File 0018-efi_loader-Fix-crash-on-32-bit-syst.patch of Package u-boot-rpi2

Overview Repositories Revisions Requests Users Attributes Meta

File 0018-efi_loader-Fix-crash-on-32-bit-syst.patch of Package u-boot-rpi2

From 26a4e5caf8a7ce95ac19c6876f2aaf0ecf5c1ed4 Mon Sep 17 00:00:00 2001
From: Robin Randhawa <robin.randhawa@arm.com>
Date: Tue, 13 Sep 2016 18:36:53 +0100
Subject: [PATCH] efi_loader: Fix crash on 32-bit systems

A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.

This is efi_allocate_pool's prototype:

static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
						    unsigned long size,
						    void **buffer);

Internally, it invokes efi_allocate_pages as follows:

efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
					    (void*)buffer);

This is efi_allocate_pages' prototype:

efi_status_t efi_allocate_pages(int type, int memory_type,
					unsigned long pages,
					uint64_t *memory);

The problem: efi_allocate_pages does this internally:

*memory = addr;

This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.

This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).

Signed-off-by: Robin Randhawa <robin.randhawa@arm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
---
 lib/efi_loader/efi_boottime.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index 4d0e077..63f6b09 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size,
 					     void **buffer)
 {
 	efi_status_t r;
+	efi_physical_addr_t t;
 
 	EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
-	r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);
+	r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
+	*buffer = (void *)(uintptr_t)t;
 	return EFI_EXIT(r);
 }

Places

File 0018-efi_loader-Fix-crash-on-32-bit-syst.patch of Package u-boot-rpi2

Places