> On 13 Sep 2016, at 19:36, Robin Randhawa <[email protected]> wrote:
>
> A type mismatch in the efi_allocate_pool boot service flow causes
> hazardous memory scribbling on 32-bit systems.
>
> This is efi_allocate_pool's prototype:
>
> static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
> unsigned long size,
> void **buffer);
>
> Internally, it invokes efi_allocate_pages as follows:
>
> efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
> (void*)buffer);
>
> This is efi_allocate_pages' prototype:
>
> efi_status_t efi_allocate_pages(int type, int memory_type,
> unsigned long pages,
> uint64_t *memory);
>
> The problem: efi_allocate_pages does this internally:
>
> *memory = addr;
>
> This fix in efi_allocate_pool uses a transitional uintptr_t cast to
> ensure the correct outcome, irrespective of the system's native word
> size.
>
> This was observed when bootefi'ing the EFI instance of FreeBSD's first
> stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
> Cortex-a9).
>
> Signed-off-by: Robin Randhawa <[email protected]>
Very nice catch!
> ---
> lib/efi_loader/efi_boottime.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
> index be6f5e8..784891b 100644
> --- a/lib/efi_loader/efi_boottime.c
> +++ b/lib/efi_loader/efi_boottime.c
> @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int
> pool_type, unsigned long size,
> void **buffer)
> {
> efi_status_t r;
> + efi_physical_addr_t t;
>
> EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
> - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
> (void*)buffer);
> + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
> + *buffer = (void *)(uintptr_t)t;
Can you please double-check that this is the only place the type mismatch
happened? For this change however, the fix is already correct:
Reviewed-by: Alexander Graf <[email protected]>
Alex
_______________________________________________
U-Boot mailing list
[email protected]
http://lists.denx.de/mailman/listinfo/u-boot
