Tianocore/edk2.git/MdeModulePkg/Core/Dxe/Misc, branch master

MdeModulePkg: Fix missing NULL tests.

2025-11-22T18:58:47+00:00

https://github.com/github/codeql/blob/codeql-cli-2.7.3/cpp/ql/src/Critical/MissingNullTest.qhelp For items which allocate memory, or get a pointer from another structure, it is important to validate that the pointers are not null before they are dereferenced. Signed-off-by: Aaron Pop

MdeModulePkg: Fix UEFI runtime driver loading after EndOfDxe

2025-10-23T13:59:39+00:00

Memory Attributes Table needs to be updated to contain executable permissions for UEFI runtime drivers loaded after EndOfDxe. Fixes a regression introduced by bb248a9. Signed-off-by: Vitaly Cheptsov

MdeModulePkg: DXE Core: Correct Usage of EFI_MEMORY_ATTRIBUTE_MASK

2025-10-16T16:50:12+00:00

edk2 commit 3bd5c994c879f78e8e3d5346dc3b627f199291aa added usage of EFI_MEMORY_ATTRIBUTE_MASK to edk2. However, it applied it incorrectly to some places that should instead use EFI_MEMORY_ACCESS_MASK. EFI_MEMORY_ACCESS_MASK contains the actual HW page table access attributes (read protect, read only, no-execute), whereas EFI_MEMORY_ATTRIBUTE_MASK contains the access attributes in addition to some virtual attributes (special purpose and cpu crypto). The GCD has a behavior where if SetMemorySpaceAttributes() is called with only virtual attributes set, it will not call into CpuDxe to change the attributes; 0 is a valid page table attribute set (it means RWX). However, after the above change, this behavior was altered so that if EFI_MEMORY_SP or EFI_MEMORY_CPU_CRYPTO is applied, in attempt to just update these virtual attributes, the GCD will call into CpuDxe and apply RWX instead, which is not the intention of the caller. One other place this was done incorrectly was in CoreGetMemoryMap, but that was fixed in f1567720b13a578ffa54716119f826df622babcd. SetUefiImageMemoryAttributes() is also updated here because that logic was copied from the check the GCD has about whether to call CpuDxe or not. Now that the GCD has been corrected, this also needs to be corrected. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: Leak Memory if Not RW on FreePages

2025-07-09T00:59:56+00:00

Currently, if the DebugClearMemory bit is set in the PcdDebugPropertyMask, CoreConvertPagesEx will attempt to write a pattern to the pages being freed. However, it does not check that the page is writeable, which will cause a page fault if not. Furthermore, if NX protections are not enabled, the core does not ensure that any freed pages are RW, which is the state expected when they are allocated next. If they are not RW, the allocating driver will crash trying to use them. This patch updates the page freeing code to query the memory attributes protocol, if present, for the attributes. If this call fails or the attributes are not RW at a minimum, the core leaks the memory (returning success to the caller). If the memory attribute protocol is not present (either because a platform doesn't produce it or it is before the protocol has been produced, the core continues with freeing memory. This is either before the CPU Arch protocol is available (so drivers can't change memory attributes) or otherwise matches existing behavior. This was deemed the best approach to let memory that can't be guaranteed to be RW leak instead of letting a driver crash when allocating it. It was deemed less brittle to simply leak the memory instead of attempting to change the attributes. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: DebugImageInfoTable: Fix Array Maintenance

