lkml.org 
[lkml]   [2014]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 2/5] efivars: Check size of user object
Date
From: Matt Fleming <matt.fleming@intel.com>

Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.

Signed-off-by: Matt Fleming <matt.fleming@intel.com>
---
drivers/firmware/efi/efivars.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 06ec6ee1c58a..2c21cccc2572 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;

+ if (count != sizeof(*new_var))
+ return -EINVAL;
+
attributes = new_var->Attributes;
size = new_var->DataSize;
data = new_var->Data;
@@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;

+ if (count != sizeof(*del_var))
+ return -EINVAL;
+
name = del_var->VariableName;
vendor = del_var->VendorGuid;

--
1.8.5.3


\
 
 \ /
  Last update: 2014-03-19 21:41    [W:0.049 / U:15.224 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site