From e36d5ac7d10a6ff5becb0f52fdfd69a1752b0d14 Mon Sep 17 00:00:00 2001 From: Hao A Wu Date: Wed, 26 Jun 2019 15:23:29 +0800 Subject: [PATCH] MdeModulePkg/SdMmcPciHcDxe: Fix double PciIo Unmap in TRB creation (CVE-2019-14587) REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1989 The commit will avoid unmapping the same resource in error handling logic for function BuildAdmaDescTable() and SdMmcCreateTrb(). For the error handling in BuildAdmaDescTable(): The error is directly related with the corresponding Map() operation (mapped address beyond 4G, which is not supported in ADMA), so the Unmap() operation is done in the error handling logic, and then setting 'Trb->AdmaMap' to NULL to avoid double Unmap. For the error handling in SdMmcCreateTrb(): The error is not directly related with the corresponding Map() operation, so the commit will update the code to left SdMmcFreeTrb() for the Unmap operation to avoid double Unmap. Cc: Jian J Wang Cc: Ray Ni Signed-off-by: Hao A Wu Reviewed-by: Jian J Wang --- MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c b/MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c index da5559ae76..43626fff48 100644 --- a/MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c +++ b/MdeModulePkg/Bus/Pci/SdMmcPciHcDxe/SdMmcPciHci.c @@ -1544,6 +1544,8 @@ BuildAdmaDescTable ( PciIo, Trb->AdmaMap ); + Trb->AdmaMap = NULL; + PciIo->FreeBuffer ( PciIo, EFI_SIZE_TO_PAGES (TableSize), @@ -1753,7 +1755,6 @@ SdMmcCreateTrb ( } Status = BuildAdmaDescTable (Trb, Private->ControllerVersion[Slot]); if (EFI_ERROR (Status)) { - PciIo->Unmap (PciIo, Trb->DataMap); goto Error; } } else if (Private->Capability[Slot].Sdma != 0) { -- 2.39.2