A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.
This is efi_allocate_pool's prototype:
static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
unsigned long size,
void **buffer);
Internally, it invokes efi_allocate_pages as follows:
efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
(void*)buffer);
This is efi_allocate_pages' prototype:
efi_status_t efi_allocate_pages(int type, int memory_type,
unsigned long pages,
uint64_t *memory);
The problem: efi_allocate_pages does this internally:
*memory = addr;
This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.
This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).
Signed-off-by: Robin Randhawa <robin.randh...@arm.com>
---
lib/efi_loader/efi_boottime.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index be6f5e8..784891b 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int
pool_type, unsigned long size,
void **buffer)
{
efi_status_t r;
+ efi_physical_addr_t t;
EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
- r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
(void*)buffer);
+ r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
+ *buffer = (void *)(uintptr_t)t;
return EFI_EXIT(r);
}
--
2.9.0
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot
