tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-28 08:04:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg NvmExpressDxe: Add check for command packet in PassThru

Browse Source 
This commit adds serveral checks for the 'Packet' parameter passed to the
EFI_NVM_EXPRESS_PASS_THRU_PROTOCOL.PassThru() API:

The check for the 'TransferLength' field in
EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET to make sure the value will not
exceed the maximum data transfer size allowed by a controller.

The check for the 'TransferBuffer' and 'TransferLength' fields in
EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET when the Opcode of an NVME
command indicates a data transfer between controller and host.

The check for the 'MetadataLength' field in
EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET to make sure the value is not 0
when the corresponding 'MetadataBuffer' field has a non-NULL value.

Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
This commit is contained in:
Hao Wu 2016-08-29 10:12:42 +08:00
parent 491f602629
commit b7f82a3a0f
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c
View File

@ -377,6 +377,7 @@ NvmExpressPassThru (
UINTN PrpListNo; UINTN PrpListNo;
UINT32 Attributes; UINT32 Attributes;
UINT32 IoAlign; UINT32 IoAlign;
UINT32 MaxTransLen;
UINT32 Data; UINT32 Data;
NVME_PASS_THRU_ASYNC_REQ *AsyncRequest; NVME_PASS_THRU_ASYNC_REQ *AsyncRequest;
EFI_TPL OldTpl; EFI_TPL OldTpl;
@ -420,6 +421,19 @@ NvmExpressPassThru (
} }
Private = NVME_CONTROLLER_PRIVATE_DATA_FROM_PASS_THRU (This); Private = NVME_CONTROLLER_PRIVATE_DATA_FROM_PASS_THRU (This);
//
// Check whether TransferLength exceeds the maximum data transfer size.
//
if (Private->ControllerData->Mdts != 0) {
MaxTransLen = (1 << (Private->ControllerData->Mdts)) *
(1 << (Private->Cap.Mpsmin + 12));
if (Packet->TransferLength > MaxTransLen) {
Packet->TransferLength = MaxTransLen;
return EFI_BAD_BUFFER_SIZE;
}
}
PciIo = Private->PciIo; PciIo = Private->PciIo;
MapData = NULL; MapData = NULL;
MapMeta = NULL; MapMeta = NULL;
@ -477,6 +491,10 @@ NvmExpressPassThru (
// processor and a PCI Bus Master. It's caller's responsbility to ensure this. // processor and a PCI Bus Master. It's caller's responsbility to ensure this.
// //
if (((Sq->Opc & (BIT0 | BIT1)) != 0) && (Sq->Opc != NVME_ADMIN_CRIOCQ_CMD) && (Sq->Opc != NVME_ADMIN_CRIOSQ_CMD)) { if (((Sq->Opc & (BIT0 | BIT1)) != 0) && (Sq->Opc != NVME_ADMIN_CRIOCQ_CMD) && (Sq->Opc != NVME_ADMIN_CRIOSQ_CMD)) {
if ((Packet->TransferLength == 0) || (Packet->TransferBuffer == NULL)) {
return EFI_INVALID_PARAMETER;
}
if ((Sq->Opc & BIT0) != 0) { if ((Sq->Opc & BIT0) != 0) {
Flag = EfiPciIoOperationBusMasterRead; Flag = EfiPciIoOperationBusMasterRead;
} else { } else {
@ -499,8 +517,7 @@ NvmExpressPassThru (
Sq->Prp[0] = PhyAddr; Sq->Prp[0] = PhyAddr;
Sq->Prp[1] = 0; Sq->Prp[1] = 0;
MapLength = Packet->MetadataLength; if((Packet->MetadataLength != 0) && (Packet->MetadataBuffer != NULL)) {
if(Packet->MetadataBuffer != NULL) {
MapLength = Packet->MetadataLength; MapLength = Packet->MetadataLength;
Status = PciIo->Map ( Status = PciIo->Map (
PciIo, PciIo,