diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-06 17:18:13 +0800 |
|---|---|---|
| committer | Ard Biesheuvel <ardb@kernel.org> | 2026-08-01 15:58:57 +0300 |
| commit | 44e4ec1a802d2078743f7a77f46af3e2213a3b4e (patch) | |
| tree | 6d11f5fc850f928b8acd90ef6c49aa8b46fdbabf | |
| parent | b4c1bfc231521b627214bf654417bfef3721da79 (diff) | |
| download | linux-next-44e4ec1a802d2078743f7a77f46af3e2213a3b4e.tar.gz linux-next-44e4ec1a802d2078743f7a77f46af3e2213a3b4e.zip | |
efi: apple-properties: validate setup data header length
map_properties() remaps the Apple properties setup_data payload
and then reads the properties header fields.
Reject a truncated payload before checking the header version and length
fields.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
| -rw-r--r-- | drivers/firmware/efi/apple-properties.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c index 2e525e17fba7..f401a04edf4c 100644 --- a/drivers/firmware/efi/apple-properties.c +++ b/drivers/firmware/efi/apple-properties.c @@ -207,7 +207,10 @@ static int __init map_properties(void) } properties = (struct properties_header *)data->data; - if (properties->version != 1) { + if (data_len < sizeof(*properties)) { + pr_err("truncated properties header\n"); + ret = -EINVAL; + } else if (properties->version != 1) { pr_err("unsupported version:\n"); print_hex_dump(KERN_ERR, pr_fmt(), DUMP_PREFIX_OFFSET, 16, 1, properties, data_len, true); |