Use SmmMemLib to check communication buffer.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Gao, Liming" <liming.gao@intel.com>
Reviewed-by: "Fan, Jeff" <jeff.fan@intel.com>


git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16694 6f19259b-4bc3-4df7-8a09-765794883524

2 files changed, 9 insertions, 87 deletions

diff --git a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c
index ad4b2645cb..dc8cc1df1c 100644
--- a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c
+++ b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.c
@@ -9,7 +9,7 @@
   SmmLockBoxHandler(), SmmLockBoxRestore(), SmmLockBoxUpdate(), SmmLockBoxSave()

   will receive untrusted input and do basic validation.

 

-Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>

 

 This program and the accompanying materials

 are licensed and made available under the terms and conditions

@@ -30,7 +30,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #include <Library/BaseLib.h>

 #include <Library/BaseMemoryLib.h>

 #include <Library/DebugLib.h>

+#include <Library/SmmMemLib.h>

 #include <Library/LockBoxLib.h>

+

 #include <Protocol/SmmReadyToLock.h>

 #include <Protocol/SmmCommunication.h>

 #include <Protocol/SmmAccess2.h>

@@ -39,63 +41,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 

 BOOLEAN              mLocked = FALSE;

 

-EFI_SMRAM_DESCRIPTOR *mSmramRanges;

-UINTN                mSmramRangeCount;

-

-/**

-  This function check if the address is in SMRAM.

-

-  @param Buffer  the buffer address to be checked.

-  @param Length  the buffer length to be checked.

-

-  @retval TRUE  this address is in SMRAM.

-  @retval FALSE this address is NOT in SMRAM.

-**/

-BOOLEAN

-IsAddressInSmram (

-  IN EFI_PHYSICAL_ADDRESS  Buffer,

-  IN UINT64                Length

-  )

-{

-  UINTN  Index;

-

-  for (Index = 0; Index < mSmramRangeCount; Index ++) {

-    if (((Buffer >= mSmramRanges[Index].CpuStart) && (Buffer < mSmramRanges[Index].CpuStart + mSmramRanges[Index].PhysicalSize)) ||

-        ((mSmramRanges[Index].CpuStart >= Buffer) && (mSmramRanges[Index].CpuStart < Buffer + Length))) {

-      return TRUE;

-    }

-  }

-

-  return FALSE;

-}

-

-/**

-  This function check if the address refered by Buffer and Length is valid.

-

-  @param Buffer  the buffer address to be checked.

-  @param Length  the buffer length to be checked.

-

-  @retval TRUE  this address is valid.

-  @retval FALSE this address is NOT valid.

-**/

-BOOLEAN

-IsAddressValid (

-  IN UINTN                 Buffer,

-  IN UINTN                 Length

-  )

-{

-  if (Buffer > (MAX_ADDRESS - Length)) {

-    //

-    // Overflow happen

-    //

-    return FALSE;

-  }

-  if (IsAddressInSmram ((EFI_PHYSICAL_ADDRESS)Buffer, (UINT64)Length)) {

-    return FALSE;

-  }

-  return TRUE;

-}

-

 /**

   Dispatch function for SMM lock box save.

 

@@ -127,7 +72,7 @@ SmmLockBoxSave (
   //

   // Sanity check

   //

-  if (!IsAddressValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) {

+  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterSave.Buffer, (UINTN)TempLockBoxParameterSave.Length)) {

     DEBUG ((EFI_D_ERROR, "SmmLockBox Save address in SMRAM or buffer overflow!\n"));

     LockBoxParameterSave->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;

     return ;

@@ -211,7 +156,7 @@ SmmLockBoxUpdate (
   //

   // Sanity check

   //

-  if (!IsAddressValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) {

+  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterUpdate.Buffer, (UINTN)TempLockBoxParameterUpdate.Length)) {

     DEBUG ((EFI_D_ERROR, "SmmLockBox Update address in SMRAM or buffer overflow!\n"));

     LockBoxParameterUpdate->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;

     return ;

@@ -252,7 +197,7 @@ SmmLockBoxRestore (
   //

   // Sanity check

   //

-  if (!IsAddressValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) {

+  if (!SmmIsBufferOutsideSmmValid ((UINTN)TempLockBoxParameterRestore.Buffer, (UINTN)TempLockBoxParameterRestore.Length)) {

     DEBUG ((EFI_D_ERROR, "SmmLockBox Restore address in SMRAM or buffer overflow!\n"));

     LockBoxParameterRestore->Header.ReturnStatus = (UINT64)EFI_ACCESS_DENIED;

     return ;

@@ -341,7 +286,7 @@ SmmLockBoxHandler (
     DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer Size invalid!\n"));

     return EFI_SUCCESS;

   }

-  if (!IsAddressValid ((UINTN)CommBuffer, TempCommBufferSize)) {

+  if (!SmmIsBufferOutsideSmmValid ((UINTN)CommBuffer, TempCommBufferSize)) {

     DEBUG ((EFI_D_ERROR, "SmmLockBox Command Buffer in SMRAM or overflow!\n"));

     return EFI_SUCCESS;

   }

@@ -444,30 +389,6 @@ SmmLockBoxEntryPoint (
   EFI_STATUS                    Status;

   EFI_HANDLE                    DispatchHandle;

   VOID                          *Registration;

-  EFI_SMM_ACCESS2_PROTOCOL      *SmmAccess;

-  UINTN                         Size;

-

-  //

-  // Get SMRAM information

-  //

-  Status = gBS->LocateProtocol (&gEfiSmmAccess2ProtocolGuid, NULL, (VOID **)&SmmAccess);

-  ASSERT_EFI_ERROR (Status);

-

-  Size = 0;

-  Status = SmmAccess->GetCapabilities (SmmAccess, &Size, NULL);

-  ASSERT (Status == EFI_BUFFER_TOO_SMALL);

-

-  Status = gSmst->SmmAllocatePool (

-                    EfiRuntimeServicesData,

-                    Size,

-                    (VOID **)&mSmramRanges

-                    );

-  ASSERT_EFI_ERROR (Status);

-

-  Status = SmmAccess->GetCapabilities (SmmAccess, &Size, mSmramRanges);

-  ASSERT_EFI_ERROR (Status);

-

-  mSmramRangeCount = Size / sizeof (EFI_SMRAM_DESCRIPTOR);

 

   //

   // Register LockBox communication handler

diff --git a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf
index 07c1b14d3e..aef6cd9065 100644
--- a/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf
+++ b/MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf
@@ -6,7 +6,7 @@
 #  This external input must be validated carefully to avoid security issue like

 #  buffer overflow, integer overflow.

 #

-#  Copyright (c) 2010 - 2014, Intel Corporation. All rights reserved.<BR>

+#  Copyright (c) 2010 - 2015, Intel Corporation. All rights reserved.<BR>

 #

 #  This program and the accompanying materials

 #  are licensed and made available under the terms and conditions

@@ -50,6 +50,7 @@
   BaseMemoryLib

   DebugLib

   LockBoxLib

+  SmmMemLib

 

 [Guids]

   gEfiSmmLockBoxCommunicationGuid   ## PRODUCES ## GUID # SmiHandlerRegister