diff options
| author | Ruiyu Ni <ruiyu.ni@intel.com> | 2017-07-05 18:45:56 +0800 |
|---|---|---|
| committer | Ruiyu Ni <ruiyu.ni@intel.com> | 2017-07-18 16:49:15 +0800 |
| commit | 5fc3889bb3c64f8cd81d7d387f829f146a1998fd (patch) | |
| tree | 23fe22e2a0b450a318f7fd23fee68d6dea3adac9 /MdeModulePkg/Core/Dxe/Hand | |
| parent | 357c48258e0b452d31f487a47dca486ba666a954 (diff) | |
| download | edk2-5fc3889bb3c64f8cd81d7d387f829f146a1998fd.zip edk2-5fc3889bb3c64f8cd81d7d387f829f146a1998fd.tar.gz edk2-5fc3889bb3c64f8cd81d7d387f829f146a1998fd.tar.bz2 | |
MdeModulePkg/DxeCore: Avoid accessing non-owned memory
The patch fixes two kinds of bugs in DxeCore that accesses memory
which might be freed or owned by other modules.
The two bugs don't cause functionality issue.
1. CoreValidateHandle() checks whether the handle is valid by
validating its signature. The proper way is to check whether
the handle is in the handle database.
2. CoreDisconnectControllersUsingProtocolInterface() and
CoreOpenProtocol() de-reference Link pointer which is
already freed. The proper way is to not de-reference the pointer.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Diffstat (limited to 'MdeModulePkg/Core/Dxe/Hand')
| -rw-r--r-- | MdeModulePkg/Core/Dxe/Hand/Handle.c | 54 |
1 files changed, 27 insertions, 27 deletions
diff --git a/MdeModulePkg/Core/Dxe/Hand/Handle.c b/MdeModulePkg/Core/Dxe/Hand/Handle.c index 59b8914..9b2809d 100644 --- a/MdeModulePkg/Core/Dxe/Hand/Handle.c +++ b/MdeModulePkg/Core/Dxe/Hand/Handle.c @@ -72,15 +72,20 @@ CoreValidateHandle ( )
{
IHANDLE *Handle;
+ LIST_ENTRY *Link;
- Handle = (IHANDLE *)UserHandle;
- if (Handle == NULL) {
+ if (UserHandle == NULL) {
return EFI_INVALID_PARAMETER;
}
- if (Handle->Signature != EFI_HANDLE_SIGNATURE) {
- return EFI_INVALID_PARAMETER;
+
+ for (Link = gHandleList.BackLink; Link != &gHandleList; Link = Link->BackLink) {
+ Handle = CR (Link, IHANDLE, AllHandles, EFI_HANDLE_SIGNATURE);
+ if (Handle == (IHANDLE *) UserHandle) {
+ return EFI_SUCCESS;
+ }
}
- return EFI_SUCCESS;
+
+ return EFI_INVALID_PARAMETER;
}
@@ -643,19 +648,16 @@ CoreDisconnectControllersUsingProtocolInterface ( //
do {
ItemFound = FALSE;
- for ( Link = Prot->OpenList.ForwardLink;
- (Link != &Prot->OpenList) && !ItemFound;
- Link = Link->ForwardLink ) {
+ for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {
OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {
- ItemFound = TRUE;
CoreReleaseProtocolLock ();
Status = CoreDisconnectController (UserHandle, OpenData->AgentHandle, NULL);
CoreAcquireProtocolLock ();
- if (EFI_ERROR (Status)) {
- ItemFound = FALSE;
- break;
+ if (!EFI_ERROR (Status)) {
+ ItemFound = TRUE;
}
+ break;
}
}
} while (ItemFound);
@@ -664,21 +666,17 @@ CoreDisconnectControllersUsingProtocolInterface ( //
// Attempt to remove BY_HANDLE_PROTOOCL and GET_PROTOCOL and TEST_PROTOCOL Open List items
//
- do {
- ItemFound = FALSE;
- for ( Link = Prot->OpenList.ForwardLink;
- (Link != &Prot->OpenList) && !ItemFound;
- Link = Link->ForwardLink ) {
- OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
- if ((OpenData->Attributes &
- (EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL | EFI_OPEN_PROTOCOL_GET_PROTOCOL | EFI_OPEN_PROTOCOL_TEST_PROTOCOL)) != 0) {
- ItemFound = TRUE;
- RemoveEntryList (&OpenData->Link);
- Prot->OpenListCount--;
- CoreFreePool (OpenData);
- }
+ for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList;) {
+ OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
+ if ((OpenData->Attributes &
+ (EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL | EFI_OPEN_PROTOCOL_GET_PROTOCOL | EFI_OPEN_PROTOCOL_TEST_PROTOCOL)) != 0) {
+ Link = RemoveEntryList (&OpenData->Link);
+ Prot->OpenListCount--;
+ CoreFreePool (OpenData);
+ } else {
+ Link = Link->ForwardLink;
}
- } while (ItemFound);
+ }
}
//
@@ -1132,7 +1130,7 @@ CoreOpenProtocol ( if (ByDriver) {
do {
Disconnect = FALSE;
- for ( Link = Prot->OpenList.ForwardLink; (Link != &Prot->OpenList) && (!Disconnect); Link = Link->ForwardLink) {
+ for (Link = Prot->OpenList.ForwardLink; Link != &Prot->OpenList; Link = Link->ForwardLink) {
OpenData = CR (Link, OPEN_PROTOCOL_DATA, Link, OPEN_PROTOCOL_DATA_SIGNATURE);
if ((OpenData->Attributes & EFI_OPEN_PROTOCOL_BY_DRIVER) != 0) {
Disconnect = TRUE;
@@ -1142,6 +1140,8 @@ CoreOpenProtocol ( if (EFI_ERROR (Status)) {
Status = EFI_ACCESS_DENIED;
goto Done;
+ } else {
+ break;
}
}
}
|