Skip to content

Commit

Permalink
efivars: Check size of user object
Browse files Browse the repository at this point in the history
Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.

Cc: Mike Waychison <mikew@google.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
  • Loading branch information
Matt Fleming committed Apr 17, 2014
1 parent bafc84d commit e003bbe
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions drivers/firmware/efi/efivars.c
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;

if (count != sizeof(*new_var))
return -EINVAL;

attributes = new_var->Attributes;
size = new_var->DataSize;
data = new_var->Data;
Expand Down Expand Up @@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
if (!capable(CAP_SYS_ADMIN))
return -EACCES;

if (count != sizeof(*del_var))
return -EINVAL;

name = del_var->VariableName;
vendor = del_var->VendorGuid;

Expand Down

0 comments on commit e003bbe

Please sign in to comment.