diff options
author | Robin Randhawa <robin.randhawa@arm.com> | 2016-09-13 18:36:53 +0100 |
---|---|---|
committer | Alexander Graf <agraf@suse.de> | 2016-10-18 09:08:07 +0200 |
commit | 991d62fa73a35598a8939a83dd84369168220d35 (patch) | |
tree | 0af165c7ed21e9f8b96dcd4ac302983bc42c2a2b /fs/zfs | |
parent | bdf5c1b3607bd6384ac5319caad2d8107130ace1 (diff) |
efi_loader: Fix crash on 32-bit systems
A type mismatch in the efi_allocate_pool boot service flow causes
hazardous memory scribbling on 32-bit systems.
This is efi_allocate_pool's prototype:
static efi_status_t EFIAPI efi_allocate_pool(int pool_type,
unsigned long size,
void **buffer);
Internally, it invokes efi_allocate_pages as follows:
efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12,
(void*)buffer);
This is efi_allocate_pages' prototype:
efi_status_t efi_allocate_pages(int type, int memory_type,
unsigned long pages,
uint64_t *memory);
The problem: efi_allocate_pages does this internally:
*memory = addr;
This fix in efi_allocate_pool uses a transitional uintptr_t cast to
ensure the correct outcome, irrespective of the system's native word
size.
This was observed when bootefi'ing the EFI instance of FreeBSD's first
stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress +
Cortex-a9).
Signed-off-by: Robin Randhawa <robin.randhawa@arm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'fs/zfs')
0 files changed, 0 insertions, 0 deletions