On Wed, Sep 09, 2026 at 01:21:28PM +0000, [email protected] wrote: > > --- /dev/null > > +++ b/drivers/firmware/efi/poison.c > > > > + /* Whole words, and a bit count that can be taken without wrapping. */ > > + if (!pm->size || !IS_ALIGNED(pm->size, sizeof(unsigned long)) || > > + check_mul_overflow(pm->size, (u64)BITS_PER_BYTE, &nbits)) > > + return false; > > [Severity: High] > Does this validation fully protect against an excessively large pm->size?
I was clamping the table before, but we decided to drop it in the last revision. See the discusion in here: https://lore.kernel.org/all/apGWUWi5-RbhFHpe@thinkstation/ > > + start = PAGE_ALIGN_DOWN(efi.poisoned_memory); > > + end = PAGE_ALIGN(efi.poisoned_memory + sizeof(*pm) + pm->size); > > [Severity: High] > Can this computation wrap around if pm->size is maliciously large? Yes, but that means that someone was able to write to EFI memory to update size? I can definitely BUG_ON() on "large" pm->size, but, I don't think this is what we want here.
