Ver código fonte

[romprefix] Use correct size for PMM allocation of image source block

iPXE allocates its first PMM block using the image source length,
which is rounded up to the nearest 16-byte paragraph.  It then copies
in data of a length calculated from the ROM size, which is
theoretically less than or equal to the image source length, but is
rounded up to the nearest 512-byte sector.  This can result in copying
beyond the end of the allocated PMM block, which can corrupt the PMM
data structures (and other essentially arbitrary areas of memory).

Fix by rounding up the image source length to the nearest 512-byte
sector before using it as the PMM allocation length.

Reported-by: Alex Williamson <alex.williamson@redhat.com>
Reported-by: Jarrod Johnson <jarrod.b.johnson@gmail.com>
Reported-by: Itay Gazit <itayg@mellanox.co.il>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 13 anos atrás
pai
commit
23daab14a6
1 arquivos alterados com 7 adições e 6 exclusões
  1. 7
    6
      src/arch/i386/prefix/romprefix.S

+ 7
- 6
src/arch/i386/prefix/romprefix.S Ver arquivo

@@ -320,7 +320,8 @@ pmm_scan:
320 320
 	/* We have PMM and so a 1kB stack: preserve whole registers */
321 321
 	pushal
322 322
 	/* Allocate image source PMM block */
323
-	movzwl	image_source_len_pgh, %ecx
323
+	movzwl	image_source_size, %ecx
324
+	shll	$5, %ecx
324 325
 	movl	$PMM_HANDLE_BASE_IMAGE_SOURCE, %ebx
325 326
 	movw	$get_pmm_image_source, %bp
326 327
 	call	get_pmm
@@ -565,16 +566,16 @@ image_source:
565 566
 	.long	0
566 567
 	.size	image_source, . - image_source
567 568
 
568
-/* Image source area length (in paragraphs)
569
+/* Image source size (in 512-byte sectors)
569 570
  *
570 571
  */
571
-image_source_len_pgh:
572
+image_source_size:
572 573
 	.word	0
573
-	.size	image_source_len_pgh, . - image_source_len_pgh
574
+	.size	image_source_size, . - image_source_size
574 575
 	.section ".zinfo.fixup", "a", @progbits	/* Compressor fixups */
575 576
 	.ascii	"ADDW"
576
-	.long	image_source_len_pgh
577
-	.long	16
577
+	.long	image_source_size
578
+	.long	512
578 579
 	.long	0
579 580
 	.previous
580 581
 

Carregando…
Cancelar
Salvar