EFI: re-check {get,set}-variable name strings after copying in
authorJan Beulich <jbeulich@suse.com>
Thu, 5 Mar 2020 10:33:26 +0000 (11:33 +0100)
committerJan Beulich <jbeulich@suse.com>
Thu, 5 Mar 2020 10:33:26 +0000 (11:33 +0100)
commita4f502e03023253a14fe1ed06ab7011a0f08e647
treebb506b2c4c935f40eb3123198157568c59c3d010
parent5abd2611893fc1c0a4ab642b5a1effa56186abad
EFI: re-check {get,set}-variable name strings after copying in

A malicious guest given permission to invoke XENPF_efi_runtime_call may
play with the strings underneath Xen sizing them and copying them in.
Guard against this by re-checking the copyied in data for consistency
with the initial sizing. At the same time also check that the actual
copy-in is in fact successful, and switch to the lighter weight non-
checking flavor of the function.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
master commit: ad38db5852f0e30d90c93c6a62b754f2861549e0
master date: 2020-02-06 09:51:17 +0100
xen/common/efi/runtime.c