efivars: Check size of user object
Unbelieavably there are no checks to see whether the data structure
passed to 'new_var' and 'del_var' is the size that we expect. Let's add
some for better robustness.
Cc: Mike Waychison <mikew@google.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 06ec6ee..2c21ccc 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -347,6 +347,9 @@
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
+ if (count != sizeof(*new_var))
+ return -EINVAL;
+
attributes = new_var->Attributes;
size = new_var->DataSize;
data = new_var->Data;
@@ -395,6 +398,9 @@
if (!capable(CAP_SYS_ADMIN))
return -EACCES;
+ if (count != sizeof(*del_var))
+ return -EINVAL;
+
name = del_var->VariableName;
vendor = del_var->VendorGuid;
