tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-28 16:14:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg: PiSmmCore: Inspect memory guarded with pool headers

Browse Source 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3488

Current free pool routine from PiSmmCore will inspect memory guard status
for target buffer without considering pool headers. This could lead to
`IsMemoryGuarded` function to return incorrect results.

In that sense, allocating a 0 sized pool could cause an allocated buffer
directly points into a guard page, which is legal. However, trying to
free this pool will cause the routine changed in this commit to read XP
pages, which leads to page fault.

This change will inspect memory guarded with pool headers. This can avoid
errors when a pool content happens to be on a page boundary.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Ray Ni <ray.ni@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>

Signed-off-by: Kun Qin <kuqin12@gmail.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
This commit is contained in:
Kun Qin 2022-04-26 08:47:46 +08:00 committed by mergify[bot]
parent deee7a100b
commit 17702186b5
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
MdeModulePkg/Core/PiSmmCore/Pool.c
View File

@ -382,11 +382,6 @@ SmmInternalFreePool (
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
MemoryGuarded = IsHeapGuardEnabled () &&
IsMemoryGuarded ((EFI_PHYSICAL_ADDRESS)(UINTN)Buffer);
HasPoolTail = !(MemoryGuarded &&
((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) == 0));
FreePoolHdr = (FREE_POOL_HEADER *)((POOL_HEADER *)Buffer - 1); FreePoolHdr = (FREE_POOL_HEADER *)((POOL_HEADER *)Buffer - 1);
ASSERT (FreePoolHdr->Header.Signature == POOL_HEAD_SIGNATURE); ASSERT (FreePoolHdr->Header.Signature == POOL_HEAD_SIGNATURE);
ASSERT (!FreePoolHdr->Header.Available); ASSERT (!FreePoolHdr->Header.Available);
@ -394,6 +389,11 @@ SmmInternalFreePool (
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
MemoryGuarded = IsHeapGuardEnabled () &&
IsMemoryGuarded ((EFI_PHYSICAL_ADDRESS)(UINTN)FreePoolHdr);
HasPoolTail = !(MemoryGuarded &&
((PcdGet8 (PcdHeapGuardPropertyMask) & BIT7) == 0));
if (HasPoolTail) { if (HasPoolTail) {
PoolTail = HEAD_TO_TAIL (&FreePoolHdr->Header); PoolTail = HEAD_TO_TAIL (&FreePoolHdr->Header);
ASSERT (PoolTail->Signature == POOL_TAIL_SIGNATURE); ASSERT (PoolTail->Signature == POOL_TAIL_SIGNATURE);