From a3c5ba3ca71c6c6a72a4ab1ef244d3b4acfb83a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ky=C3=B6sti=20M=C3=A4lkki?= Date: Wed, 27 Nov 2013 17:51:31 +0200 Subject: [PATCH] CBMEM console: Prevent buffer overrun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Make sure memcpy target and a possible message telling log was truncated stay within the allocated region for CBMEM console. This fixes observed CBMEM corruption on platforms that do not use CBMEM console during romstage. Those platforms will need an additional fix to reset cursor position to zero on s3 resume. Change-Id: I76501ca3afc716545ca76ebca1119995126a43f8 Signed-off-by: Kyösti Mälkki Reviewed-on: http://review.coreboot.org/4292 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel Reviewed-by: Idwer Vollering Reviewed-by: Martin Roth --- src/lib/cbmem_console.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/src/lib/cbmem_console.c b/src/lib/cbmem_console.c index dd883008bf..ac1d8bbd7e 100644 --- a/src/lib/cbmem_console.c +++ b/src/lib/cbmem_console.c @@ -113,27 +113,39 @@ void cbmemc_tx_byte(unsigned char data) */ static void copy_console_buffer(struct cbmem_console *new_cons_p) { - u32 copy_size; + u32 copy_size, dropped_chars; u32 cursor = new_cons_p->buffer_cursor; struct cbmem_console *old_cons_p; - int overflow; old_cons_p = current_console(); - overflow = old_cons_p->buffer_cursor > old_cons_p->buffer_size; + if (old_cons_p->buffer_cursor < old_cons_p->buffer_size) + copy_size = old_cons_p->buffer_cursor; + else + copy_size = old_cons_p->buffer_size; - copy_size = overflow ? - old_cons_p->buffer_size : old_cons_p->buffer_cursor; + if (cursor > new_cons_p->buffer_size) + copy_size = 0; + else if (cursor + copy_size > new_cons_p->buffer_size) + copy_size = new_cons_p->buffer_size - cursor; + + dropped_chars = old_cons_p->buffer_cursor - copy_size; + if (dropped_chars) { + /* Reserve 80 chars to report overflow, if possible. */ + if (copy_size < 80) + return; + copy_size -= 80; + dropped_chars += 80; + } memcpy(new_cons_p->buffer_body + cursor, old_cons_p->buffer_body, copy_size); cursor += copy_size; - if (overflow) { + if (dropped_chars) { const char loss_str1[] = "\n\n*** Log truncated, "; const char loss_str2[] = " characters dropped. ***\n\n"; - u32 dropped_chars = old_cons_p->buffer_cursor - copy_size; /* * When running from ROM sprintf is not available, a simple