ -332,10 +332,19 @@ LoadEfiDriversFromRomImage (
>                          ImageBuffer,
>                          ImageLength,
>                          &ImageHandle
>                         );
>            if (EFI_ERROR (Status)) {
> +            //
> +            // With EFI_SECURITY_VIOLATION retval, the Image was loaded and an ImageHandle was created
> +            // with a valid EFI_LOADED_IMAGE_PROTOCOL, but the image can not be started right now.
> +            // If the caller doesn't have the option to defer the execution of an image, we should
> +            // unload image for the EFI_SECURITY_VIOLATION to avoid resource leak.
> +            //
> +            if (Status == EFI_SECURITY_VIOLATION) {
> +              gBS->UnloadImage (ImageHandle);
> +            }

OK

>              ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_LOADPCIROM_LOAD_FAIL), gShellDebug1HiiHandle, L"loadpcirom", FileName, ImageIndex);
>  //            PrintToken (STRING_TOKEN (STR_LOADPCIROM_LOAD_IMAGE_ERROR), HiiHandle, ImageIndex, Status);
>            } else {
>              Status = gBS->StartImage (ImageHandle, NULL, NULL);
>              if (EFI_ERROR (Status)) {
> diff --git a/ShellPkg/Library/UefiShellLevel2CommandsLib/Load.c b/ShellPkg/Library/UefiShellLevel2CommandsLib/Load.c
> index 6a94b48c86..b6e7c952fa 100644
> --- a/ShellPkg/Library/UefiShellLevel2CommandsLib/Load.c
> +++ b/ShellPkg/Library/UefiShellLevel2CommandsLib/Load.c
> @@ -1,10 +1,10 @@
>  /** @file
>    Main file for attrib shell level 2 function.
>  
>    (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
> -  Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
> +  Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
>    SPDX-License-Identifier: BSD-2-Clause-Patent
>  
>  **/
>  
>  #include "UefiShellLevel2CommandsLib.h"
> @@ -110,10 +110,19 @@ LoadDriver(
>      NULL,
>      0,
>      &LoadedDriverHandle);
>  
>    if (EFI_ERROR(Status)) {
> +    //
> +    // With EFI_SECURITY_VIOLATION retval, the Image was loaded and an ImageHandle was created
> +    // with a valid EFI_LOADED_IMAGE_PROTOCOL, but the image can not be started right now.
> +    // If the caller doesn't have the option to defer the execution of an image, we should
> +    // unload image for the EFI_SECURITY_VIOLATION to avoid resource leak.
> +    //
> +    if (Status == EFI_SECURITY_VIOLATION) {
> +      gBS->UnloadImage (LoadedDriverHandle);
> +    }

OK.

Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>

>      ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN (STR_LOAD_NOT_IMAGE), gShellLevel2HiiHandle, FileName, Status);
>    } else {
>      //
>      // Make sure it is a driver image
>      //
>