Skip to content
  • Robin Randhawa's avatar
    efi_loader: Fix crash on 32-bit systems · 991d62fa
    Robin Randhawa authored
    
    
    A type mismatch in the efi_allocate_pool boot service flow causes
    hazardous memory scribbling on 32-bit systems.
    
    This is efi_allocate_pool's prototype:
    
    static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
    						    unsigned long size,
    						    void **buffer);
    
    Internally, it invokes efi_allocate_pages as follows:
    
    efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
    					    (void*)buffer);
    
    This is efi_allocate_pages' prototype:
    
    efi_status_t efi_allocate_pages(int type, int memory_type,
    					unsigned long pages,
    					uint64_t *memory);
    
    The problem: efi_allocate_pages does this internally:
    
        *memory = addr;
    
    This fix in efi_allocate_pool uses a transitional uintptr_t cast to
    ensure the correct outcome, irrespective of the system's native word
    size.
    
    This was observed when bootefi'ing the EFI instance of FreeBSD's first
    stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
    Cortex-a9).
    
    Signed-off-by: default avatarRobin Randhawa <robin.randhawa@arm.com>
    Signed-off-by: default avatarAlexander Graf <agraf@suse.de>
    991d62fa