diff options
| author | Toomas Soome <tsoome@FreeBSD.org> | 2026-02-21 15:27:35 +0000 |
|---|---|---|
| committer | Toomas Soome <tsoome@FreeBSD.org> | 2026-02-21 15:27:35 +0000 |
| commit | 23605a8e5124dcbd27aa3a8bfbca20ee2b179361 (patch) | |
| tree | 1933278e4b6afe97cdc7cd7210ffff9e8670d593 | |
| parent | f2186bbd63fc4185a42740dfee8c403e3d9b2ae9 (diff) | |
loader.efi: efi_redirect_exceptions does use uninitialized pointer
loader_idt.rd_base is not set when we are attempting to bcopy(),
resulting to data stored to page 0 and therefore corrupting it.
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D55180
| -rw-r--r-- | stand/efi/loader/arch/amd64/trap.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/stand/efi/loader/arch/amd64/trap.c b/stand/efi/loader/arch/amd64/trap.c index ffd84db40a3a..3fe86f7b1924 100644 --- a/stand/efi/loader/arch/amd64/trap.c +++ b/stand/efi/loader/arch/amd64/trap.c @@ -266,6 +266,7 @@ efi_redirect_exceptions(void) return (0); } loader_idt.rd_limit = fw_idt.rd_limit; + loader_idt.rd_base = lidt_pa; bcopy((void *)fw_idt.rd_base, (void *)loader_idt.rd_base, loader_idt.rd_limit); bzero(ist_use_table, sizeof(ist_use_table)); |