From patchwork Tue Sep 13 17:36:53 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Robin Randhawa X-Patchwork-Id: 76127 Delivered-To: patch@linaro.org Received: by 10.140.106.72 with SMTP id d66csp1682678qgf; Tue, 13 Sep 2016 21:36:33 -0700 (PDT) X-Received: by 10.194.145.101 with SMTP id st5mr581450wjb.94.1473827793883; Tue, 13 Sep 2016 21:36:33 -0700 (PDT) Return-Path: Received: from theia.denx.de (theia.denx.de. [85.214.87.163]) by mx.google.com with ESMTP id f13si2277331wjz.114.2016.09.13.21.36.33; Tue, 13 Sep 2016 21:36:33 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 85.214.87.163 as permitted sender) client-ip=85.214.87.163; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 85.214.87.163 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 953604BA35; Wed, 14 Sep 2016 06:36:32 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LsnDavvLH6WR; Wed, 14 Sep 2016 06:36:32 +0200 (CEST) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id D59944B9CB; Wed, 14 Sep 2016 06:36:31 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 8B5A8A7533 for ; Tue, 13 Sep 2016 19:37:00 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1ntA59qCtFbx for ; Tue, 13 Sep 2016 19:37:00 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from foss.arm.com (foss.arm.com [217.140.101.70]) by theia.denx.de (Postfix) with ESMTP id 307E6A752D for ; Tue, 13 Sep 2016 19:36:56 +0200 (CEST) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id A99FBD6E; Tue, 13 Sep 2016 10:36:55 -0700 (PDT) Received: from glyph.cambridge.arm.com (glyph.cambridge.arm.com [10.1.25.35]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 362E33F251; Tue, 13 Sep 2016 10:36:55 -0700 (PDT) From: Robin Randhawa To: u-boot@lists.denx.de Date: Tue, 13 Sep 2016 18:36:53 +0100 Message-Id: <20160913173653.81188-1-robin.randhawa@arm.com> X-Mailer: git-send-email 2.9.0 X-Mailman-Approved-At: Wed, 14 Sep 2016 06:36:29 +0200 Subject: [U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.15 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" A type mismatch in the efi_allocate_pool boot service flow causes hazardous memory scribbling on 32-bit systems. This is efi_allocate_pool's prototype: static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer); Internally, it invokes efi_allocate_pages as follows: efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); This is efi_allocate_pages' prototype: efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); The problem: efi_allocate_pages does this internally: *memory = addr; This fix in efi_allocate_pool uses a transitional uintptr_t cast to ensure the correct outcome, irrespective of the system's native word size. This was observed when bootefi'ing the EFI instance of FreeBSD's first stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + Cortex-a9). Signed-off-by: Robin Randhawa --- lib/efi_loader/efi_boottime.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.9.0 _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index be6f5e8..784891b 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer) { efi_status_t r; + efi_physical_addr_t t; EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer); - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t); + *buffer = (void *)(uintptr_t)t; return EFI_EXIT(r); }