Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932341AbcCBBUr (ORCPT ); Tue, 1 Mar 2016 20:20:47 -0500 Received: from mail333.us4.mandrillapp.com ([205.201.137.77]:34623 "EHLO mail333.us4.mandrillapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755548AbcCAXz2 (ORCPT ); Tue, 1 Mar 2016 18:55:28 -0500 DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=linuxfoundation.org; b=IVoDCAM8m1dZzemwMP3FMqmEIAlYK8sG5rmE+WTmNRNTWC7zVPoDyFzN/rgAbJkFAwijUHyxFEXU EdtHQsXSCyB1YHr5qAbynvvm63CZqO/Ix+qDv24spkq35+4ppon6P7UGO0HJP07P2r7vuts/iBPx UZ8XSgVEhZChtLlhvj0=; From: Greg Kroah-Hartman Subject: [PATCH 4.4 057/342] efi: Do variable name validation tests in utf8 X-Mailer: git-send-email 2.7.2 To: Cc: Greg Kroah-Hartman , , Peter Jones , Matthew Garrett , "Lee, Chun-Yi" , Matt Fleming Message-Id: <20160301234529.849769499@linuxfoundation.org> In-Reply-To: <20160301234527.990448862@linuxfoundation.org> References: <20160301234527.990448862@linuxfoundation.org> X-Report-Abuse: Please forward a copy of this message, including all headers, to abuse@mandrill.com X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30481620.7e9f687c7e4446c681753f2aab235f4c X-Mandrill-User: md_30481620 Date: Tue, 01 Mar 2016 23:54:02 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2286 Lines: 84 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Peter Jones commit 3dcb1f55dfc7631695e69df4a0d589ce5274bd07 upstream. Actually translate from ucs2 to utf8 before doing the test, and then test against our other utf8 data, instead of fudging it. Signed-off-by: Peter Jones Acked-by: Matthew Garrett Tested-by: Lee, Chun-Yi Signed-off-by: Matt Fleming Signed-off-by: Greg Kroah-Hartman --- drivers/firmware/efi/vars.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) --- a/drivers/firmware/efi/vars.c +++ b/drivers/firmware/efi/vars.c @@ -189,10 +189,19 @@ static const struct variable_validate va }; bool -efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len) +efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long data_size) { int i; - u16 *unicode_name = var_name; + unsigned long utf8_size; + u8 *utf8_name; + + utf8_size = ucs2_utf8size(var_name); + utf8_name = kmalloc(utf8_size + 1, GFP_KERNEL); + if (!utf8_name) + return false; + + ucs2_as_utf8(utf8_name, var_name, utf8_size); + utf8_name[utf8_size] = '\0'; for (i = 0; variable_validate[i].validate != NULL; i++) { const char *name = variable_validate[i].name; @@ -200,28 +209,29 @@ efivar_validate(efi_char16_t *var_name, for (match = 0; ; match++) { char c = name[match]; - u16 u = unicode_name[match]; - - /* All special variables are plain ascii */ - if (u > 127) - return true; + char u = utf8_name[match]; /* Wildcard in the matching name means we've matched */ - if (c == '*') + if (c == '*') { + kfree(utf8_name); return variable_validate[i].validate(var_name, - match, data, len); + match, data, data_size); + } /* Case sensitive match */ if (c != u) break; /* Reached the end of the string while matching */ - if (!c) + if (!c) { + kfree(utf8_name); return variable_validate[i].validate(var_name, - match, data, len); + match, data, data_size); + } } } + kfree(utf8_name); return true; } EXPORT_SYMBOL_GPL(efivar_validate);