From 5e5bb2a9baefcd2f231696ea94576dab5565fbfb Mon Sep 17 00:00:00 2001 From: lzeng14 Date: Tue, 7 May 2013 05:38:32 +0000 Subject: 1. Fix TOCTOU issue in VariableSmm, FtwSmm, FpdtSmm, SmmCorePerformance SMM handler. For VariableSmm, pre-allocate a mVariableBufferPayload buffer with mVariableBufferPayloadSize(match with mVariableBufferPayloadSize in VariableSmmRuntimeDxe) to hold communicate buffer payload to avoid TOCTOU issue. 2. Add check to ensure CommBufferPayloadSize not exceed mVariableBufferPayloadSize or is enough to hold function structure in VariableSmm and FtwSmm. 3. Align FtwGetLastWrite() in FaultTolerantWriteSmmDxe.c to FtwGetLastWrite() in FaultTolerantWrite.c. Signed-off-by: Star Zeng Reviewed-by: Jiewen Yao git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14325 6f19259b-4bc3-4df7-8a09-765794883524 --- .../FirmwarePerformanceSmm.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) (limited to 'MdeModulePkg/Universal/Acpi') diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c index ebf81ca6f7..f3472e26f3 100644 --- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c +++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c @@ -266,6 +266,8 @@ FpdtSmiHandler ( { EFI_STATUS Status; SMM_BOOT_RECORD_COMMUNICATE *SmmCommData; + UINTN BootRecordSize; + VOID *BootRecordData; // // If input is invalid, stop processing this SMI @@ -279,7 +281,7 @@ FpdtSmiHandler ( } if (!InternalIsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) { - DEBUG ((EFI_D_ERROR, "SMM communication data buffer in SMRAM or overflow!\n")); + DEBUG ((EFI_D_ERROR, "FpdtSmiHandler: SMM communication data buffer in SMRAM or overflow!\n")); return EFI_SUCCESS; } @@ -293,7 +295,9 @@ FpdtSmiHandler ( break; case SMM_FPDT_FUNCTION_GET_BOOT_RECORD_DATA : - if (SmmCommData->BootRecordData == NULL || SmmCommData->BootRecordSize < mBootRecordSize) { + BootRecordData = SmmCommData->BootRecordData; + BootRecordSize = SmmCommData->BootRecordSize; + if (BootRecordData == NULL || BootRecordSize < mBootRecordSize) { Status = EFI_INVALID_PARAMETER; break; } @@ -302,14 +306,14 @@ FpdtSmiHandler ( // Sanity check // SmmCommData->BootRecordSize = mBootRecordSize; - if (!InternalIsAddressValid ((UINTN)SmmCommData->BootRecordData, mBootRecordSize)) { - DEBUG ((EFI_D_ERROR, "SMM Data buffer in SMRAM or overflow!\n")); + if (!InternalIsAddressValid ((UINTN)BootRecordData, mBootRecordSize)) { + DEBUG ((EFI_D_ERROR, "FpdtSmiHandler: SMM Data buffer in SMRAM or overflow!\n")); Status = EFI_ACCESS_DENIED; break; } CopyMem ( - (UINT8*)SmmCommData->BootRecordData, + (UINT8*)BootRecordData, mBootRecordBuffer, mBootRecordSize ); -- cgit v1.2.3