| Subject | Re: [PATCH 097/102] efivars: explicitly calculate length of VariableName | From | Ben Hutchings <> | Date | Tue, 09 Apr 2013 23:45:06 +0100 |
| |
On Mon, 2013-04-08 at 10:50 +0100, Luis Henriques wrote: > 3.5.7.10 -stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Matt Fleming <matt.fleming@intel.com> > > commit ec50bd32f1672d38ddce10fb1841cbfda89cfe9a upstream. > > It's not wise to assume VariableNameSize represents the length of > VariableName, as not all firmware updates VariableNameSize in the same > way (some don't update it at all if EFI_SUCCESS is returned). There > are even implementations out there that update VariableNameSize with > values that are both larger than the string returned in VariableName > and smaller than the buffer passed to GetNextVariableName(), which > resulted in the following bug report from Michael Schroeder, > > > On HP z220 system (firmware version 1.54), some EFI variables are > > incorrectly named : > > > > ls -d /sys/firmware/efi/vars/*8be4d* | grep -v -- -8be returns > > /sys/firmware/efi/vars/dbxDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/KEKDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/SecureBoot-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/SetupMode-Information8be4df61-93ca-11d2-aa0d-00e098032b8c > > The issue here is that because we blindly use VariableNameSize without > verifying its value, we can potentially read garbage values from the > buffer containing VariableName if VariableNameSize is larger than the > length of VariableName. > > Since VariableName is a string, we can calculate its size by searching > for the terminating NULL character. > > Reported-by: Frederic Crozat <fcrozat@suse.com> > Cc: Matthew Garrett <mjg59@srcf.ucam.org> > Cc: Josh Boyer <jwboyer@redhat.com> > Cc: Michael Schroeder <mls@suse.com> > Cc: Lee, Chun-Yi <jlee@suse.com> > Cc: Lingzhu Xiang <lxiang@redhat.com> > Cc: Seiji Aguchi <seiji.aguchi@hds.com> > Signed-off-by: Matt Fleming <matt.fleming@intel.com> > [ Backported for 3.4-stable. Removed workqueue code added in a93bc0c 3.9-rc1. ] [...]
I thought the workqueue addition was a worthwhile fix in its own right, so for 3.2.y I cherry-picked that as well.
Ben.
-- Ben Hutchings Life would be so much easier if we could look at the source code. [unhandled content-type:application/pgp-signature] |