From: "Gerd Hoffmann" <kraxel@redhat.com>
To: devel@edk2.groups.io, Ard Biesheuvel <ardb@kernel.org>
Subject: heap/page guard broken on aarch64
Date: Wed, 12 Jul 2023 10:41:28 +0200 [thread overview]
Message-ID: <uohzj3bb2n2fhmojdol5p4v2mfslvavr3ntjufe3ll26h5xn5y@baa37hrbeccr> (raw)
Hi,
Tried to debug a bug which looks like memory corruption, turned on page
and heap guard:
PcdHeapGuardPageType=0x7e
PcdHeapGuardPoolType=0x7e
PcdHeapGuardPropertyMask=0x03
With that the firmware crashes due to a page fault.
Stack trace (with PCs manually mapped to functions):
PC 0x000047730268 (0x000047711000+0x0001F268) [ 0] DxeCore.dll -> InternalMemSetMem
PC 0x00004771F4EC (0x000047711000+0x0000E4EC) [ 0] DxeCore.dll -> CoreConvertPagesEx
PC 0x00004771FED4 (0x000047711000+0x0000EED4) [ 0] DxeCore.dll -> CoreFreePoolPagesI
PC 0x000047721368 (0x000047711000+0x00010368) [ 0] DxeCore.dll -> CoreFreePoolI
PC 0x000047721564 (0x000047711000+0x00010564) [ 0] DxeCore.dll -> CoreInternalFreePool
PC 0x00004772160C (0x000047711000+0x0001060C) [ 0] DxeCore.dll -> CoreFreePool
PC 0x00007C574338 (0x00007C560000+0x00014338) [ 1] VariableRuntimeDxe.dll -> FreePool
PC 0x00007C574F8C (0x00007C560000+0x00014F8C) [ 1] VariableRuntimeDxe.dll -> ReallocateRuntimePool
PC 0x00007C574FE0 (0x00007C560000+0x00014FE0) [ 1] VariableRuntimeDxe.dll -> VarCheckAddTableEntry
PC 0x00007C575FF0 (0x00007C560000+0x00015FF0) [ 1] VariableRuntimeDxe.dll -> VarCheckLibVariablePropertySet
PC 0x00007C5760B8 (0x00007C560000+0x000160B8) [ 1] VariableRuntimeDxe.dll -> VarCheckUefiLibNullClassConstructor
PC 0x00007C578828 (0x00007C560000+0x00018828) [ 1] VariableRuntimeDxe.dll -> _ModuleEntryPoint
PC 0x000047718788 (0x000047711000+0x00007788) [ 2] DxeCore.dll -> CoreStartImage
PC 0x000047725CC8 (0x000047711000+0x00014CC8) [ 2] DxeCore.dll -> CoreDispatcher
PC 0x00004771BFF0 (0x000047711000+0x0000AFF0) [ 2] DxeCore.dll -> _ModuleEntryPoint
Some debug logging added shows that the faulting address is right after
the memory block which gets freed, looks like the code tries to clear
the guard page ...
edk2-stable202305 is broken.
edk2-stable202302 works.
Trying to bisect did not work due to another bug.
take care,
Gerd
next reply other threads:[~2023-07-12 8:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-12 8:41 Gerd Hoffmann [this message]
2023-07-12 12:03 ` heap/page guard broken on aarch64 Ard Biesheuvel
2023-07-12 13:26 ` Gerd Hoffmann
2023-07-12 21:20 ` [edk2-devel] " Oliver Smith-Denny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=uohzj3bb2n2fhmojdol5p4v2mfslvavr3ntjufe3ll26h5xn5y@baa37hrbeccr \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox