November 2023 - SeaBIOS - mail.coreboot.org

Uninitialized local leads to undefined memory dereference
by Datta manikanta sri hari Danduri Nov. 25, 2023

Nov. 25, 2023

Hi ISSUE-1: seabios-1.15.0/scripts/kconfig/menu.c function get_prompt_str, the variable jump is uninitialized and may lead to illegal access at if (i > 0) { str_printf(r, _(" Location:\n")); for (j = 4; --i >= 0; j += 2) { menu = submenu[i]; if (head && location && menu == location) jump->offset = strlen(r->s); str_printf(r, "%*c-> %s", j, ' ', _(menu_get_prompt(menu))); if (menu->sym) { str_printf(r, " (%s [=%s])", menu->sym->name ? menu->sym->name : _("<choice>"), sym_get_string_value(menu->sym)); } str_append(r, "\n"); } } ISSUE-2: seabios-1.15.0/src/hw/usb-ohci.c function start_ohci, the check is incorrect for (;;) { u32 status = readl(&cntl->regs->cmdstatus); if (! status & OHCI_HCR) break; if (timer_check(end)) { warn_timeout(); return -1; } } Thanks Srihari

1 0

unbounded-writes, causes buffer overflow
by Datta manikanta sri hari Danduri Nov. 25, 2023

Nov. 25, 2023

Hi There are a few bugs related to Buffer write operations that do not control the length of data, which may overflow. I attached a reference patch. Please make changes as needed. If possible, assign CVE, as the content written to these buffers is tainted and coming from the user, which can lead to security risks. Thanks Srihari

1 0

[PATCH v6] limit address space used for pci devices.
by Gerd Hoffmann Nov. 13, 2023

Nov. 13, 2023

For better compatibility with old linux kernels, see source code comment. Also rename some variables to make the code more readable, following suggestions by Kevin. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Kevin O'Connor <kevin(a)koconnor.net> Reported-by: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/pciinit.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c index c7084f5e397e..6b13cd5b7d1c 100644 --- a/src/fw/pciinit.c +++ b/src/fw/pciinit.c @@ -46,12 +46,16 @@ static const char *region_type_name[] = { [ PCI_REGION_TYPE_PREFMEM ] = "prefmem", }; +// Memory ranges exported to legacy ACPI type table generation u64 pcimem_start = BUILD_PCIMEM_START; u64 pcimem_end = BUILD_PCIMEM_END; u64 pcimem64_start = BUILD_PCIMEM64_START; u64 pcimem64_end = BUILD_PCIMEM64_END; -u64 pci_io_low_end = 0xa000; -u32 pci_use_64bit = 0; + +// Resource allocation limits +static u64 pci_io_low_end = 0xa000; +static u64 pci_mem64_top = 0; +static u32 pci_pad_mem64 = 0; struct pci_region_entry { struct pci_device *dev; @@ -966,8 +970,9 @@ static int pci_bios_check_devices(struct pci_bus *busses) int resource_optional = 0; if (hotplug_support == HOTPLUG_PCIE) resource_optional = pcie_cap && (type == PCI_REGION_TYPE_IO); - if (hotplug_support && pci_use_64bit && is64 && (type == PCI_REGION_TYPE_PREFMEM)) - align = (u64)1 << (CPUPhysBits - 11); + if (hotplug_support && pci_pad_mem64 && is64 + && (type == PCI_REGION_TYPE_PREFMEM)) + align = pci_mem64_top >> 11; if (align > sum && hotplug_support && !resource_optional) sum = align; /* reserve min size for hot-plug */ if (size > sum) { @@ -1111,7 +1116,7 @@ static void pci_bios_map_devices(struct pci_bus *busses) panic("PCI: out of I/O address space\n"); dprintf(1, "PCI: 32: %016llx - %016llx\n", pcimem_start, pcimem_end); - if (pci_use_64bit || pci_bios_init_root_regions_mem(busses)) { + if (pci_pad_mem64 || pci_bios_init_root_regions_mem(busses)) { struct pci_region r64_mem, r64_pref; r64_mem.list.first = NULL; r64_pref.list.first = NULL; @@ -1131,14 +1136,13 @@ static void pci_bios_map_devices(struct pci_bus *busses) r64_mem.base = le64_to_cpu(romfile_loadint("etc/reserved-memory-end", 0)); if (r64_mem.base < 0x100000000LL + RamSizeOver4G) r64_mem.base = 0x100000000LL + RamSizeOver4G; - if (CPUPhysBits) { - u64 top = 1LL << CPUPhysBits; + if (pci_mem64_top) { u64 size = (ALIGN(sum_mem, (1LL<<30)) + ALIGN(sum_pref, (1LL<<30))); - if (pci_use_64bit) - size = ALIGN(size, (1LL<<(CPUPhysBits-3))); - if (r64_mem.base < top - size) { - r64_mem.base = top - size; + if (pci_pad_mem64) + size = ALIGN(size, pci_mem64_top >> 3); + if (r64_mem.base < pci_mem64_top - size) { + r64_mem.base = pci_mem64_top - size; } if (e820_is_used(r64_mem.base, size)) r64_mem.base -= size; @@ -1181,8 +1185,18 @@ pci_setup(void) dprintf(3, "pci setup\n"); + if (CPUPhysBits) { + pci_mem64_top = 1LL << CPUPhysBits; + if (CPUPhysBits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + pci_mem64_top = 1LL << 46; + } + } + if (CPUPhysBits >= 36 && CPULongMode && RamSizeOver4G) - pci_use_64bit = 1; + pci_pad_mem64 = 1; dprintf(1, "=== PCI bus & bridge init ===\n"); if (pci_probe_host() != 0) { -- 2.41.0

