When the trial_counter_read() function reads its counter from the
TrialStateCtr UEFI Variable, it erroneously computes the return buffer
size to be the size of a pointer instead of a u16.
As the UEFI Variable is always created by trial_counter_update() with
the right size before any read attempt, overflow cannot happen in
practice, but fix the size computation for correctness.
Fixes: 7e9814cc6c1d ("FWU: Add boot time checks as highlighted by the FWU
specification")
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Sughosh Ganu <[email protected]>
Cc: Kory Maincent <[email protected]>
Cc: Tom Rini <[email protected]>
---
Hi,
This has been tested on the sandbox, with CONFIG_FWU_MULTI_BANK_UPDATE=y
& CONFIG_FWU_MDATA_V2=y, and with a modified fwu_boottime_checks()
function doing essentially the following sequence:
efi_init_obj_list();
trial_counter_update();
trial_counter_read();
---
lib/fwu_updates/fwu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/fwu_updates/fwu.c b/lib/fwu_updates/fwu.c
index e9bb1b4fc65..24a8f1ce5b2 100644
--- a/lib/fwu_updates/fwu.c
+++ b/lib/fwu_updates/fwu.c
@@ -82,7 +82,7 @@ static int trial_counter_read(u16 *trial_state_ctr)
efi_status_t status;
efi_uintn_t var_size;
- var_size = (efi_uintn_t)sizeof(trial_state_ctr);
+ var_size = (efi_uintn_t)sizeof(*trial_state_ctr);
status = efi_get_variable_int(u"TrialStateCtr",
&efi_global_variable_guid,
NULL,
---
base-commit: a44f46af0aa17e48572e0d46c0d082886ee353c3
change-id: 20260914-fwu-24265a691f9a
Best regards,
--
Vincent.
