On Mon, 2013-04-08 at 10:50 +0100, Luis Henriques wrote: > 3.5.7.10 -stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Matt Fleming <matt.fleming@xxxxxxxxx> > > commit ec50bd32f1672d38ddce10fb1841cbfda89cfe9a upstream. > > It's not wise to assume VariableNameSize represents the length of > VariableName, as not all firmware updates VariableNameSize in the same > way (some don't update it at all if EFI_SUCCESS is returned). There > are even implementations out there that update VariableNameSize with > values that are both larger than the string returned in VariableName > and smaller than the buffer passed to GetNextVariableName(), which > resulted in the following bug report from Michael Schroeder, > > > On HP z220 system (firmware version 1.54), some EFI variables are > > incorrectly named : > > > > ls -d /sys/firmware/efi/vars/*8be4d* | grep -v -- -8be returns > > /sys/firmware/efi/vars/dbxDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/KEKDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/SecureBoot-pport8be4df61-93ca-11d2-aa0d-00e098032b8c > > /sys/firmware/efi/vars/SetupMode-Information8be4df61-93ca-11d2-aa0d-00e098032b8c > > The issue here is that because we blindly use VariableNameSize without > verifying its value, we can potentially read garbage values from the > buffer containing VariableName if VariableNameSize is larger than the > length of VariableName. > > Since VariableName is a string, we can calculate its size by searching > for the terminating NULL character. > > Reported-by: Frederic Crozat <fcrozat@xxxxxxxx> > Cc: Matthew Garrett <mjg59@xxxxxxxxxxxxx> > Cc: Josh Boyer <jwboyer@xxxxxxxxxx> > Cc: Michael Schroeder <mls@xxxxxxxx> > Cc: Lee, Chun-Yi <jlee@xxxxxxxx> > Cc: Lingzhu Xiang <lxiang@xxxxxxxxxx> > Cc: Seiji Aguchi <seiji.aguchi@xxxxxxx> > Signed-off-by: Matt Fleming <matt.fleming@xxxxxxxxx> > [ Backported for 3.4-stable. Removed workqueue code added in a93bc0c 3.9-rc1. ] [...] I thought the workqueue addition was a worthwhile fix in its own right, so for 3.2.y I cherry-picked that as well. Ben. -- Ben Hutchings Life would be so much easier if we could look at the source code.
Attachment:
signature.asc
Description: This is a digitally signed message part