/* * We allow each variable to be edited via rewriting the * entire efi variable structure. */ static ssize_t efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) { struct efi_variable *new_var, *var = &entry->var; struct efivars *efivars = entry->efivars; efi_status_t status = EFI_NOT_FOUND; if (count != sizeof(struct efi_variable)) return -EINVAL; new_var = (struct efi_variable *)buf; /* * If only updating the variable data, then the name * and guid should remain the same */ if (memcmp(new_var->VariableName, var->VariableName, sizeof(var->VariableName)) || efi_guidcmp(new_var->VendorGuid, var->VendorGuid)) { printk(KERN_ERR "efivars: Cannot edit the wrong variable!\n"); return -EINVAL; } if ((new_var->DataSize <= 0) || (new_var->Attributes == 0)){ printk(KERN_ERR "efivars: DataSize & Attributes must be valid!\n"); return -EINVAL; } if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 || validate_var(new_var, new_var->Data, new_var->DataSize) == false) { printk(KERN_ERR "efivars: Malformed variable content\n"); return -EINVAL; } spin_lock_irq(&efivars->lock); status = check_var_size_locked(efivars, new_var->Attributes, new_var->DataSize + utf16_strsize(new_var->VariableName, 1024)); if (status == EFI_SUCCESS || status == EFI_UNSUPPORTED) status = efivars->ops->set_variable(new_var->VariableName, &new_var->VendorGuid, new_var->Attributes, new_var->DataSize, new_var->Data); spin_unlock_irq(&efivars->lock); if (status != EFI_SUCCESS) { printk(KERN_WARNING "efivars: set_variable() failed: status=%lx\n", status); return -EIO; } memcpy(&entry->var, new_var, count); return count; }
static bool validate_load_option(struct efi_variable *var, int match, u8 *buffer, unsigned long len) { u16 filepathlength; int i, desclength = 0, namelen; namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName)); /* Either "Boot" or "Driver" followed by four digits of hex */ for (i = match; i < match+4; i++) { if (var->VariableName[i] > 127 || hex_to_bin(var->VariableName[i] & 0xff) < 0) return true; } /* Reject it if there's 4 digits of hex and then further content */ if (namelen > match + 4) return false; /* A valid entry must be at least 8 bytes */ if (len < 8) return false; filepathlength = buffer[4] | buffer[5] << 8; /* * There's no stored length for the description, so it has to be * found by hand */ desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2; /* Each boot entry must have a descriptor */ if (!desclength) return false; /* * If the sum of the length of the description, the claimed filepath * length and the original header are greater than the length of the * variable, it's malformed */ if ((desclength + filepathlength + 6) > len) return false; /* * And, finally, check the filepath */ return validate_device_path(var, match, buffer + desclength + 6, filepathlength); }
static bool validate_load_option(struct efi_variable *var, int match, u8 *buffer, unsigned long len) { u16 filepathlength; int i, desclength = 0, namelen; namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName)); for (i = match; i < match+4; i++) { if (var->VariableName[i] > 127 || hex_to_bin(var->VariableName[i] & 0xff) < 0) return true; } if (namelen > match + 4) return false; if (len < 8) return false; filepathlength = buffer[4] | buffer[5] << 8; desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2; if (!desclength) return false; if ((desclength + filepathlength + 6) > len) return false; return validate_device_path(var, match, buffer + desclength + 6, filepathlength); }