From 2966b2fd97bad0d1ffe55b5d7b5585efbda2fc21 Mon Sep 17 00:00:00 2001 From: Patrick Rudolph Date: Wed, 6 May 2026 08:08:01 +0200 Subject: [PATCH] UefiPayloadPkg/UefiPayloadEntry: Fix use of uninitialized memory ParseSmbiosTable() wrote through its output pointer before validating the handoff HOB. When no SMBIOS table was present, UefiPayloadEntry still created the SMBIOS GUID HOB using uninitialized stack data. Change ParseSmbiosTable() to take a pointer to UINT64, validate inputs, and only build the SMBIOS table HOB after a successful parse. Signed-off-by: Patrick Rudolph --- UefiPayloadPkg/Include/Library/BlParseLib.h | 4 ++-- UefiPayloadPkg/Library/CbParseLib/CbParseLib.c | 10 +++++++--- UefiPayloadPkg/Library/SblParseLib/SblParseLib.c | 9 ++++++--- .../UefiPayloadEntry/UefiPayloadEntry.c | 16 +++++++++------- 4 files changed, 24 insertions(+), 15 deletions(-) diff --git a/UefiPayloadPkg/Include/Library/BlParseLib.h b/UefiPayloadPkg/Include/Library/BlParseLib.h index 365a0f34d8..b946ada855 100644 --- a/UefiPayloadPkg/Include/Library/BlParseLib.h +++ b/UefiPayloadPkg/Include/Library/BlParseLib.h @@ -68,7 +68,7 @@ ParseMemoryInfo ( /** Acquire SMBIOS table from bootloader. - @param SmbiosTable Pointer to the system table info + @param SmBiosEntryPoint Pointer to the SMBIOS structure. @retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_NOT_FOUND Failed to find the tables. @@ -77,7 +77,7 @@ ParseMemoryInfo ( RETURN_STATUS EFIAPI ParseSmbiosTable ( - OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable + OUT UINT64 *SmBiosEntryPoint ); /** diff --git a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c b/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c index 0f6d1d506f..9efd815759 100644 --- a/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c +++ b/UefiPayloadPkg/Library/CbParseLib/CbParseLib.c @@ -411,7 +411,7 @@ ParseMemoryInfo ( /** Acquire SMBIOS table from coreboot. - @param SmbiosTable Pointer to the SMBIOS table info. + @param SmBiosEntryPoint Pointer to the SMBIOS structure. @retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_NOT_FOUND Failed to find the tables. @@ -420,19 +420,23 @@ ParseMemoryInfo ( RETURN_STATUS EFIAPI ParseSmbiosTable ( - OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable + OUT UINT64 *SmBiosEntryPoint ) { EFI_STATUS Status; VOID *MemTable; UINT32 MemTableSize; + if (SmBiosEntryPoint == NULL) { + return RETURN_INVALID_PARAMETER; + } + Status = ParseCbMemTable (SIGNATURE_32 ('T', 'B', 'M', 'S'), &MemTable, &MemTableSize); if (EFI_ERROR (Status)) { return EFI_NOT_FOUND; } - SmbiosTable->SmBiosEntryPoint = (UINT64)(UINTN)MemTable; + *SmBiosEntryPoint = (UINT64)(UINTN)MemTable; return RETURN_SUCCESS; } diff --git a/UefiPayloadPkg/Library/SblParseLib/SblParseLib.c b/UefiPayloadPkg/Library/SblParseLib/SblParseLib.c index 7cc615a35e..669713f08f 100644 --- a/UefiPayloadPkg/Library/SblParseLib/SblParseLib.c +++ b/UefiPayloadPkg/Library/SblParseLib/SblParseLib.c @@ -113,7 +113,7 @@ ParseMemoryInfo ( /** Acquire SMBIOS table from slim bootloader. - @param SmbiosTable Pointer to the SMBIOS table info. + @param SmBiosEntryPoint Pointer to the SMBIOS structure. @retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_NOT_FOUND Failed to find the tables. @@ -122,18 +122,21 @@ ParseMemoryInfo ( RETURN_STATUS EFIAPI ParseSmbiosTable ( - OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable + OUT UINT64 *SmBiosEntryPoint ) { UNIVERSAL_PAYLOAD_SMBIOS_TABLE *TableInfo; + if (SmBiosEntryPoint == NULL) { + return RETURN_INVALID_PARAMETER; + } TableInfo = (UNIVERSAL_PAYLOAD_SMBIOS_TABLE *)GetGuidHobDataFromSbl (&gUniversalPayloadSmbiosTableGuid); if (TableInfo == NULL) { ASSERT (FALSE); return RETURN_NOT_FOUND; } - SmbiosTable->SmBiosEntryPoint = TableInfo->SmBiosEntryPoint; + *SmBiosEntryPoint = TableInfo->SmBiosEntryPoint; return RETURN_SUCCESS; } diff --git a/UefiPayloadPkg/UefiPayloadEntry/UefiPayloadEntry.c b/UefiPayloadPkg/UefiPayloadEntry/UefiPayloadEntry.c index 921ce7d716..bd9f4bfb0b 100644 --- a/UefiPayloadPkg/UefiPayloadEntry/UefiPayloadEntry.c +++ b/UefiPayloadPkg/UefiPayloadEntry/UefiPayloadEntry.c @@ -350,6 +350,7 @@ BuildHobFromBl ( EFI_PEI_GRAPHICS_DEVICE_INFO_HOB *NewGfxDeviceInfo; UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmBiosTableHob; UNIVERSAL_PAYLOAD_ACPI_TABLE *AcpiTableHob; + UINT64 SmBiosEntryPoint; // // First find TOLUD @@ -415,14 +416,15 @@ BuildHobFromBl ( // // Create SmBios table Hob // - SmBiosTableHob = BuildGuidHob (&gUniversalPayloadSmbiosTableGuid, sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE)); - ASSERT (SmBiosTableHob != NULL); - SmBiosTableHob->Header.Revision = UNIVERSAL_PAYLOAD_SMBIOS_TABLE_REVISION; - SmBiosTableHob->Header.Length = sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE); - DEBUG ((DEBUG_INFO, "Create smbios table gUniversalPayloadSmbiosTableGuid guid hob\n")); - Status = ParseSmbiosTable (SmBiosTableHob); + Status = ParseSmbiosTable (&SmBiosEntryPoint); if (!EFI_ERROR (Status)) { - DEBUG ((DEBUG_INFO, "Detected Smbios Table at 0x%lx\n", SmBiosTableHob->SmBiosEntryPoint)); + DEBUG ((DEBUG_INFO, "Detected Smbios Table at 0x%lx\n", SmBiosEntryPoint)); + SmBiosTableHob = BuildGuidHob (&gUniversalPayloadSmbiosTableGuid, sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE)); + ASSERT (SmBiosTableHob != NULL); + SmBiosTableHob->Header.Revision = UNIVERSAL_PAYLOAD_SMBIOS_TABLE_REVISION; + SmBiosTableHob->Header.Length = sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE); + SmBiosTableHob->SmBiosEntryPoint = SmBiosEntryPoint; + DEBUG ((DEBUG_INFO, "Create smbios table gUniversalPayloadSmbiosTableGuid guid hob\n")); } //