Commit 48a42821 authored by Thomas Huth's avatar Thomas Huth Committed by Ard Biesheuvel
Browse files

efi/capsule-loader: fix incorrect sizeof in phys array reallocation 



The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses
sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be
causing an undersized allocation.

The allocation is also inconsistent with the initial array allocation in
efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),
and the efi_capsule_write() function that stores phys_addr_t values (not
pointers) via page_to_phys().

On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this
goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but
pointers are 32-bit, this allocates half the required space, which might
lead to a heap buffer overflow when storing physical addresses.

This is similar to the bug fixed in commit fccfa646 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial
allocation site.

Fixes: f24c4d47 ("efi/capsule-loader: Reinstate virtual capsule mapping")
Assisted-by: Claude:claude-sonnet-4-5
Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent 259e3e6f

drivers/firmware/efi/capsule-loader.c

+1 −1
Original line number Diff line number Diff line
@@ -67,7 +67,7 @@ int __efi_capsule_setup_info(struct capsule_info *cap_info) 
	cap_info->pages = temp_page;



	temp_page = krealloc(cap_info->phys,

			     pages_needed * sizeof(phys_addr_t *),

			     pages_needed * sizeof(phys_addr_t),

			     GFP_KERNEL | __GFP_ZERO);

	if (!temp_page)

		return -ENOMEM;