UefiCpuPkg PiSmmCpuDxeSmm: Only support IN/OUT IO save state read (CVE-2018-12182)

[mirror_edk2.git] / UefiCpuPkg / PiSmmCpuDxeSmm / SmramSaveState.c

diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
index 26e365eabc9dad3cd0824a29d0ee89eb1223c7e1..11102c9cbf75e1878d81241062a61358672bd86f 100644 (file)
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmramSaveState.c
@@ -360,7 +360,6 @@ ReadSaveStateRegister (
   UINT32                      SmmRevId;\r
   SMRAM_SAVE_STATE_IOMISC     IoMisc;\r
   EFI_SMM_SAVE_STATE_IO_INFO  *IoInfo;\r
-  VOID                        *IoMemAddr;\r
 \r
   //\r
   // Check for special EFI_SMM_SAVE_STATE_REGISTER_LMA\r
@@ -406,6 +405,14 @@ ReadSaveStateRegister (
       return EFI_NOT_FOUND;\r
     }\r
 \r
+    //\r
+    // Only support IN/OUT, but not INS/OUTS/REP INS/REP OUTS.\r
+    //\r
+    if ((mSmmCpuIoType[IoMisc.Bits.Type] != EFI_SMM_SAVE_STATE_IO_TYPE_INPUT) &&\r
+        (mSmmCpuIoType[IoMisc.Bits.Type] != EFI_SMM_SAVE_STATE_IO_TYPE_OUTPUT)) {\r
+      return EFI_NOT_FOUND;\r
+    }\r
+\r
     //\r
     // Compute index for the I/O Length and I/O Type lookup tables\r
     //\r
@@ -425,13 +432,7 @@ ReadSaveStateRegister (
     IoInfo->IoPort = (UINT16)IoMisc.Bits.Port;\r
     IoInfo->IoWidth = mSmmCpuIoWidth[IoMisc.Bits.Length].IoWidth;\r
     IoInfo->IoType = mSmmCpuIoType[IoMisc.Bits.Type];\r
-    if (IoInfo->IoType == EFI_SMM_SAVE_STATE_IO_TYPE_INPUT || IoInfo->IoType == EFI_SMM_SAVE_STATE_IO_TYPE_OUTPUT) {\r
-      ReadSaveStateRegister (CpuIndex, EFI_SMM_SAVE_STATE_REGISTER_RAX, mSmmCpuIoWidth[IoMisc.Bits.Length].Width, &IoInfo->IoData);\r
-    }\r
-    else {\r
-      ReadSaveStateRegisterByIndex(CpuIndex, SMM_SAVE_STATE_REGISTER_IOMEMADDR_INDEX, sizeof(IoMemAddr), &IoMemAddr);\r
-      CopyMem(&IoInfo->IoData, IoMemAddr, mSmmCpuIoWidth[IoMisc.Bits.Length].Width);\r
-    }\r
+    ReadSaveStateRegister (CpuIndex, EFI_SMM_SAVE_STATE_REGISTER_RAX, mSmmCpuIoWidth[IoMisc.Bits.Length].Width, &IoInfo->IoData);\r
     return EFI_SUCCESS;\r
   }\r
 \r