vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cmd: nvedit_efi: use efi_auth_var_get_guid() for the default GUID

Browse Source 
do_env_set_efi() hand rolls the mapping from well known variable names
to their default vendor GUID and has already drifted from the canonical
name_type[] table in efi_var_common.c: it does not know "dbr", so
"env set -e dbr" operates on the variable under EFI_GLOBAL_VARIABLE_GUID
instead of the image security database GUID, silently creating a
variable that nothing will ever consume.

Convert the variable name to UTF-16 before selecting the GUID and let
efi_auth_var_get_guid() do the lookup. That function knows all
authenticated variables including "dbr" and falls back to
EFI_GLOBAL_VARIABLE_GUID for any other name, so behaviour is unchanged
for "db", "dbx", "dbt" and non-authenticated variables. Future
additions to the table now apply to the shell command automatically.

Since the conversion now happens before the value parsing loop, free
the UTF-16 name at the common exit label so the error path there does
not leak it.

Also drop the unmap_sysmem() call right after efi_set_variable_int():
the common exit path already unmaps the value for the -i case and frees
it otherwise, so the value was unmapped twice. On sandbox the second
call triggers a spurious "Address not mapped" warning for addresses
that get a tagged mapping.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Aristo Chen
2026-07-27 18:50:28 +02:00
committed by Heinrich Schuchardt
parent e85562963f
commit 7a63ea5889
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/nvedit_efi.c
+8 -14
View File
@@ -448,13 +448,14 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
return CMD_RET_USAGE;
var_name = argv[0];
if (default_guid) {
if (!strcmp(var_name, "db") || !strcmp(var_name, "dbx") ||
!strcmp(var_name, "dbt"))
guid = efi_guid_image_security_database;
else
guid = efi_global_variable_guid;
var_name16 = efi_convert_string(var_name);
if (!var_name16) {
printf("## Out of memory\n");
ret = CMD_RET_FAILURE;
goto out;
}
if (default_guid)
guid = *efi_auth_var_get_guid(var_name16);
if (verbose) {
printf("GUID: %pUl (%pUs)\n", &guid, &guid);
@@ -479,16 +480,8 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
16, 1, value, size, true);
}
var_name16 = efi_convert_string(var_name);
if (!var_name16) {
printf("## Out of memory\n");
ret = CMD_RET_FAILURE;
goto out;
}
ret = efi_set_variable_int(var_name16, &guid, attributes, size, value,
true);
free(var_name16);
unmap_sysmem(value);
if (ret == EFI_SUCCESS) {
ret = CMD_RET_SUCCESS;
} else {
@@ -518,6 +511,7 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
ret = CMD_RET_FAILURE;
}
out:
free(var_name16);
if (value_on_memory)
unmap_sysmem(value);
else