1 0

[PATCH v5] limit physical address space size
by Gerd Hoffmann Nov. 10, 2023

Nov. 10, 2023

For better compatibility with old linux kernels, see source code comment. Related (same problem in ovmf): https://github.com/tianocore/edk2/commit/c1e853769046 Cc: Claudio Fontana <cfontana(a)suse.de> Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> --- src/fw/paravirt.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c index e5d4eca0cb5a..a2c9c64d5e78 100644 --- a/src/fw/paravirt.c +++ b/src/fw/paravirt.c @@ -182,6 +182,14 @@ static void physbits(int qemu_quirk) __func__, signature, pae ? "yes" : "no", CPULongMode ? "yes" : "no", physbits, valid ? "yes" : "no"); + if (valid && physbits > 46) { + // Old linux kernels have trouble dealing with more than 46 + // phys-bits, so avoid that for now. Seems to be a bug in the + // virtio-pci driver. Reported: centos-7, ubuntu-18.04 + dprintf(1, "%s: using phys-bits=46 (old linux kernel compatibility)\n", __func__); + physbits = 46; + } + if (valid) CPUPhysBits = physbits; } -- 2.41.0

3 6

Regarding the contribution to the seabios project
by Aditya Patil Nov. 7, 2023

Nov. 7, 2023

I am attaching the patch with this email. The fixes were about the code optimizations in the Python scripts. These were mainly about file handling and this patch addresses the issues with file handling. Some of the files that were opened by the script were not closed. There has been an addition to the code optimization by using "with" statements providing more readable code.

2 2

Git Not working?
by Pvt Snafu Nov. 7, 2023

Nov. 7, 2023

I started getting intermittent 502 server errors last week when I checked for updates. Now I'm consistently getting them. Is the server misconfigured or failed? Does it need to be reset? Using https://git.seabios.org/seabios.git/ as my origin. If I check https://git.seabios.org/ in my browser, it redirects to coreboot.org and says to clone from ssh://review.coreboot.org:29418/seabios, but when I do that, it starts complaining about not having the key (I guess the ssh server mirror isn't configged for public access?) I'm not trying to submit anything, just looking to keep my repo up to date.

2 1