diff mbox series

[5.5,114/151] efi: Add a sanity check to efivar_store_raw()

Message ID	20200317103334.571691754@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=f8y2=5C=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Vladis Dronov <vdronov@redhat.com>, Ard Biesheuvel <ardb@kernel.org>, Ingo Molnar <mingo@kernel.org> Subject: [PATCH 5.5 114/151] efi: Add a sanity check to efivar_store_raw() Date: Tue, 17 Mar 2020 11:55:24 +0100 Message-Id: <20200317103334.571691754@linuxfoundation.org> In-Reply-To: <20200317103326.593639086@linuxfoundation.org> References: <20200317103326.593639086@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.5,003/151] ALSA: hda/realtek - Add Headset Mic supported for HP cPC [5.5,005/151] cgroup, netclassid: periodically release file_lock on classid updating [5.5,008/151] inet_diag: return classid for all socket types [5.5,009/151] ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface [5.5,010/151] ipvlan: add cond_resched_rcu() while processing muticast backlog [5.5,012/151] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() [5.5,013/151] ipvlan: dont deref eth hdr before checking its set [5.5,019/151] net/ipv6: use configured metric when add peer route [5.5,021/151] net: macsec: update SCI upon MAC address change. [5.5,025/151] net: phy: bcm63xx: fix OOPS due to missing driver name [5.5,026/151] net/smc: cancel event worker during device removal [5.5,028/151] net: systemport: fix index check to avoid an array out of bounds access [5.5,030/151] sfc: detach from cb_page in efx_copy_channel() [5.5,032/151] taprio: Fix sending packets without dequeueing them [5.5,034/151] bnxt_en: reinitialize IRQs when MTU is modified [5.5,036/151] cgroup: memcg: net: do not associate sock with unrelated cgroup [5.5,038/151] net: memcg: fix lockdep splat in inet_csk_accept() [5.5,041/151] fsl/fman: detect FMan erratum A050385 [5.5,042/151] dpaa_eth: FMan erratum A050385 workaround [5.5,043/151] net: hns3: fix "tc qdisc del" failed issue [5.5,045/151] net: hns3: clear port base VLAN when unload PF [5.5,047/151] devlink: validate length of region addr/len [5.5,050/151] nl802154: add missing attribute validation for dev_type [5.5,051/151] can: add missing attribute validation for termination [5.5,053/151] openvswitch: add missing attribute validation for hash [5.5,056/151] team: add missing attribute validation for port ifindex [5.5,057/151] team: add missing attribute validation for array index [5.5,059/151] nfc: add missing attribute validation for SE API [5.5,062/151] net: phy: avoid clearing PHY interrupts twice in irq handler [5.5,063/151] net: phy: fix MDIO bus PM PHY resuming [5.5,064/151] net/ipv6: need update peer route when modify metric [5.5,066/151] selftests/net/fib_tests: update addr_metric_test for peer route testing [5.5,068/151] s390/qeth: handle error when backing RX buffer [5.5,069/151] net: dsa: Dont instantiate phylink for CPU/DSA ports unless needed [5.5,071/151] net: phy: Avoid multiple suspends [5.5,073/151] cgroup: cgroup_procs_next should increase position index [5.5,076/151] iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices [5.5,079/151] netfilter: nf_conntrack: ct_cpu_seq_next should increase position index [5.5,080/151] netfilter: synproxy: synproxy_cpu_seq_next should increase position index [5.5,082/151] netfilter: x_tables: xt_mttg_seq_next should increase position index [5.5,086/151] drm/i915: Return early for await_start on same timeline [5.5,087/151] drm/i915: be more solid in checking the alignment [5.5,088/151] drm/i915: Defer semaphore priority bumping to a workqueue [5.5,090/151] drm/i915/execlists: Enable timeslice on partial virtual engine dequeue [5.5,092/151] pinctrl: falcon: fix syntax error [5.5,093/151] pinctrl: qcom: Assign irq_eoi conditionally [5.5,096/151] cifs_atomic_open(): fix double-put on late allocation failure [5.5,098/151] KVM: x86: clear stale x86_emulate_ctxt->intercept value [5.5,100/151] ARC: define __ALIGN_STR and __ALIGN symbols for ARC [5.5,101/151] fuse: fix stack use after return [5.5,103/151] MIPS: DTS: CI20: fix interrupt for pcf8563 RTC [5.5,105/151] s390/dasd: fix data corruption for thin provisioned devices [5.5,106/151] ipmi_si: Avoid spurious errors for optional IRQs [5.5,109/151] fscrypt: dont evict dirty inodes after removing key [5.5,110/151] pid: Fix error return value in some cases [5.5,112/151] x86/ioremap: Map EFI runtime services data as encrypted for SEV [5.5,114/151] efi: Add a sanity check to efivar_store_raw() [5.5,116/151] mt76: fix array overflow on receiving too many fragments for a packet [5.5,117/151] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag [5.5,120/151] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint [5.5,122/151] iommu/vt-d: Fix RCU list debugging warnings [5.5,126/151] pinctrl: meson-gxl: fix GPIOX sdio pins [5.5,127/151] pinctrl: imx: scu: Align imx sc msg structs to 4 [5.5,128/151] virtio_ring: Fix mem leak with vring_new_virtqueue() [5.5,131/151] pinctrl: core: Remove extra kref_get which blocks hogs being freed [5.5,133/151] driver code: clarify and fix platform device DMA mask allocation [5.5,135/151] i2c: gpio: suppress error on probe defer [5.5,137/151] nl80211: add missing attribute validation for beacon report scanning [5.5,139/151] perf bench futex-wake: Restore thread count default to online CPU count [5.5,141/151] netfilter: cthelper: add missing attribute validation for cthelper [5.5,144/151] netfilter: nf_tables: dump NFTA_CHAIN_FLAGS attribute [5.5,145/151] netfilter: nft_chain_nat: inet family is missing module ownership [5.5,147/151] iommu/vt-d: Ignore devices with out-of-spec domain number [5.5,149/151] iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE

Commit Message

Greg Kroah-Hartman March 17, 2020, 10:55 a.m. UTC

From: Vladis Dronov <vdronov@redhat.com>

commit d6c066fda90d578aacdf19771a027ed484a79825 upstream.

Add a sanity check to efivar_store_raw() the same way
efivar_{attr,size,data}_read() and efivar_show_raw() have it.

Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200305084041.24053-3-vdronov@redhat.com
Link: https://lore.kernel.org/r/20200308080859.21568-25-ardb@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/firmware/efi/efivars.c |    3 +++
 1 file changed, 3 insertions(+)

diff mbox series

Patch

--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -208,6 +208,9 @@  efivar_store_raw(struct efivar_entry *en
 	u8 *data;
 	int err;
 
+	if (!entry || !buf)
+		return -EINVAL;
+
 	if (in_compat_syscall()) {
 		struct compat_efi_variable *compat;