sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

smmstore: Verify userspace-provided pointer to protect SMM

Browse Source 
Use the introduced functions and verify pointers in the SMMSTORE.
Make sure to not overwrite or leak data from SMM and update the
documentation as well.

Change-Id: I70df08657c3fa0f98917742d8e1a6cb1077e3758
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Signed-off-by: Christian Walter <christian.walter@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/41085
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Patrick Rudolph
2020-05-06 10:57:01 +02:00
committed by Patrick Georgi
parent 41fec869fb
commit 2fdabd9038
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/drivers/smmstore/smi.c
View File

@@ -1,6 +1,8 @@
/* SPDX-License-Identifier: GPL-2.0-only */
#include <console/console.h>
#include <commonlib/region.h>
#include <cpu/x86/smm.h>
#include <smmstore.h>
#include <stddef.h>
#include <stdint.h>
@@ -10,13 +12,14 @@
*
* Legal means:
* - not pointing into SMRAM
* - ...?
*
* returns 0 on success, -1 on failure
*/
static int range_check(void *start, size_t size)
{
// TODO: fill in
if (smm_points_to_smram(start, size))
return -1;
return 0;
}
@@ -30,6 +33,9 @@ uint32_t smmstore_exec(uint8_t command, void *param)
printk(BIOS_DEBUG, "Reading from SMM store\n");
struct smmstore_params_read *params = param;
if (range_check(params, sizeof(*params)) != 0)
break;
if (range_check(params->buf, params->bufsize) != 0)
break;
@@ -42,6 +48,8 @@ uint32_t smmstore_exec(uint8_t command, void *param)
printk(BIOS_DEBUG, "Appending into SMM store\n");
struct smmstore_params_append *params = param;
if (range_check(params, sizeof(*params)) != 0)
break;
if (range_check(params->key, params->keysize) != 0)
break;
if (range_check(params->val, params->valsize) != 0)