sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MdeModulePkg/SmmCore: Fix hang due to already-freed memory deference

Browse Source 
SmiHandlerUnRegister() validates the DispatchHandle by checking
whether the first 32bit matches to a certain signature
(SMI_HANDLER_SIGNATURE).
But if a caller calls *UnRegister() twice and the memory freed by
first call still contains the signature, the second call may hang.

The patch fixes this issue by locating the DispatchHandle
in all SMI handlers, instead of checking the signature.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
(cherry picked from commit 8a641d2b73)
This commit is contained in:
Ruiyu Ni
2018-02-01 18:14:24 +08:00
parent 1de7f6464a
commit 5e69443e82
1 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
MdeModulePkg/Core/PiSmmCore/Smi.c
View File

@@ -1,7 +1,7 @@
/** @file
SMI management.
Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials are licensed and made available
under the terms and conditions of the BSD License which accompanies this
distribution. The full text of the license may be found at
@@ -276,14 +276,41 @@ SmiHandlerUnRegister (
{
SMI_HANDLER *SmiHandler;
SMI_ENTRY *SmiEntry;
LIST_ENTRY *EntryLink;
LIST_ENTRY *HandlerLink;
SmiHandler = (SMI_HANDLER *) DispatchHandle;
if (SmiHandler == NULL) {
if (DispatchHandle == NULL) {
return EFI_INVALID_PARAMETER;
}
if (SmiHandler->Signature != SMI_HANDLER_SIGNATURE) {
//
// Look for it in root SMI handlers
//
SmiHandler = NULL;
for ( HandlerLink = GetFirstNode (&mRootSmiEntry.SmiHandlers)
; !IsNull (&mRootSmiEntry.SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle)
; HandlerLink = GetNextNode (&mRootSmiEntry.SmiHandlers, HandlerLink)
) {
SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE);
}
//
// Look for it in non-root SMI handlers
//
for ( EntryLink = GetFirstNode (&mSmiEntryList)
; !IsNull (&mSmiEntryList, EntryLink) && (SmiHandler != DispatchHandle)
; EntryLink = GetNextNode (&mSmiEntryList, EntryLink)
) {
SmiEntry = CR (EntryLink, SMI_ENTRY, AllEntries, SMI_ENTRY_SIGNATURE);
for ( HandlerLink = GetFirstNode (&SmiEntry->SmiHandlers)
; !IsNull (&SmiEntry->SmiHandlers, HandlerLink) && (SmiHandler != DispatchHandle)
; HandlerLink = GetNextNode (&SmiEntry->SmiHandlers, HandlerLink)
) {
SmiHandler = CR (HandlerLink, SMI_HANDLER, Link, SMI_HANDLER_SIGNATURE);
}
}
if (SmiHandler != DispatchHandle) {
return EFI_INVALID_PARAMETER;
}