efi_loader: Fix crash on 32-bit systems
authorRobin Randhawa <[email protected]>
Tue, 13 Sep 2016 17:36:53 +0000 (18:36 +0100)
committerAlexander Graf <[email protected]>
Tue, 18 Oct 2016 07:08:07 +0000 (09:08 +0200)
commit991d62fa73a35598a8939a83dd84369168220d35
tree0af165c7ed21e9f8b96dcd4ac302983bc42c2a2b
parentbdf5c1b3607bd6384ac5319caad2d8107130ace1
efi_loader: Fix crash on 32-bit systems

A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.

This is efi_allocate_pool's prototype:

static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
    unsigned long size,
    void **buffer);

Internally, it invokes efi_allocate_pages as follows:

efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
    (void*)buffer);

This is efi_allocate_pages' prototype:

efi_status_t efi_allocate_pages(int type, int memory_type,
unsigned long pages,
uint64_t *memory);

The problem: efi_allocate_pages does this internally:

    *memory = addr;

This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.

This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).

Signed-off-by: Robin Randhawa <[email protected]>
Signed-off-by: Alexander Graf <[email protected]>
lib/efi_loader/efi_boottime.c