diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2015-07-28 18:26:13 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2015-07-28 18:26:13 (GMT) |
commit | d61be4b3f2684b6d76ef8c1d28ecdeb9bb20fa8f (patch) | |
tree | d87c3b49ecaf4fb2c567b8aca6a6738728d70fa1 /arch | |
parent | 67eb890e5e132b56d9af7adf407e7c2a6ed248dc (diff) | |
parent | f91b1feada0b6f0a4d33648155b3ded2c4e0707e (diff) | |
download | linux-d61be4b3f2684b6d76ef8c1d28ecdeb9bb20fa8f.tar.xz |
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fix from Catalin Marinas:
"Fix buffer overflow when UTF-16 UEFI vendor string is copied from the
system table into a char array with a size of 100 bytes"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64/efi: map the entire UEFI vendor string before reading it
Diffstat (limited to 'arch')
-rw-r--r-- | arch/arm64/kernel/efi.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c index 9d4aa18..e8ca6ea 100644 --- a/arch/arm64/kernel/efi.c +++ b/arch/arm64/kernel/efi.c @@ -122,12 +122,12 @@ static int __init uefi_init(void) /* Show what we know for posterity */ c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor), - sizeof(vendor)); + sizeof(vendor) * sizeof(efi_char16_t)); if (c16) { for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i) vendor[i] = c16[i]; vendor[i] = '\0'; - early_memunmap(c16, sizeof(vendor)); + early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t)); } pr_info("EFI v%u.%.02u by %s\n", |