uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

UefiPayloadPkg/UefiPayloadEntry: Fix use of uninitialized memory

Browse source 
ParseSmbiosTable() wrote through its output pointer before validating the
handoff HOB. When no SMBIOS table was present, UefiPayloadEntry still
created the SMBIOS GUID HOB using uninitialized stack data.

Change ParseSmbiosTable() to take a pointer to UINT64, validate inputs,
and only build the SMBIOS table HOB after a successful parse.

Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
This commit is contained in:
Patrick Rudolph 2026-05-06 08:08:01 +02:00 • committed by Matt DeVillier
parent d98a39d4ce
commit 2966b2fd97
4 changed files with 24 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

4
UefiPayloadPkg/Include/Library/BlParseLib.h
View file

@ -68,7 +68,7 @@ ParseMemoryInfo (
/** /**
Acquire SMBIOS table from bootloader. Acquire SMBIOS table from bootloader.
@param SmbiosTable Pointer to the system table info @param SmBiosEntryPoint Pointer to the SMBIOS structure.
@retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_SUCCESS Successfully find out the tables.
@retval RETURN_NOT_FOUND Failed to find the tables. @retval RETURN_NOT_FOUND Failed to find the tables.
@ -77,7 +77,7 @@ ParseMemoryInfo (
RETURN_STATUS RETURN_STATUS
EFIAPI EFIAPI
ParseSmbiosTable ( ParseSmbiosTable (
OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable OUT UINT64 *SmBiosEntryPoint
); );
/** /**

10
UefiPayloadPkg/Library/CbParseLib/CbParseLib.c
View file

@ -411,7 +411,7 @@ ParseMemoryInfo (
/** /**
Acquire SMBIOS table from coreboot. Acquire SMBIOS table from coreboot.
@param SmbiosTable Pointer to the SMBIOS table info. @param SmBiosEntryPoint Pointer to the SMBIOS structure.
@retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_SUCCESS Successfully find out the tables.
@retval RETURN_NOT_FOUND Failed to find the tables. @retval RETURN_NOT_FOUND Failed to find the tables.
@ -420,19 +420,23 @@ ParseMemoryInfo (
RETURN_STATUS RETURN_STATUS
EFIAPI EFIAPI
ParseSmbiosTable ( ParseSmbiosTable (
OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable OUT UINT64 *SmBiosEntryPoint
) )
{ {
EFI_STATUS Status; EFI_STATUS Status;
VOID *MemTable; VOID *MemTable;
UINT32 MemTableSize; UINT32 MemTableSize;
if (SmBiosEntryPoint == NULL) {
return RETURN_INVALID_PARAMETER;
}
Status = ParseCbMemTable (SIGNATURE_32 ('T', 'B', 'M', 'S'), &MemTable, &MemTableSize); Status = ParseCbMemTable (SIGNATURE_32 ('T', 'B', 'M', 'S'), &MemTable, &MemTableSize);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return EFI_NOT_FOUND; return EFI_NOT_FOUND;
} }
SmbiosTable->SmBiosEntryPoint = (UINT64)(UINTN)MemTable; *SmBiosEntryPoint = (UINT64)(UINTN)MemTable;
return RETURN_SUCCESS; return RETURN_SUCCESS;
} }

