summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin Randhawa <robin.randhawa@arm.com>2016-09-13 18:36:53 +0100
committerAlexander Graf <agraf@suse.de>2016-10-18 09:08:07 +0200
commit991d62fa73a35598a8939a83dd84369168220d35 (patch)
tree0af165c7ed21e9f8b96dcd4ac302983bc42c2a2b
parentbdf5c1b3607bd6384ac5319caad2d8107130ace1 (diff)
downloadu-boot-imx-991d62fa73a35598a8939a83dd84369168220d35.zip
u-boot-imx-991d62fa73a35598a8939a83dd84369168220d35.tar.gz
u-boot-imx-991d62fa73a35598a8939a83dd84369168220d35.tar.bz2
efi_loader: Fix crash on 32-bit systems
A type mismatch in the efi_allocate_pool boot service flow causes hazardous memory scribbling on 32-bit systems. This is efi_allocate_pool's prototype: static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer); Internally, it invokes efi_allocate_pages as follows: efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); This is efi_allocate_pages' prototype: efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); The problem: efi_allocate_pages does this internally: *memory = addr; This fix in efi_allocate_pool uses a transitional uintptr_t cast to ensure the correct outcome, irrespective of the system's native word size. This was observed when bootefi'ing the EFI instance of FreeBSD's first stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + Cortex-a9). Signed-off-by: Robin Randhawa <robin.randhawa@arm.com> Signed-off-by: Alexander Graf <agraf@suse.de>
-rw-r--r--lib/efi_loader/efi_boottime.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index 792db39..a11100f 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size,
void **buffer)
{
efi_status_t r;
+ efi_physical_addr_t t;
EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer);
- r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer);
+ r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t);
+ *buffer = (void *)(uintptr_t)t;
return EFI_EXIT(r);
}