2025-05-07T03:27:35+00:00

The DebugImageInfoTable contains an array of image info structures. The current implementation removes an entry by freeing the info structure and putting NULL in that entry of the array. It then decrements the table size tracked in the table. However, the array is invalid at this point, it contains a NULL entry, which the UEFI spec does not envision and it contains a valid entry past the end of the array as tracked in the spec defined config table. If the table is consumed at this point it can lead to an invalid assessment of the image state, which defeats the purpose of the table. When a new info structure is added, it then scans for the first NULL entry adds a pointer to the new info structure there and increments the table size to cover the entrythat was formerly past the end of the array. The current implementation requires that once an unload happens, more loads happen than unloads and that the last operation is not an unload (which won't be true in the shell, e.g.). This is needlessly complex, as the order of the table doesn't matter (and in fact this implementation doesn't preserve image loading order either). This patch updates the removal function to free the desired info structure, move the last entry of the array to this freed spot, mark the last entry as NULL, and decrement the table count. The entry addition function then just always puts a new entry at the end of the array, expanding it as necessary. This simplifies the logic and covers the gaps that were present. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: Fix Image Memory Protection Applying

2025-05-07T03:27:20+00:00

Commit 5ccb5fff02a66b21898bd57f48bbd7c3cd6f4e8d updated the image memory protection code to set the protection attributes through the GCD instead of directly to the page table. However, this code had an implicit assumption that each base address passed to it was the beginning of a GCD descriptor. On the virtual platforms tested, this was the case. However, on a physical platform, a scenario was encountered where the base address was not the beginning of a GCD descriptor, thus causing memory attributes to be applied incorrectly. This assumption does not need to be made and this patch updates the code to handle the case where the base address is not the beginning of a GCD descriptor. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: DxeCore: Set Image Protections Through GCD

2025-04-27T05:52:11+00:00

Today, SetUefiImageMemoryAttributes calls directly to the CPU Arch protocol to set EFI_MEMORY_XP or EFI_MEMORY_RO on image memory. However, this bypasses the GCD and so the GCD is out of sync with the actual state of memory. This can cause an issue in the scenario where a new attribute is being set (whether a virtual attribute or a real HW attribute), if the GCD attributes are queried for a region and the new attribute is appended to the existing GCD attributes (which are incorrect), then the incorrect attributes can get applied. This can result in setting EFI_MEMORY_XP on code sections of images and causing an execution fault. This patch updates SetUefiImageMemoryAttributes to call into the GCD to update the attributes there and let the GCD code call into the CPU Arch protocol to update the page table. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: DxeCore: Lower Image Protection Print to Verbose Log Level

2025-04-27T05:52:11+00:00

The print that describes memory attributes being applied to image memory sections is currently at info level and very noisy, being printed multiple times per image. Reduce this to the verbose logging level. Signed-off-by: Oliver Smith-Denny

MdeModulePkg: Fix buffer overflow in MergeMemoryMap

2024-09-13T07:53:57+00:00

Check that the next map entry is valid before dereferencing to merge the guard pages. If the final entry is at the end of a page with no valid page following it, then this can cause an access violation. Signed-off-by: Kenneth Lautner

MdeModulePkg: MAT Set RO/XP on Code/Data Sections Outside Image Memory

2024-08-29T08:47:26+00:00

The Memory Attributes Table is generated by fetching the EFI memory map and splitting entries which contain loaded images so DATA and CODE sections have separate descriptors. The splitting is done via a call to SplitTable() which marks image DATA sections with the EFI_MEMORY_XP attribute and CODE sections with the EFI_MEMORY_RO attribute when splitting. After this process, there may still be EfiRuntimeServicesCode regions which did not have their attributes set because they are not part of loaded images. This patch updates the MAT EnforceMemoryMapAttribute logic to set the access attributes of runtime memory regions which are not part of loaded images (have not had their access attributes set). The attributes of the code regions will be read-only and no-execute because the UEFI spec dictates that runtime code regions should only contain loaded EFI modules. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4832 Refs: 1. https://edk2.groups.io/g/devel/topic/patch_v1_mdemodulepkg/105570114?p=,,,20,0,0,0::recentpostdate/sticky,,,20,2,0,105570114 2. https://edk2.groups.io/g/devel/topic/mdemodulepkg_fix_mat/105477564?p=,,,20,0,0,0::recentpostdate/sticky,,,20,2,0,105477564 Signed-off-by: Oliver Smith-Denny