9
UefiPayloadPkg/Library/SblParseLib/SblParseLib.c
View file

@ -113,7 +113,7 @@ ParseMemoryInfo (
/** /**
Acquire SMBIOS table from slim bootloader. Acquire SMBIOS table from slim bootloader.
@param SmbiosTable Pointer to the SMBIOS table info. @param SmBiosEntryPoint Pointer to the SMBIOS structure.
@retval RETURN_SUCCESS Successfully find out the tables. @retval RETURN_SUCCESS Successfully find out the tables.
@retval RETURN_NOT_FOUND Failed to find the tables. @retval RETURN_NOT_FOUND Failed to find the tables.
@ -122,18 +122,21 @@ ParseMemoryInfo (
RETURN_STATUS RETURN_STATUS
EFIAPI EFIAPI
ParseSmbiosTable ( ParseSmbiosTable (
OUT UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmbiosTable OUT UINT64 *SmBiosEntryPoint
) )
{ {
UNIVERSAL_PAYLOAD_SMBIOS_TABLE *TableInfo; UNIVERSAL_PAYLOAD_SMBIOS_TABLE *TableInfo;
if (SmBiosEntryPoint == NULL) {
return RETURN_INVALID_PARAMETER;
}
TableInfo = (UNIVERSAL_PAYLOAD_SMBIOS_TABLE *)GetGuidHobDataFromSbl (&gUniversalPayloadSmbiosTableGuid); TableInfo = (UNIVERSAL_PAYLOAD_SMBIOS_TABLE *)GetGuidHobDataFromSbl (&gUniversalPayloadSmbiosTableGuid);
if (TableInfo == NULL) { if (TableInfo == NULL) {
ASSERT (FALSE); ASSERT (FALSE);
return RETURN_NOT_FOUND; return RETURN_NOT_FOUND;
} }
SmbiosTable->SmBiosEntryPoint = TableInfo->SmBiosEntryPoint; *SmBiosEntryPoint = TableInfo->SmBiosEntryPoint;
return RETURN_SUCCESS; return RETURN_SUCCESS;
} }

16
UefiPayloadPkg/UefiPayloadEntry/UefiPayloadEntry.c
View file

@ -350,6 +350,7 @@ BuildHobFromBl (
EFI_PEI_GRAPHICS_DEVICE_INFO_HOB *NewGfxDeviceInfo; EFI_PEI_GRAPHICS_DEVICE_INFO_HOB *NewGfxDeviceInfo;
UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmBiosTableHob; UNIVERSAL_PAYLOAD_SMBIOS_TABLE *SmBiosTableHob;
UNIVERSAL_PAYLOAD_ACPI_TABLE *AcpiTableHob; UNIVERSAL_PAYLOAD_ACPI_TABLE *AcpiTableHob;
UINT64 SmBiosEntryPoint;
// //
// First find TOLUD // First find TOLUD
@ -415,14 +416,15 @@ BuildHobFromBl (
// //
// Create SmBios table Hob // Create SmBios table Hob
// //
SmBiosTableHob = BuildGuidHob (&gUniversalPayloadSmbiosTableGuid, sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE)); Status = ParseSmbiosTable (&SmBiosEntryPoint);
ASSERT (SmBiosTableHob != NULL);
SmBiosTableHob->Header.Revision = UNIVERSAL_PAYLOAD_SMBIOS_TABLE_REVISION;
SmBiosTableHob->Header.Length = sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE);
DEBUG ((DEBUG_INFO, "Create smbios table gUniversalPayloadSmbiosTableGuid guid hob\n"));
Status = ParseSmbiosTable (SmBiosTableHob);
if (!EFI_ERROR (Status)) { if (!EFI_ERROR (Status)) {
DEBUG ((DEBUG_INFO, "Detected Smbios Table at 0x%lx\n", SmBiosTableHob->SmBiosEntryPoint)); DEBUG ((DEBUG_INFO, "Detected Smbios Table at 0x%lx\n", SmBiosEntryPoint));
SmBiosTableHob = BuildGuidHob (&gUniversalPayloadSmbiosTableGuid, sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE));
ASSERT (SmBiosTableHob != NULL);
SmBiosTableHob->Header.Revision = UNIVERSAL_PAYLOAD_SMBIOS_TABLE_REVISION;
SmBiosTableHob->Header.Length = sizeof (UNIVERSAL_PAYLOAD_SMBIOS_TABLE);
SmBiosTableHob->SmBiosEntryPoint = SmBiosEntryPoint;
DEBUG ((DEBUG_INFO, "Create smbios table gUniversalPayloadSmbiosTableGuid guid hob\n"));
} }
// //