diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-06 17:18:13 +0800 |
|---|---|---|
| committer | Ard Biesheuvel <ardb@kernel.org> | 2026-08-20 14:49:39 +0300 |
| commit | eb01ffabeb52251f821c18438af8a65391f7ac79 (patch) | |
| tree | a6335546f563e9dbcd3a0eb9695a28c602126b62 /drivers | |
| parent | 01787ed2fde4ac42bc35339dae799a5abb094ed0 (diff) | |
efi: apple-properties: validate setup data header length
map_properties() remaps the Apple properties setup_data payload
and then reads the properties header fields.
Reject a truncated payload before checking the header version and length
fields.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/firmware/efi/apple-properties.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c index 2e525e17fba7..f401a04edf4c 100644 --- a/drivers/firmware/efi/apple-properties.c +++ b/drivers/firmware/efi/apple-properties.c @@ -207,7 +207,10 @@ static int __init map_properties(void) } properties = (struct properties_header *)data->data; - if (properties->version != 1) { + if (data_len < sizeof(*properties)) { + pr_err("truncated properties header\n"); + ret = -EINVAL; + } else if (properties->version != 1) { pr_err("unsupported version:\n"); print_hex_dump(KERN_ERR, pr_fmt(), DUMP_PREFIX_OFFSET, 16, 1, properties, data_len, true); |