1 files changed, 109 insertions, 17 deletions
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
index 2ef44e3a..103a1291 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -13,7 +13,7 @@
 
   InitCommunicateBuffer() is really function to check the variable data size.
 
-Copyright (c) 2010 - 2012, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2010 - 2013, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials 
 are licensed and made available under the terms and conditions of the BSD License 
 which accompanies this distribution.  The full text of the license may be found at 
@@ -52,7 +52,51 @@ EFI_SMM_COMMUNICATION_PROTOCOL  *mSmmCommunication          = NULL;
 UINT8                           *mVariableBuffer            = NULL;
 UINT8                           *mVariableBufferPhysical    = NULL;
 UINTN                            mVariableBufferSize;
+EFI_LOCK                         mVariableServicesLock;
 
+/**
+  Acquires lock only at boot time. Simply returns at runtime.
+
+  This is a temperary function that will be removed when
+  EfiAcquireLock() in UefiLib can handle the call in UEFI
+  Runtimer driver in RT phase.
+  It calls EfiAcquireLock() at boot time, and simply returns
+  at runtime.
+
+  @param  Lock         A pointer to the lock to acquire.
+
+**/
+VOID
+AcquireLockOnlyAtBootTime (
+  IN EFI_LOCK                             *Lock
+  )
+{
+  if (!EfiAtRuntime ()) {
+    EfiAcquireLock (Lock);
+  }
+}
+
+/**
+  Releases lock only at boot time. Simply returns at runtime.
+
+  This is a temperary function which will be removed when
+  EfiReleaseLock() in UefiLib can handle the call in UEFI
+  Runtimer driver in RT phase.
+  It calls EfiReleaseLock() at boot time and simply returns
+  at runtime.
+
+  @param  Lock         A pointer to the lock to release.
+
+**/
+VOID
+ReleaseLockOnlyAtBootTime (
+  IN EFI_LOCK                             *Lock
+  )
+{
+  if (!EfiAtRuntime ()) {
+    EfiReleaseLock (Lock);
+  }
+}
 
 /**
   Initialize the communicate buffer using DataSize and Function.
@@ -169,15 +213,27 @@ RuntimeServiceGetVariable (
   if ((*DataSize != 0) && (Data == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
+  if (*DataSize >= mVariableBufferSize) {
+    //
+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to
+    // overflow to a small value and pass the check in InitCommunicateBuffer().
+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.
+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.
+    //
+    return EFI_INVALID_PARAMETER;
+  }
+
+  AcquireLockOnlyAtBootTime(&mVariableServicesLock);
+
   //
   // Init the communicate buffer. The buffer data size is:
-  // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize + DataSize.
+  // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
   //
   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + StrSize (VariableName) + *DataSize;
   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_GET_VARIABLE);
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
   ASSERT (SmmVariableHeader != NULL);
 
@@ -205,11 +261,13 @@ RuntimeServiceGetVariable (
   }
 
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
 
   CopyMem (Data, (UINT8 *)SmmVariableHeader->Name + SmmVariableHeader->NameSize, SmmVariableHeader->DataSize);
 
+Done:
+  ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
   return Status;
 }
 
@@ -242,7 +300,19 @@ RuntimeServiceGetNextVariableName (
   if (VariableNameSize == NULL || VariableName == NULL || VendorGuid == NULL) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
+  if (*VariableNameSize >= mVariableBufferSize) {
+    //
+    // VariableNameSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to
+    // overflow to a small value and pass the check in InitCommunicateBuffer().
+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if VariableNameSize is >= mVariableBufferSize.
+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.
+    //
+    return EFI_INVALID_PARAMETER;
+  }
+
+  AcquireLockOnlyAtBootTime(&mVariableServicesLock);
+
   //
   // Init the communicate buffer. The buffer data size is:
   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
@@ -250,7 +320,7 @@ RuntimeServiceGetNextVariableName (
   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_GET_NEXT_VARIABLE_NAME, Name) + *VariableNameSize; 
   Status = InitCommunicateBuffer ((VOID **)&SmmGetNextVariableName, PayloadSize, SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME);
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
   ASSERT (SmmGetNextVariableName != NULL);
 
