MdeModulePkg: Fix use-after-free error in InstallConfigurationTable()
[mirror_edk2.git] / MdeModulePkg / Core / PiSmmCore / InstallConfigurationTable.c
CommitLineData
e42e9404 1/** @file\r
2 System Management System Table Services SmmInstallConfigurationTable service\r
3\r
322d827c 4 Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r
e42e9404 5 This program and the accompanying materials are licensed and made available \r
6 under the terms and conditions of the BSD License which accompanies this \r
7 distribution. The full text of the license may be found at \r
8 http://opensource.org/licenses/bsd-license.php \r
9\r
10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. \r
12\r
13**/\r
14\r
15#include "PiSmmCore.h"\r
16\r
17#define CONFIG_TABLE_SIZE_INCREASED 0x10\r
18\r
19UINTN mSmmSystemTableAllocateSize = 0;\r
20\r
21/**\r
22 The SmmInstallConfigurationTable() function is used to maintain the list\r
23 of configuration tables that are stored in the System Management System\r
24 Table. The list is stored as an array of (GUID, Pointer) pairs. The list\r
25 must be allocated from pool memory with PoolType set to EfiRuntimeServicesData.\r
26\r
27 @param SystemTable A pointer to the SMM System Table (SMST).\r
28 @param Guid A pointer to the GUID for the entry to add, update, or remove.\r
29 @param Table A pointer to the buffer of the table to add.\r
30 @param TableSize The size of the table to install.\r
31\r
32 @retval EFI_SUCCESS The (Guid, Table) pair was added, updated, or removed.\r
33 @retval EFI_INVALID_PARAMETER Guid is not valid.\r
34 @retval EFI_NOT_FOUND An attempt was made to delete a non-existent entry.\r
35 @retval EFI_OUT_OF_RESOURCES There is not enough memory available to complete the operation.\r
36\r
37**/\r
38EFI_STATUS\r
39EFIAPI\r
40SmmInstallConfigurationTable (\r
41 IN CONST EFI_SMM_SYSTEM_TABLE2 *SystemTable,\r
42 IN CONST EFI_GUID *Guid,\r
43 IN VOID *Table,\r
44 IN UINTN TableSize\r
45 )\r
46{\r
47 UINTN Index;\r
48 EFI_CONFIGURATION_TABLE *ConfigurationTable;\r
322d827c 49 EFI_CONFIGURATION_TABLE *OldTable;\r
e42e9404 50\r
51 //\r
52 // If Guid is NULL, then this operation cannot be performed\r
53 //\r
54 if (Guid == NULL) {\r
55 return EFI_INVALID_PARAMETER;\r
56 }\r
57\r
58 ConfigurationTable = gSmmCoreSmst.SmmConfigurationTable;\r
59\r
60 //\r
61 // Search all the table for an entry that matches Guid\r
62 //\r
63 for (Index = 0; Index < gSmmCoreSmst.NumberOfTableEntries; Index++) {\r
64 if (CompareGuid (Guid, &(ConfigurationTable[Index].VendorGuid))) {\r
65 break;\r
66 }\r
67 }\r
68\r
69 if (Index < gSmmCoreSmst.NumberOfTableEntries) {\r
70 //\r
71 // A match was found, so this is either a modify or a delete operation\r
72 //\r
73 if (Table != NULL) {\r
74 //\r
75 // If Table is not NULL, then this is a modify operation.\r
322d827c 76 // Modify the table entry and return.\r
e42e9404 77 //\r
78 ConfigurationTable[Index].VendorTable = Table;\r
79 return EFI_SUCCESS;\r
80 }\r
81\r
82 //\r
83 // A match was found and Table is NULL, so this is a delete operation.\r
84 //\r
85 gSmmCoreSmst.NumberOfTableEntries--;\r
86\r
87 //\r
88 // Copy over deleted entry\r
89 //\r
90 CopyMem (\r
91 &(ConfigurationTable[Index]),\r
92 &(ConfigurationTable[Index + 1]),\r
93 (gSmmCoreSmst.NumberOfTableEntries - Index) * sizeof (EFI_CONFIGURATION_TABLE)\r
94 );\r
95\r
96 } else {\r
97 //\r
98 // No matching GUIDs were found, so this is an add operation.\r
99 //\r
100 if (Table == NULL) {\r
101 //\r
102 // If Table is NULL on an add operation, then return an error.\r
103 //\r
104 return EFI_NOT_FOUND;\r
105 }\r
106\r
107 //\r
108 // Assume that Index == gSmmCoreSmst.NumberOfTableEntries\r
109 //\r
110 if ((Index * sizeof (EFI_CONFIGURATION_TABLE)) >= mSmmSystemTableAllocateSize) {\r
111 //\r
112 // Allocate a table with one additional entry.\r
113 //\r
114 mSmmSystemTableAllocateSize += (CONFIG_TABLE_SIZE_INCREASED * sizeof (EFI_CONFIGURATION_TABLE));\r
115 ConfigurationTable = AllocatePool (mSmmSystemTableAllocateSize);\r
116 if (ConfigurationTable == NULL) {\r
117 //\r
118 // If a new table could not be allocated, then return an error.\r
119 //\r
120 return EFI_OUT_OF_RESOURCES;\r
121 }\r
122\r
123 if (gSmmCoreSmst.SmmConfigurationTable != NULL) {\r
124 //\r
125 // Copy the old table to the new table.\r
126 //\r
127 CopyMem (\r
128 ConfigurationTable,\r
129 gSmmCoreSmst.SmmConfigurationTable,\r
130 Index * sizeof (EFI_CONFIGURATION_TABLE)\r
131 );\r
132\r
133 //\r
322d827c 134 // Record the old table pointer.\r
e42e9404 135 //\r
322d827c 136 OldTable = gSmmCoreSmst.SmmConfigurationTable;\r
e42e9404 137\r
322d827c
SS
138 //\r
139 // As the SmmInstallConfigurationTable() may be re-entered by FreePool() in\r
140 // its calling stack, updating System table to the new table pointer must\r
141 // be done before calling FreePool() to free the old table.\r
142 // It can make sure the gSmmCoreSmst.SmmConfigurationTable point to the new\r
143 // table and avoid the errors of use-after-free to the old table by the\r
144 // reenter of SmmInstallConfigurationTable() in FreePool()'s calling stack.\r
145 //\r
146 gSmmCoreSmst.SmmConfigurationTable = ConfigurationTable;\r
147\r
148 //\r
149 // Free the old table after updating System Table to the new table pointer.\r
150 //\r
151 FreePool (OldTable);\r
152 } else {\r
153 //\r
154 // Update System Table\r
155 //\r
156 gSmmCoreSmst.SmmConfigurationTable = ConfigurationTable;\r
157 }\r
e42e9404 158 }\r
159\r
160 //\r
161 // Fill in the new entry\r
162 //\r
163 CopyGuid ((VOID *)&ConfigurationTable[Index].VendorGuid, Guid);\r
164 ConfigurationTable[Index].VendorTable = Table;\r
165\r
166 //\r
167 // This is an add operation, so increment the number of table entries\r
168 //\r
169 gSmmCoreSmst.NumberOfTableEntries++;\r
170 }\r
171\r
172 //\r
173 // CRC-32 field is ignorable for SMM System Table and should be set to zero\r
174 //\r
175\r
176 return EFI_SUCCESS;\r
177}\r