Copy the entire output buffer to the guest because some firmwares update
size on successful calls (contrary to the spec) and the buffer may
contain data beyond the output size that the firmware requires on a
subsequent GetNextVariableName() call (e.g. a NULL character).
Note that this shouldn't change the amount of data copied because on success, a
compliant firmware does not change size and so the entire buffer is copied
anyway. If size is changed, Xen does not copy the buffer.
Without this change, the following (simplified) sequence would occur:
GetNextVariableName: in \0, size 1024 || out AdminPw\0, size 7
GetNextVariableName: in AdminPw\0, size 1024 || out UserPw\0, size 6
GetNextVariableName: in UserPww\0, size 1024 || NOT FOUND
This was seen on an Intel S1200RP_SE with firmware
S1200RP.86B.02.02.0005.102320140911, version 4.6, date 2014-10-23.
Signed-off-by: Ross Lagerwall <ross.lagerw...@citrix.com>
Reviewed-by: Andrew Cooper <andrew.coop...@citrix.com>
---
xen/common/efi/runtime.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/xen/common/efi/runtime.c b/xen/common/efi/runtime.c
index 7ed5bfa..dc80c6f9 100644
--- a/xen/common/efi/runtime.c
+++ b/xen/common/efi/runtime.c
@@ -516,9 +516,13 @@ int efi_runtime_call(struct xenpf_efi_runtime_call *op)
cast_guid(&op->u.get_next_variable_name.vendor_guid));
efi_rs_leave(cr3);
+ /*
+ * Copy the variable name if necessary. The entire buffer is copied
+ * because some firmwares update size when they shouldn't.
+ * */
if ( !EFI_ERROR(status) &&
- copy_to_guest(op->u.get_next_variable_name.name,
- name.raw, size) )
+ __copy_to_guest(op->u.get_next_variable_name.name,
+ name.raw, op->u.get_next_variable_name.size) )
rc = -EFAULT;
op->u.get_next_variable_name.size = size;
}
--
2.1.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
