MdeModulePkg/PiSmmCore: fix #PF caused by freeing read-only memory

[mirror_edk2.git] / MdeModulePkg / Core / PiSmmCore / HeapGuard.c

diff --git a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
index aa9c25d1021d144d5ae3299c5a1aed44911e4f38..d5556eb79cb1cfd73ba1569fe8c9e2ee02708cbb 100644 (file)
--- a/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
+++ b/MdeModulePkg/Core/PiSmmCore/HeapGuard.c
@@ -73,7 +73,7 @@ SetBits (
   StartBit  = (UINTN)GUARDED_HEAP_MAP_ENTRY_BIT_INDEX (Address);\r
   EndBit    = (StartBit + BitNumber - 1) % GUARDED_HEAP_MAP_ENTRY_BITS;\r
 \r
-  if ((StartBit + BitNumber) > GUARDED_HEAP_MAP_ENTRY_BITS) {\r
+  if ((StartBit + BitNumber) >= GUARDED_HEAP_MAP_ENTRY_BITS) {\r
     Msbs    = (GUARDED_HEAP_MAP_ENTRY_BITS - StartBit) %\r
               GUARDED_HEAP_MAP_ENTRY_BITS;\r
     Lsbs    = (EndBit + 1) % GUARDED_HEAP_MAP_ENTRY_BITS;\r
@@ -126,7 +126,7 @@ ClearBits (
   StartBit  = (UINTN)GUARDED_HEAP_MAP_ENTRY_BIT_INDEX (Address);\r
   EndBit    = (StartBit + BitNumber - 1) % GUARDED_HEAP_MAP_ENTRY_BITS;\r
 \r
-  if ((StartBit + BitNumber) > GUARDED_HEAP_MAP_ENTRY_BITS) {\r
+  if ((StartBit + BitNumber) >= GUARDED_HEAP_MAP_ENTRY_BITS) {\r
     Msbs    = (GUARDED_HEAP_MAP_ENTRY_BITS - StartBit) %\r
               GUARDED_HEAP_MAP_ENTRY_BITS;\r
     Lsbs    = (EndBit + 1) % GUARDED_HEAP_MAP_ENTRY_BITS;\r
@@ -191,10 +191,14 @@ GetBits (
     Lsbs = 0;\r
   }\r
 \r
-  Result    = RShiftU64 ((*BitMap), StartBit) & (LShiftU64 (1, Msbs) - 1);\r
-  if (Lsbs > 0) {\r
-    BitMap  += 1;\r
-    Result  |= LShiftU64 ((*BitMap) & (LShiftU64 (1, Lsbs) - 1), Msbs);\r
+  if (StartBit == 0 && BitNumber == GUARDED_HEAP_MAP_ENTRY_BITS) {\r
+    Result = *BitMap;\r
+  } else {\r
+    Result    = RShiftU64((*BitMap), StartBit) & (LShiftU64(1, Msbs) - 1);\r
+    if (Lsbs > 0) {\r
+      BitMap  += 1;\r
+      Result  |= LShiftU64 ((*BitMap) & (LShiftU64 (1, Lsbs) - 1), Msbs);\r
+    }\r
   }\r
 \r
   return Result;\r
@@ -251,8 +255,8 @@ FindGuardedMemoryMap (
   //\r
   // Adjust current map table depth according to the address to access\r
   //\r
-  while (mMapLevel < GUARDED_HEAP_MAP_TABLE_DEPTH\r
-         &&\r
+  while (AllocMapUnit &&\r
+         mMapLevel < GUARDED_HEAP_MAP_TABLE_DEPTH &&\r
          RShiftU64 (\r
            Address,\r
            mLevelShift[GUARDED_HEAP_MAP_TABLE_DEPTH - mMapLevel - 1]\r
@@ -887,6 +891,10 @@ AdjustMemoryS (
   }\r
 \r
   Target = Start + Size - SizeRequested;\r
+  ASSERT (Target >= Start);\r
+  if (Target == 0) {\r
+    return 0;\r
+  }\r
 \r
   if (!IsGuardPage (Start + Size)) {\r
     // No Guard at tail to share. One more page is needed.\r
@@ -933,6 +941,7 @@ AdjustMemoryF (
   EFI_PHYSICAL_ADDRESS  MemoryToTest;\r
   UINTN                 PagesToFree;\r
   UINT64                GuardBitmap;\r
+  UINT64                Attributes;\r
 \r
   if (Memory == NULL || NumberOfPages == NULL || *NumberOfPages == 0) {\r
     return;\r
@@ -941,6 +950,27 @@ AdjustMemoryF (
   Start = *Memory;\r
   PagesToFree = *NumberOfPages;\r
 \r
+  //\r
+  // In case the memory to free is marked as read-only (e.g. EfiRuntimeServicesCode).\r
+  //\r
+  if (mSmmMemoryAttribute != NULL) {\r
+    Attributes = 0;\r
+    mSmmMemoryAttribute->GetMemoryAttributes (\r
+                           mSmmMemoryAttribute,\r
+                           Start,\r
+                           EFI_PAGES_TO_SIZE (PagesToFree),\r
+                           &Attributes\r
+                           );\r
+    if ((Attributes & EFI_MEMORY_RO) != 0) {\r
+      mSmmMemoryAttribute->ClearMemoryAttributes (\r
+                             mSmmMemoryAttribute,\r
+                             Start,\r
+                             EFI_PAGES_TO_SIZE (PagesToFree),\r
+                             EFI_MEMORY_RO\r
+                             );\r
+    }\r
+  }\r
+\r
   //\r
   // Head Guard must be one page before, if any.\r
   //\r