Re: [PATCH v2 2/2] hw/uefi: disable debug function

["Philippe Mathieu-Daudé" <philmd@oss.qualcomm.com>]

Hi Gerd,

On 2/7/26 11:23, Gerd Hoffmann wrote:
> This was never meant to be active in production builds.  It's a code
> path not hit on a normal boot (OVMF wouldn't try variable updates which
> are not allowed), so this went unnoticed.
> 
> Wrap the call into "if (VARIABLE_POLICY_DEBUG)" so it is never used
> unless the #define is changed to true.
> 
> Also fix the name printing to not overrun the entry size.
> 
> Fixes: CVE-2026-58582
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>   hw/uefi/var-service-policy.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
> index 989bf87ddb86..b56fc62f7092 100644
> --- a/hw/uefi/var-service-policy.c
> +++ b/hw/uefi/var-service-policy.c
> @@ -16,6 +16,8 @@
>   
>   #include "trace.h"
>   
> +#define VARIABLE_POLICY_DEBUG 0

To avoid this anti-pattern, ...

>   static void calc_policy(uefi_var_policy *pol);
>   
>   static int uefi_var_policy_post_load(void *opaque, int version_id)
> @@ -40,11 +42,12 @@ const VMStateDescription vmstate_uefi_var_policy = {
>   static void print_policy_entry(variable_policy_entry *pe)
>   {
>       uint16_t *name = (void *)pe + pe->offset_to_name;
> +    uint16_t *end = (void *)pe + pe->size;
>   
>       fprintf(stderr, "%s:\n", __func__);
>   
>       fprintf(stderr, "    name ´");
> -    while (*name) {
> +    while (*name && name < end) {
>           fprintf(stderr, "%c", *name);
>           name++;
>       }
> @@ -173,7 +176,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv,
>       pe = pol->entry;
>   
>       uefi_trace_variable(__func__, var->guid, var->name, var->name_size);

... better keep it compiled with a trace event:

        if (trace_event_get_state_backends(TRACE_UEFI_POLICY)) {

> -    print_policy_entry(pe);
> +    if (VARIABLE_POLICY_DEBUG) {
> +        print_policy_entry(pe);
> +    }
>   
>       if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) {
>           trace_uefi_vars_policy_deny("must-have-attr");