Re: [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems

[Robin Randhawa]

Hi Alex.

On Wed 14 Sep 08:34:47 2016, Alexander Graf wrote:

[...]
 
> Very nice catch!

Thanks!

[...]
 
> Can you please double-check that this is the only place the type 
> mismatch happened? 

So I skimmed through the boot and run-time service API implementations 
and couldn't spot another instance of a mismatch. Ideally it would be 
neat to have an automated way to check for these things - maybe 
Coccinelle or something.

> For this change however, the fix is already correct:
> 
>   Reviewed-by: Alexander Graf 

Thanks,
Robin
___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot

Re: [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems

[Alexander Graf]

> On 13 Sep 2016, at 19:36, Robin Randhawa  wrote:
> 
> A type mismatch in the efi_allocate_pool boot service flow causes
> hazardous memory scribbling on 32-bit systems.
> 
> This is efi_allocate_pool's prototype:
> 
> static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
>   unsigned long size,
>   void **buffer);
> 
> Internally, it invokes efi_allocate_pages as follows:
> 
> efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
>   (void*)buffer);
> 
> This is efi_allocate_pages' prototype:
> 
> efi_status_t efi_allocate_pages(int type, int memory_type,
>   unsigned long pages,
>   uint64_t *memory);
> 
> The problem: efi_allocate_pages does this internally:
> 
>*memory = addr;
> 
> This fix in efi_allocate_pool uses a transitional uintptr_t cast to
> ensure the correct outcome, irrespective of the system's native word
> size.
> 
> This was observed when bootefi'ing the EFI instance of FreeBSD's first
> stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
> Cortex-a9).
> 
> Signed-off-by: Robin Randhawa 

Very nice catch!

> ---
> lib/efi_loader/efi_boottime.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
> index be6f5e8..784891b 100644
> --- a/lib/efi_loader/efi_boottime.c
> +++ b/lib/efi_loader/efi_boottime.c
> @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int 
> pool_type, unsigned long size,
>void **buffer)
> {
>   efi_status_t r;
> + efi_physical_addr_t t;
> 
>   EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
> - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, 
> (void*)buffer);
> + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, );
> + *buffer = (void *)(uintptr_t)t;

Can you please double-check that this is the only place the type mismatch 
happened? For this change however, the fix is already correct:

  Reviewed-by: Alexander Graf 


Alex

___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot

[U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems

[Robin Randhawa]

A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.

This is efi_allocate_pool's prototype:

static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
unsigned long size,
void **buffer);

Internally, it invokes efi_allocate_pages as follows:

efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
(void*)buffer);

This is efi_allocate_pages' prototype:

efi_status_t efi_allocate_pages(int type, int memory_type,
unsigned long pages,
uint64_t *memory);

The problem: efi_allocate_pages does this internally:

*memory = addr;

This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.

This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).

Signed-off-by: Robin Randhawa 
---
 lib/efi_loader/efi_boottime.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index be6f5e8..784891b 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int 
pool_type, unsigned long size,
 void **buffer)
 {
efi_status_t r;
+   efi_physical_addr_t t;
 
EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
-   r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, 
(void*)buffer);
+   r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, );
+   *buffer = (void *)(uintptr_t)t;
return EFI_EXIT(r);
 }
 
-- 
2.9.0

___
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot