Skip to content

UefiTestingPkg: Fix memory info database dump - #925

Merged
makubacki merged 1 commit into
microsoft:release/202511from
makubacki:924_paging_audit_fix
Jul 24, 2026
Merged

UefiTestingPkg: Fix memory info database dump#925
makubacki merged 1 commit into
microsoft:release/202511from
makubacki:924_paging_audit_fix

Conversation

@makubacki

@makubacki makubacki commented Jul 24, 2026

Copy link
Copy Markdown
Member

Description

Fixes: #924

Memory info is stored in mMemoryInfoDatabaseBuffer. The code first calculates how large of a buffer is needed. A "dry run" is performed to compute that. It calls each dump handler with AllowAllocation=FALSE, to get the size of the data that would be written.

However, the call to LoadedImageTableDump() during this phase, sets AllowAllocation=TRUE. mMemoryInfoDatabaseOffset is still NULL, then AppendMemoryInfoDatabase() sees that and allocates a buffer.

Now, mMemoryInfoDatabaseSize is advanced. Other dump handlers after write to the buffer now that it exists.

Eventually, DumpPagingInfo() allocates the real (intended) buffer. Because of what happened earlier, the "accidental" buffer is leaked and mMemoryInfoDatabaseSize is non-zero which causes mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize] to write past the beginning of the buffer:

  // Copy the new string to the end of the buffer and update the size.
  if (!EFI_ERROR (Status)) {
    CopyMem (&mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize], DatabaseString, NewStringSize);
    mMemoryInfoDatabaseSize = NewDatabaseSize;
  }

This change sets AllowAllocation=FALSE in that call and resets mMemoryInfoDatabaseSize to zero before the real allocation as a precaution.

  • Impacts functionality?
  • Impacts security?
  • Breaking change?
  • Includes tests?
  • Includes documentation?

How This Was Tested

  1. Before - Reproduce the problem:

    image
    (venv) paging>python PagingReportGenerator.py -i ..\collection_data -o report1.html
    Traceback (most recent call last):
      File "paging\PagingReportGenerator.py", line 312, in <module>
        retcode = main()
      File "paging\PagingReportGenerator.py", line 294, in main
        spt.Parse()
        ~~~~~~~~~^^
      File "paging\PagingReportGenerator.py", line 79, in Parse
        self.MemoryRangeInfo.extend(ParseInfoFile(info))
                                    ~~~~~~~~~~~~~^^^^^^
      File "paging\BinaryParsing.py", line 38, in ParseInfoFile
        MemoryRanges.append(MemoryRange(row[0], *row[1:]))
                            ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
      File "paging\MemoryRangeObjects.py", line 126, in __init__
        raise RuntimeError("Unknown type '%s' found!" % self.RecordType)
    RuntimeError: Unknown type 'MemoryMap' found!
    
  2. After - Verify the problem no longer exists:

    image
    python Windows\PagingReportGenerator.py -i ../collection_data -o report1.html
    

Integration Instructions

  • N/A

Fixes: microsoft#924

Memory info is stored in `mMemoryInfoDatabaseBuffer`. The code first
calculates how large of a buffer is needed. A "dry run" is performed
to compute that. It calls each dump handler with `AllowAllocation=FALSE`,
to get the size of the data that would be written.

However, the call to `LoadedImageTableDump()` during this phase, seets
`AllowAllocation=TRUE`. `mMemoryInfoDatabaseOffset` is still `NULL`,
then `AppendMemoryInfoDatabase()` sees that and allocates a buffer.

Now, `mMemoryInfoDatabaseSize` is advanced. Other dump handlers after
write to the buffer now that it exists.

Eventually, `DumpPagingInfo()` allocates the real (intended) buffer.
Because of what happened earlier, the "accidental" buffer is leaked
and `mMemoryInfoDatabaseSize` is non-zero which causes
`mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize]` to write past the
beginning of the buffer:

```c
  // Copy the new string to the end of the buffer and update the size.
  if (!EFI_ERROR (Status)) {
    CopyMem (&mMemoryInfoDatabaseBuffer[mMemoryInfoDatabaseSize], DatabaseString, NewStringSize);
    mMemoryInfoDatabaseSize = NewDatabaseSize;
  }
```

This change sets `AllowAllocation=FALSE` in that call and resets
`mMemoryInfoDatabaseSize` to zero before the real allocation as a
precaution.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
@makubacki
makubacki requested review from apop5, kuqin12 and os-d July 24, 2026 15:20
@makubacki makubacki self-assigned this Jul 24, 2026
@makubacki makubacki added the type:bug Something isn't working label Jul 24, 2026
@mu-automation

mu-automation Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

✅ QEMU Validation Passed

Source Dependencies

Repository Commit
mu_plus d76d97e
mu_tiano_platforms d8ecfb8

Results

Platform Target Build Boot Overall Boot Time Build Logs Boot Logs
Q35 DEBUG ✅ success ✅ success 0m 19s Build Logs Boot Logs
ArmVirt DEBUG ✅ success ✅ success 0m 14s Build Logs Boot Logs

Workflow run: https://github.com/microsoft/mu_plus/actions/runs/30105774308

This comment was automatically generated by the Mu QEMU PR Validation workflow.

@makubacki
makubacki merged commit 87ca875 into microsoft:release/202511 Jul 24, 2026
44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type:bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Paging audit tests write corrupted data

4 participants