Emulation/switch-coreboot
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-coreboot.git synced 2025-05-04 01:39:18 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

UPSTREAM: mainboard/emulation/qemu-i440fx/fw_cfg: Fix undefined behavior

Browse source 
Fixes 2 reports found by undefined behavior sanitizer. Dereferencing
pointers that are not aligned to the size of access is undefiend
behavior.

BUG=none
BRANCH=none
TEST=none

Change-Id: I9f58f4d389569df7a5fa3625b420cd512257582a
Signed-off-by: Patrick Georgi <pgeorgi@google.com>
Original-Commit-Id: d4f994bbc4
Original-Change-Id: Iaa3845308171c307f1ddc7937286aacbd00e3a10
Original-Signed-off-by: Ryan Salsamendi <rsalsamendi@hotmail.com>
Original-Reviewed-on: https://review.coreboot.org/20155
Original-Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Original-Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/539526
Commit-Ready: Patrick Georgi <pgeorgi@chromium.org>
Tested-by: Patrick Georgi <pgeorgi@chromium.org>
Reviewed-by: Patrick Georgi <pgeorgi@chromium.org>
This commit is contained in:
Ryan Salsamendi 2017-06-11 19:39:06 -07:00 • committed by chrome-bot
parent d203198c17
commit 26fc510b47
1 changed files with 20 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
src/mainboard/emulation/qemu-i440fx/fw_cfg.c
View file

@ -17,6 +17,7 @@
#include <console/console.h>
#include <arch/io.h>
#include <arch/acpigen.h>
#include <commonlib/endian.h>
#include "fw_cfg.h"
#include "fw_cfg_if.h"
@ -203,8 +204,7 @@ unsigned long fw_cfg_acpi_tables(unsigned long start)
{
BiosLinkerLoaderEntry *s;
unsigned long *addrs, current;
uint32_t *ptr4;
uint64_t *ptr8;
uint8_t *ptr;
int rc, i, j, src, dst, max;
rc = fw_cfg_check_file("etc/table-loader");
@ -220,6 +220,10 @@ unsigned long fw_cfg_acpi_tables(unsigned long start)
current = start;
for (i = 0; i < max && s[i].command != 0; i++) {
void *cksum_data;
uint32_t cksum;
uint32_t addr4;
uint64_t addr8;
switch (s[i].command) {
case BIOS_LINKER_LOADER_COMMAND_ALLOCATE:
current = ALIGN(current, s[i].alloc.align);
@ -248,13 +252,19 @@ unsigned long fw_cfg_acpi_tables(unsigned long start)
switch (s[i].pointer.size) {
case 4:
ptr4 = (uint32_t*)(addrs[dst] + s[i].pointer.offset);
*ptr4 += addrs[src];
ptr = (uint8_t *)addrs[dst];
ptr += s[i].pointer.offset;
addr4 = read_le32(ptr);
addr4 += addrs[src];
write_le32(ptr, addr4);
break;
case 8:
ptr8 = (uint64_t*)(addrs[dst] + s[i].pointer.offset);
*ptr8 += addrs[src];
ptr = (uint8_t *)addrs[dst];
ptr += s[i].pointer.offset;
addr8 = read_le64(ptr);
addr8 += addrs[src];
write_le64(ptr, addr8);
break;
default:
@ -280,10 +290,10 @@ unsigned long fw_cfg_acpi_tables(unsigned long start)
if (dst == -1)
goto err;
ptr4 = (uint32_t*)(addrs[dst] + s[i].cksum.offset);
*ptr4 = 0;
*ptr4 = acpi_checksum((void *)(addrs[dst] + s[i].cksum.start),
s[i].cksum.length);
ptr = (uint8_t *)(addrs[dst] + s[i].cksum.offset);
cksum_data = (void *)(addrs[dst] + s[i].cksum.start);
cksum = acpi_checksum(cksum_data, s[i].cksum.length);
write_le32(ptr, cksum);
break;
default: