aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatt Fleming <matt.fleming@intel.com>2014-03-17 09:17:28 +0000
committerMark Brown <broonie@linaro.org>2014-07-23 21:06:47 +0100
commitf5f59ce673a0071e6bad70a5108d49191f60f812 (patch)
treef7aaf1fe25e6342486771e2ad440ddd1e9c2f9a8
parent0a421a5ce423f9c06f515067e625349a3b19e112 (diff)
downloadlinux-linaro-stable-f5f59ce673a0071e6bad70a5108d49191f60f812.tar.gz
efivars: Check size of user object
Unbelieavably there are no checks to see whether the data structure passed to 'new_var' and 'del_var' is the size that we expect. Let's add some for better robustness. Cc: Mike Waychison <mikew@google.com> Signed-off-by: Matt Fleming <matt.fleming@intel.com> (cherry picked from commit e003bbee2a6a19a4c733335989284caf1b179e0d) Signed-off-by: Mark Brown <broonie@linaro.org>
-rw-r--r--drivers/firmware/efi/efivars.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 06ec6ee1c58a..2c21cccc2572 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
+ if (count != sizeof(*new_var))
+ return -EINVAL;
+
attributes = new_var->Attributes;
size = new_var->DataSize;
data = new_var->Data;
@@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
+ if (count != sizeof(*del_var))
+ return -EINVAL;
+
name = del_var->VariableName;
vendor = del_var->VendorGuid;