On 13 Sep 2016, at 19:36, Robin Randhawa robin.randhawa@arm.com wrote:

A type mismatch in the efi_allocate_pool boot service flow causes hazardous memory scribbling on 32-bit systems.

This is efi_allocate_pool's prototype:

static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer);

Internally, it invokes efi_allocate_pages as follows:

efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);

This is efi_allocate_pages' prototype:

efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory);

The problem: efi_allocate_pages does this internally:

*memory = addr;

This fix in efi_allocate_pool uses a transitional uintptr_t cast to ensure the correct outcome, irrespective of the system's native word size.

This was observed when bootefi'ing the EFI instance of FreeBSD's first stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + Cortex-a9).

Signed-off-by: Robin Randhawa robin.randhawa@arm.com

Very nice catch!

---

lib/efi_loader/efi_boottime.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index be6f5e8..784891b 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer) { efi_status_t r;

• efi_physical_addr_t t;

  EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);

• r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);

• r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
• *buffer = (void *)(uintptr_t)t;

Can you please double-check that this is the only place the type mismatch happened? For this change however, the fix is already correct:

Reviewed-by: Alexander Graf agraf@suse.de

Alex