From 842b1242d19225bb6d6146861d3418a5c9549175 Mon Sep 17 00:00:00 2001 From: "Yao, Jiewen" Date: Mon, 2 Feb 2015 14:42:22 +0000 Subject: Use SmmMemLib to check communication buffer. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: "Yao, Jiewen" Reviewed-by: "Gao, Liming" Reviewed-by: "Fan, Jeff" git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16694 6f19259b-4bc3-4df7-8a09-765794883524 --- .../Universal/LockBox/SmmLockBox/SmmLockBox.c | 93 ++-------------------- .../Universal/LockBox/SmmLockBox/SmmLockBox.inf | 3 +- 2 files changed, 9 insertions(+), 87 deletions(-) (limited to 'MdeModulePkg/Universal/LockBox/SmmLockBox') diff --git a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c index ad4b2645cb..dc8cc1df1c 100644 --- a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c +++ b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c @@ -9,7 +9,7 @@ SmmLockBoxHandler(), SmmLockBoxRestore(), SmmLockBoxUpdate(), SmmLockBoxSave() will receive untrusted input and do basic validation. -Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.
+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions @@ -30,7 +30,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #include #include #include +#include #include + #include #include #include @@ -39,63 +41,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. BOOLEAN mLocked = FALSE; -EFI_SMRAM_DESCRIPTOR *mSmramRanges; -UINTN mSmramRangeCount; - -/** - This function check if the address is in SMRAM. - - @param Buffer the buffer address to be checked. - @param Length the buffer length to be checked. - - @retval TRUE this address is in SMRAM. - @retval FALSE this address is NOT in SMRAM. -**/ -BOOLEAN -IsAddressInSmram ( - IN EFI_PHYSICAL_ADDRESS Buffer, - IN UINT64 Length - ) -{ - UINTN Index; - - for (Index = 0; Index < mSmramRangeCount; Index ++) { - if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) || - ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) { - return TRUE; - } - } - - return FALSE; -} - -/** - This function check if the address refered by Buffer and Length is valid. - - @param Buffer the buffer address to be checked. - @param Length the buffer length to be checked. - - @retval TRUE this address is valid. - @retval FALSE this address is NOT valid. -**/ -BOOLEAN -IsAddressValid ( - IN UINTN Buffer, - IN UINTN Length - ) -{ - if (Buffer > (MAX_ADDRESS - Length)) { - // - // Overflow happen - // - return FALSE; - } - if (IsAddressInSmram ((EFI_PHYSICAL_ADDRESS)Buffer, (UINT64)Length)) { - return FALSE; - } - return TRUE; -} - /** Dispatch function for SMM lock box save. @@ -127,7 +72,7 @@ SmmLockBoxSave ( // // Sanity check // - if (!IsAddressValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) { + if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) { DEBUG ((EFI_D_ERROR, "SmmLockBox Save address in SMRAM or buffer overflow!\n")); LockBoxParameterSave->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED; return ; @@ -211,7 +156,7 @@ SmmLockBoxUpdate ( // // Sanity check // - if (!IsAddressValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) { + if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) { DEBUG ((EFI_D_ERROR, "SmmLockBox Update address in SMRAM or buffer overflow!\n")); LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED; return ; @@ -252,7 +197,7 @@ SmmLockBoxRestore ( // // Sanity check // - if (!IsAddressValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) { + if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) { DEBUG ((EFI_D_ERROR, "SmmLockBox Restore address in SMRAM or buffer overflow!\n")); LockBoxParameterRestore->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED; return ; @@ -341,7 +286,7 @@ SmmLockBoxHandler ( DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size invalid!\n")); return EFI_SUCCESS; } - if (!IsAddressValid ((UINTN)CommBuffer, TempCommBufferSize)) { + if (!SmmIsBufferOutsideSmmValid ((UINTN)CommBuffer, TempCommBufferSize)) { DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer in SMRAM or overflow!\n")); return EFI_SUCCESS; } @@ -444,30 +389,6 @@ SmmLockBoxEntryPoint ( EFI_STATUS Status; EFI_HANDLE DispatchHandle; VOID *Registration; - EFI_SMM_ACCESS2_PROTOCOL *SmmAccess; - UINTN Size; - - // - // Get SMRAM information - // - Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess); - ASSERT_EFI_ERROR (Status); - - Size = 0; - Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL); - ASSERT (Status == EFI_BUFFER_TOO_SMALL); - - Status = gSmst->SmmAllocatePool ( - EfiRuntimeServicesData, - Size, - (VOID **)&mSmramRanges - ); - ASSERT_EFI_ERROR (Status); - - Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges); - ASSERT_EFI_ERROR (Status); - - mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR); // // Register LockBox communication handler diff --git a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf index 07c1b14d3e..aef6cd9065 100644 --- a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf +++ b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf @@ -6,7 +6,7 @@ # This external input must be validated carefully to avoid security issue like # buffer overflow, integer overflow. # -# Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.
+# Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.
# # This program and the accompanying materials # are licensed and made available under the terms and conditions @@ -50,6 +50,7 @@ BaseMemoryLib DebugLib LockBoxLib + SmmMemLib [Guids] gEfiSmmLockBoxCommunicationGuid ## PRODUCES ## GUID # SmiHandlerRegister -- cgit v1.2.3