efivars: Check size of user object
authorMatt Fleming <matt.fleming@intel.com>
Mon, 17 Mar 2014 09:17:28 +0000 (09:17 +0000)
committerMatt Fleming <matt.fleming@intel.com>
Thu, 17 Apr 2014 12:53:34 +0000 (13:53 +0100)
Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.

Cc: Mike Waychison <mikew@google.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
drivers/firmware/efi/efivars.c

index 06ec6ee1c58ace47ae0adb9caa3e98eb518010ec..2c21cccc25723920aa2275dd92844e910d682277 100644 (file)
@@ -347,6 +347,9 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
 
+       if (count != sizeof(*new_var))
+               return -EINVAL;
+
        attributes = new_var->Attributes;
        size = new_var->DataSize;
        data = new_var->Data;
@@ -395,6 +398,9 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
 
+       if (count != sizeof(*del_var))
+               return -EINVAL;
+
        name = del_var->VariableName;
        vendor = del_var->VendorGuid;