@@ -268,12 +338,14 @@ RuntimeServiceGetNextVariableName (
   //
   *VariableNameSize = SmmGetNextVariableName->NameSize;    
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
   
   CopyGuid (VendorGuid, &SmmGetNextVariableName->Guid);
   CopyMem (VariableName, SmmGetNextVariableName->Name, SmmGetNextVariableName->NameSize);  
 
+Done:
+  ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
   return Status;
 }
 
@@ -321,7 +393,19 @@ RuntimeServiceSetVariable (
   if (DataSize != 0 && Data == NULL) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
+  if (DataSize >= mVariableBufferSize) {
+    //
+    // DataSize may be near MAX_ADDRESS incorrectly, this can cause the computed PayLoadSize to
+    // overflow to a small value and pass the check in InitCommunicateBuffer().
+    // To protect against this vulnerability, return EFI_INVALID_PARAMETER if DataSize is >= mVariableBufferSize.
+    // And there will be further check to ensure the total size is also not > mVariableBufferSize.
+    //
+    return EFI_INVALID_PARAMETER;
+  }
+
+  AcquireLockOnlyAtBootTime(&mVariableServicesLock);
+ 
   //
   // Init the communicate buffer. The buffer data size is:
   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
@@ -329,7 +413,7 @@ RuntimeServiceSetVariable (
   PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + StrSize (VariableName) + DataSize;
   Status = InitCommunicateBuffer ((VOID **)&SmmVariableHeader, PayloadSize, SMM_VARIABLE_FUNCTION_SET_VARIABLE);
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
   ASSERT (SmmVariableHeader != NULL);
 
@@ -344,7 +428,9 @@ RuntimeServiceSetVariable (
   // Send data to SMM.
   //
   Status = SendCommunicateBuffer (PayloadSize);
- 
+
+Done:
+  ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
   return Status;
 }
 
@@ -382,7 +468,9 @@ RuntimeServiceQueryVariableInfo (
   if(MaximumVariableStorageSize == NULL || RemainingVariableStorageSize == NULL || MaximumVariableSize == NULL || Attributes == 0) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
+  AcquireLockOnlyAtBootTime(&mVariableServicesLock);
+
   //
   // Init the communicate buffer. The buffer data size is:
   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize;
@@ -390,7 +478,7 @@ RuntimeServiceQueryVariableInfo (
   PayloadSize = sizeof (SMM_VARIABLE_COMMUNICATE_QUERY_VARIABLE_INFO);
   Status = InitCommunicateBuffer ((VOID **)&SmmQueryVariableInfo, PayloadSize, SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO);
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
   ASSERT (SmmQueryVariableInfo != NULL);
 
@@ -401,7 +489,7 @@ RuntimeServiceQueryVariableInfo (
   //
   Status = SendCommunicateBuffer (PayloadSize);
   if (EFI_ERROR (Status)) {
-    return Status;
+    goto Done;
   }
 
   //
@@ -410,8 +498,10 @@ RuntimeServiceQueryVariableInfo (
   *MaximumVariableSize          = SmmQueryVariableInfo->MaximumVariableSize;
   *MaximumVariableStorageSize   = SmmQueryVariableInfo->MaximumVariableStorageSize;
   *RemainingVariableStorageSize = SmmQueryVariableInfo->RemainingVariableStorageSize; 
- 
-  return EFI_SUCCESS;
+
+Done:
+  ReleaseLockOnlyAtBootTime (&mVariableServicesLock);
+  return Status;
 }
 
 
@@ -608,7 +698,9 @@ VariableSmmRuntimeInitialize (
   VOID                                      *SmmVariableWriteRegistration;
   EFI_EVENT                                 OnReadyToBootEvent;
   EFI_EVENT                                 ExitBootServiceEvent;
-  
+
+  EfiInitializeLock (&mVariableServicesLock, TPL_NOTIFY);
+
   //
   // Smm variable service is ready
   //