Commit 8f3603a2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull EFI fix from Ingo Molnar:
 "This fixes a bug in the efivars code"

* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  efi: Fix out-of-bounds read in variable_matches()
parents ba14e961 ede85e90

drivers/firmware/efi/vars.c

+26 −11
Original line number Diff line number Diff line
@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { 
	{ NULL_GUID, "", NULL },

};



/*

 * Check if @var_name matches the pattern given in @match_name.

 *

 * @var_name: an array of @len non-NUL characters.

 * @match_name: a NUL-terminated pattern string, optionally ending in "*". A

 *              final "*" character matches any trailing characters @var_name,

 *              including the case when there are none left in @var_name.

 * @match: on output, the number of non-wildcard characters in @match_name

 *         that @var_name matches, regardless of the return value.

 * @return: whether @var_name fully matches @match_name.

 */

static bool

variable_matches(const char *var_name, size_t len, const char *match_name,

		 int *match)

{

	for (*match = 0; ; (*match)++) {

		char c = match_name[*match];

		char u = var_name[*match];



		/* Wildcard in the matching name means we've matched */

		if (c == '*')

		switch (c) {

		case '*':

			/* Wildcard in @match_name means we've matched. */

			return true;



		/* Case sensitive match */

		if (!c && *match == len)

			return true;

		case '\0':

			/* @match_name has ended. Has @var_name too? */

			return (*match == len);



		if (c != u)

		default:

			/*

			 * We've reached a non-wildcard char in @match_name.

			 * Continue only if there's an identical character in

			 * @var_name.

			 */

			if (*match < len && c == var_name[*match])

				continue;

			return false;



		if (!c)

			return true;

		}

	return true;

	}

}



bool