EFI fix
Linus,
Please pull the latest efi-urgent-for-linus git tree from:
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git efi-urgent-for-linus
# HEAD: ede85e90be26e5de2a72f76feec01cfc5281d4bd Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into efi/urgent
This fixes a bug in the efivars code.
Thanks,
Ingo
------------------>
Laszlo Ersek (1):
efi: Fix out-of-bounds read in variable_matches()
drivers/firmware/efi/vars.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-)
drivers/firmware/efi/vars.c +26 -11
@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { { NULL_GUID, "", NULL }, }; +/* +* Check if @var_name matches the pattern given in @match_name. +* +* @var_name: an array of @len non-NUL characters. +* @match_name: a NUL-terminated pattern string, optionally ending in "*". A +* final "*" character matches any trailing characters @var_name, +* including the case when there are none left in @var_name. +* @match: on output, the number of non-wildcard characters in @match_name +* that @var_name matches, regardless of the return value. +* @return: whether @var_name fully matches @match_name. +*/ static bool variable_matches (const char *var_name,size_t len,const char *match_name,int *match) {for (*match =0 ; ; (*match)++) {char c = match_name[*match]; -char u = var_name[*match]; -/* Wildcard in the matching name means we've matched */ -if (c =='*' ) +switch (c) { +case '*' : +/* Wildcard in @match_name means we've matched. */ return true; -/* Case sensitive match */ -if (!c && *match == len) -return true; +case '\0' : +/* @match_name has ended. Has @var_name too? */ +return (*match == len); -if (c != u) +default : +/* +* We've reached a non-wildcard char in @match_name. +* Continue only if there's an identical character in +* @var_name. +*/ +if (*match < len && c == var_name[*match]) +continue ;return false; - -if (!c) -return true; + } } -return true; }bool