Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e003bbee authored by Matt Fleming's avatar Matt Fleming
Browse files

efivars: Check size of user object 



Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.

Cc: Mike Waychison <mikew@google.com>
Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
parent bafc84d5

drivers/firmware/efi/efivars.c

+6 −0
Original line number Diff line number Diff line
@@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj, 
	if (!capable(CAP_SYS_ADMIN))

		return -EACCES;



	if (count != sizeof(*new_var))

		return -EINVAL;



	attributes = new_var->Attributes;

	size = new_var->DataSize;

	data = new_var->Data;
@@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj, 
	if (!capable(CAP_SYS_ADMIN))

		return -EACCES;



	if (count != sizeof(*del_var))

		return -EINVAL;



	name = del_var->VariableName;

	vendor = del_var->VendorGuid;