diff options
| author | Matt Fleming <matt.fleming@intel.com> | 2014-03-17 09:17:28 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@linaro.org> | 2014-08-08 20:20:28 +0100 |
| commit | 04c1c34efab786ab524af83aaf378a3a799d1bdb (patch) | |
| tree | 36e3aab088c9760461198ca19eeda2e718f16ac2 | |
| parent | 50be1a9b5658cc698dcdd1feac2013fee7dab507 (diff) | |
efivars: Check size of user object
Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.
Cc: Mike Waychison <mikew@google.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
(cherry picked from commit e003bbee2a6a19a4c733335989284caf1b179e0d)
Signed-off-by: Mark Brown <broonie@linaro.org>
| -rw-r--r-- | drivers/firmware/efi/efivars.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c index 06ec6ee1c58a..2c21cccc2572 100644 --- a/drivers/firmware/efi/efivars.c +++ b/drivers/firmware/efi/efivars.c @@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj, if (!capable(CAP_SYS_ADMIN)) return -EACCES; + if (count != sizeof(*new_var)) + return -EINVAL; + attributes = new_var->Attributes; size = new_var->DataSize; data = new_var->Data; @@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj, if (!capable(CAP_SYS_ADMIN)) return -EACCES; + if (count != sizeof(*del_var)) + return -EINVAL; + name = del_var->VariableName; vendor = del_var->VendorGuid; |