EFI: re-check {get,set}-variable name strings after copying in
authorJan Beulich <jbeulich@suse.com>
Thu, 6 Feb 2020 08:51:17 +0000 (09:51 +0100)
committerJan Beulich <jbeulich@suse.com>
Thu, 6 Feb 2020 08:51:17 +0000 (09:51 +0100)
commitad38db5852f0e30d90c93c6a62b754f2861549e0
treef9aa41f7e5201786a7cc87f3f455a526511d546b
parent4e3322ec14155d3580fcbbe64e342c98182c1848
EFI: re-check {get,set}-variable name strings after copying in

A malicious guest given permission to invoke XENPF_efi_runtime_call may
play with the strings underneath Xen sizing them and copying them in.
Guard against this by re-checking the copyied in data for consistency
with the initial sizing. At the same time also check that the actual
copy-in is in fact successful, and switch to the lighter weight non-
checking flavor of the function.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
xen/common/efi/boot.c
xen/common/efi/efi.h
xen/common/efi/runtime.c