Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull EFI fix from Ingo Molnar:
 "This fixes a bug in the efivars code"

* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  efi: Fix out-of-bounds read in variable_matches()

1 files changed, 26 insertions, 11 deletions

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 0ac594c0a234..34b741940494 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = {
         { NULL_GUID, "", NULL },
 };
 
+/*
+ * Check if @var_name matches the pattern given in @match_name.
+ *
+ * @var_name: an array of @len non-NUL characters.
+ * @match_name: a NUL-terminated pattern string, optionally ending in "*". A
+ *              final "*" character matches any trailing characters @var_name,
+ *              including the case when there are none left in @var_name.
+ * @match: on output, the number of non-wildcard characters in @match_name
+ *         that @var_name matches, regardless of the return value.
+ * @return: whether @var_name fully matches @match_name.
+ */
 static bool
 variable_matches(const char *var_name, size_t len, const char *match_name,
                  int *match)
 {
         for (*match = 0; ; (*match)++) {
                 char c = match_name[*match];
-                char u = var_name[*match];
 
-                /* Wildcard in the matching name means we've matched */
-                if (c == '*')
+                switch (c) {
+                case '*':
+                        /* Wildcard in @match_name means we've matched. */
                         return true;
 
-                /* Case sensitive match */
-                if (!c && *match == len)
-                        return true;
+                case '\0':
+                        /* @match_name has ended. Has @var_name too? */
+                        return (*match == len);
 
-                if (c != u)
+                default:
+                        /*
+                         * We've reached a non-wildcard char in @match_name.
+                         * Continue only if there's an identical character in
+                         * @var_name.
+                         */
+                        if (*match < len && c == var_name[*match])
+                                continue;
                         return false;
-
-                if (!c)
-                        return true;
+                }
         }
-        return true;
 }
 
 bool