I will wait for Ard's feedback. It's an ARM specific module.
Thanks/Ray
-----Original Message----- From: Zeng, Star Sent: Monday, October 30, 2017 6:07 PM To: Ni, Ruiyu ruiyu.ni@intel.com; Heyi Guo heyi.guo@linaro.org; linaro- uefi@lists.linaro.org; edk2-devel@lists.01.org Cc: Dong, Eric eric.dong@intel.com; Ard Biesheuvel ard.biesheuvel@linaro.org; Zeng, Star star.zeng@intel.com Subject: RE: [edk2][PATCH] MdeModulePkg/NonDiscoverable: fix memory override bug
Ray, Please help take a review to this patch.
Thanks, Star -----Original Message----- From: Heyi Guo [mailto:heyi.guo@linaro.org] Sent: Monday, October 30, 2017 1:48 PM To: linaro-uefi@lists.linaro.org; edk2-devel@lists.01.org Cc: Heyi Guo heyi.guo@linaro.org; Zeng, Star star.zeng@intel.com; Dong, Eric eric.dong@intel.com; Ard Biesheuvel ard.biesheuvel@linaro.org; Ni, Ruiyu ruiyu.ni@intel.com Subject: [edk2][PATCH] MdeModulePkg/NonDiscoverable: fix memory override bug
For PciIoPciRead interface, memory prior to Buffer would be written with zeros if Offset was larger than sizeof (Dev->ConfigSpace), which would cause serious system exception.
So we add a pre-check branch to avoid memory override.
Cc: Star Zeng star.zeng@intel.com Cc: Eric Dong eric.dong@intel.com Cc: Ard Biesheuvel ard.biesheuvel@linaro.org Cc: Ruiyu Ni ruiyu.ni@intel.com Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Heyi Guo heyi.guo@linaro.org
.../Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverablePciDeviceIo.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverable PciDeviceIo.c b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverable PciDeviceIo.c index c836ad6..0e42ae4 100644
a/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverable PciDeviceIo.c +++ b/MdeModulePkg/Bus/Pci/NonDiscoverablePciDeviceDxe/NonDiscoverable Pc +++ iDeviceIo.c @@ -465,6 +465,11 @@ PciIoPciRead ( Address = (UINT8 *)&Dev->ConfigSpace + Offset; Length = Count << ((UINTN)Width & 0x3);
- if (Offset >= sizeof (Dev->ConfigSpace)) {
- ZeroMem (Buffer, Length);
- return EFI_SUCCESS;
- }
- if (Offset + Length > sizeof (Dev->ConfigSpace)) { // // Read all zeroes for config space accesses beyond the first
-- 1.9.1