On 9/15/26 16:29, Vincent Stehlé wrote:
When the trial_counter_read() function reads its counter from the TrialStateCtr UEFI Variable, it erroneously computes the return buffer size to be the size of a pointer instead of a u16. As the UEFI Variable is always created by trial_counter_update() with the right size before any read attempt, overflow cannot happen in practice, but fix the size computation for correctness.
Reviewed-by: Kory Maincent <[email protected]> Thank you! -- Köry Maincent, Bootlin Embedded Linux and kernel engineering https://bootlin.com
