From patchwork Mon Apr 25 11:29:04 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Fleming X-Patchwork-Id: 66570 Delivered-To: patch@linaro.org Received: by 10.140.93.198 with SMTP id d64csp980364qge; Mon, 25 Apr 2016 04:29:10 -0700 (PDT) X-Received: by 10.98.42.211 with SMTP id q202mr47551945pfq.13.1461583750488; Mon, 25 Apr 2016 04:29:10 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id sj6si6553790pac.205.2016.04.25.04.29.10; Mon, 25 Apr 2016 04:29:10 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@codeblueprint-co-uk.20150623.gappssmtp.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754436AbcDYL3J (ORCPT + 3 others); Mon, 25 Apr 2016 07:29:09 -0400 Received: from mail-wm0-f48.google.com ([74.125.82.48]:37404 "EHLO mail-wm0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754298AbcDYL3I (ORCPT ); Mon, 25 Apr 2016 07:29:08 -0400 Received: by mail-wm0-f48.google.com with SMTP id n3so122350310wmn.0 for ; Mon, 25 Apr 2016 04:29:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codeblueprint-co-uk.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=1enW/QQUJo7X4NOm9wL3A3NGclvVwuiV1WLTDTV0jYk=; b=IyCryyhsj1EOpQbhtEMe4kEHHfUipRyJVifpCkEcwl7nIqleWiVVK5LJysBFOjKV60 LcRoUizQO2kf+Z51iqqIG0mw2BI1aFjwbSG8ndW6zYUUcOsaWXMg0e0t+qBxi9ZKrVX/ mcoc+x6TxEtG/8URVG36oAQEnDWy6dKTlzuY2xqqPzO572FNt+joG7HI7kJZ6jg1RZOb bSsnetDFW8CxTUfTH/J9HXCH/8iMgX8+pFKZMWTzW1c8aFaJ2is2uO2zxR3NkSEn7oWM KkMjgBlfsq8ot3cxk0pB6TuuGqkmT75N/Wdkti8yMtI5H8lNSSP9yipLwV3wXzloYR02 vTyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=1enW/QQUJo7X4NOm9wL3A3NGclvVwuiV1WLTDTV0jYk=; b=mkd8zHfg9aEE2WAJksupIqjsD9nIfpS7UlSFiUbRtEGGSH+Zqa4/KzGpoCjrKK+zTn 7uTqvIOAtfbDbGeazlM5Hcj2hqU34HFz07APnI8T5ojmlruyvBzHYMQhjaSvVyq03g0R r6ySZSHODF5bMn0XQBs8uHQMXEFhN7fogyh0kTYnsyegxIqhqOwYlw1W0eiS6GjGx0/1 1JYkQtFomZpcxIMI7YVeiDdIdPVM7++xUJe1prghc48g4yAhTchzGTIKKJcKOotSQPLv Q1JyliNnQ5+wA2D+iJIkKraalEl0BZ4lV//M1nFxQ0DZ66M99RixwlZYYTYC26n2FKwS hVXw== X-Gm-Message-State: AOPr4FXkf9TKF6s+9pZ6GZ4i5Wfcq3eQJiM53AKXpHUTmPWM0VXj2olplt+YrVjzqNA+MA== X-Received: by 10.28.216.83 with SMTP id p80mr10144594wmg.49.1461583745618; Mon, 25 Apr 2016 04:29:05 -0700 (PDT) Received: from localhost (bcdc58e5.skybroadband.com. [188.220.88.229]) by smtp.gmail.com with ESMTPSA id h124sm18201911wmf.7.2016.04.25.04.29.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Apr 2016 04:29:04 -0700 (PDT) From: Matt Fleming To: Ingo Molnar , Thomas Gleixner , "H . Peter Anvin" Cc: Laszlo Ersek , Ard Biesheuvel , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, Matt Fleming , Chris Wilson , Jani Nikula , Jason Andryuk , Matthew Garrett , Peter Jones , stable@vger.kernel.org Subject: [PATCH] efi: Fix out-of-bounds read in variable_matches() Date: Mon, 25 Apr 2016 12:29:04 +0100 Message-Id: <1461583744-32034-1-git-send-email-matt@codeblueprint.co.uk> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1461583602-31599-1-git-send-email-matt@codeblueprint.co.uk> References: <1461583602-31599-1-git-send-email-matt@codeblueprint.co.uk> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Laszlo Ersek The variable_matches() function can currently read "var_name[len]", for example when: - var_name[0] == 'a', - len == 1 - match_name points to the NUL-terminated string "ab". This function is supposed to accept "var_name" inputs that are not NUL-terminated (hence the "len" parameter"). Document the function, and access "var_name[*match]" only if "*match" is smaller than "len". Reported-by: Chris Wilson Signed-off-by: Laszlo Ersek Cc: Peter Jones Cc: Matthew Garrett Cc: Jason Andryuk Cc: Jani Nikula Cc: # v3.10+ Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906 Signed-off-by: Matt Fleming --- drivers/firmware/efi/vars.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) -- 2.7.3 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c index 0ac594c0a234..34b741940494 100644 --- a/drivers/firmware/efi/vars.c +++ b/drivers/firmware/efi/vars.c @@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { { NULL_GUID, "", NULL }, }; +/* + * Check if @var_name matches the pattern given in @match_name. + * + * @var_name: an array of @len non-NUL characters. + * @match_name: a NUL-terminated pattern string, optionally ending in "*". A + * final "*" character matches any trailing characters @var_name, + * including the case when there are none left in @var_name. + * @match: on output, the number of non-wildcard characters in @match_name + * that @var_name matches, regardless of the return value. + * @return: whether @var_name fully matches @match_name. + */ static bool variable_matches(const char *var_name, size_t len, const char *match_name, int *match) { for (*match = 0; ; (*match)++) { char c = match_name[*match]; - char u = var_name[*match]; - /* Wildcard in the matching name means we've matched */ - if (c == '*') + switch (c) { + case '*': + /* Wildcard in @match_name means we've matched. */ return true; - /* Case sensitive match */ - if (!c && *match == len) - return true; + case '\0': + /* @match_name has ended. Has @var_name too? */ + return (*match == len); - if (c != u) + default: + /* + * We've reached a non-wildcard char in @match_name. + * Continue only if there's an identical character in + * @var_name. + */ + if (*match < len && c == var_name[*match]) + continue; return false; - - if (!c) - return true; + } } - return true; } bool