From nobody Mon Dec 15 18:18:25 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dVSwx5f25z6L7FW for ; Mon, 15 Dec 2025 18:18:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dVSwx1jysz4L0Q for ; Mon, 15 Dec 2025 18:18:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765822705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=412a5LoosJBl1KRhy5jHhRugxR5rwSF1o5Xv2RqSHdU=; b=kLHnGggjJ1Oaq7uvYzpLiXIYrSBRQgmcyJEEpYSeffkW/abEa3ID183auzUkR6VGWzm8UO wueOIzm1QmcNcKRa1xry9wZBB/tVIQKuT389MOWi/Gww2L71gFZxFD8PywYWTBxn68haVd zINinYy0eMWVA+osL9GJF1TfgpbD4vndhudoerssHgq/UgiSYHNcfFvfuvD45BjNlLzUih UiEmCdEb8rLlS5/roFVbPZUvfjxQInU2MYQE4STMntDLquA9PAHwnnRHSG5dxaXoheqH72 XeWotZs8U5oneWNQdGH/9awhfZTxWB6m0Vp4YYEZJDOcTLIx4imqoQaz9uyuww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765822705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=412a5LoosJBl1KRhy5jHhRugxR5rwSF1o5Xv2RqSHdU=; b=CL4PP/fqFK5e6D9ioy8y/UDlDo3dIQWHtqsUlzMBvTJP3MKi+vOm4CjWT+XI36h6CSHx7O /b4dBH+LVIaQIp6S4WpMYvhK227XtZ88tBxQtDeScGOJKoH8mxftwXk4EsGUZtDasUAcx9 qP4fwL8piwt3MeJT83NZ5C4pqJikAP9/t8blKKIl7jP6fKuqh360ICF3Fajw337Qm2nHei TaYaWBHMRcKHhOCvf6hiSs2KAI0oA4HY67r2NoSIwA4/xVZTfD/7yOGN4Z8HycsfApCSnu Ouw8XpC+OdJ90Yw8hSnaJ3uq92pW1Fq2+MNkxuwtFNCx8J8Y6EI91f7W+9TxUw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765822705; a=rsa-sha256; cv=none; b=ojr7xVzRKSM3ZwSGkSSGqm8WRqbemVbe+hlka2jA224lraaSZ1ex5Tr03Qg8gpCfTtGND2 jbqBVNfmta3ImBNKd5R2gP6AaJsTGASoZ3ES62riRXqLJVMP+O2woBT4RTpmIit8s0HsGB 92XgFuUAFYh37IoxkWvUmrnSCsblJKK4REY0gzxazZmpFTkiAR50kWG9bKT5SC/fms/txT +xikTLdX/YW5AxtgIRJfqQT92GeulRyaxerjMdeqqAIqTQUYEdb8VtfX2CIXHB1DydzpNO z7cpjvBXQKZZuoIVZxaOFBYl02tmPEhjNKCD9tpD2qXseLOClH5VdEppooA8zg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dVSwx1G8KzVhC for ; Mon, 15 Dec 2025 18:18:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 25a2a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 15 Dec 2025 18:18:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jessica Clarke Subject: git: c4f666e81c6e - stable/13 - efibootmgr: Simplify make_next_boot_var_name and fix cnt == 0 case List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrtc27 X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: c4f666e81c6e7c4b726d7c5ff34a95e652848914 Auto-Submitted: auto-generated Date: Mon, 15 Dec 2025 18:18:25 +0000 Message-Id: <694050f1.25a2a.2e97ba0a@gitrepo.freebsd.org> The branch stable/13 has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=c4f666e81c6e7c4b726d7c5ff34a95e652848914 commit c4f666e81c6e7c4b726d7c5ff34a95e652848914 Author: Jessica Clarke AuthorDate: 2024-02-23 02:36:21 +0000 Commit: Jessica Clarke CommitDate: 2025-12-15 17:56:34 +0000 efibootmgr: Simplify make_next_boot_var_name and fix cnt == 0 case If cnt == 0 we access element 0 unconditionally, which is out of bounds, and then if that doesn't crash and happens to be 0 we will access element - 1, also out of bounds, and then if that doesn't crash will add 1 to whatever junk is there and use that for the variable. On CHERI, though, this does crash. This code is also overly complicated, with unnecessary special cases and tracking more state than needed. Rewrite it in a more general manner that doesn't need those special cases and naturally works for cnt == 0. Found by: CHERI Reviewed by: imp Fixes: 1285bcc833a3 ("Import Netflix's efibootmgr to help manage UEFI boot variables") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D44029 (cherry picked from commit 09cb8031b43c8e98abb5ff9b43ff649031d1e808) --- usr.sbin/efibootmgr/efibootmgr.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/usr.sbin/efibootmgr/efibootmgr.c b/usr.sbin/efibootmgr/efibootmgr.c index dfe8bfb1c145..74b59863d6c5 100644 --- a/usr.sbin/efibootmgr/efibootmgr.c +++ b/usr.sbin/efibootmgr/efibootmgr.c @@ -555,7 +555,7 @@ static char * make_next_boot_var_name(void) { struct entry *v; - uint16_t *vals, next_free = 0; + uint16_t *vals; char *name; int cnt = 0; int i; @@ -573,21 +573,14 @@ make_next_boot_var_name(void) vals[i++] = v->idx; } qsort(vals, cnt, sizeof(uint16_t), compare); - /* if the hole is at the beginning, just return zero */ - if (vals[0] > 0) { - next_free = 0; - } else { - /* now just run the list looking for the first hole */ - for (i = 0; i < cnt - 1 && next_free == 0; i++) - if (vals[i] + 1 != vals[i + 1]) - next_free = vals[i] + 1; - if (next_free == 0) - next_free = vals[cnt - 1] + 1; - /* In theory we could have used all 65k slots -- what to do? */ - } + /* Find the first hole (could be at start or end) */ + for (i = 0; i < cnt; ++i) + if (vals[i] != i) + break; free(vals); + /* In theory we could have used all 65k slots -- what to do? */ - asprintf(&name, "%s%04X", "Boot", next_free); + asprintf(&name, "%s%04X", "Boot", i); if (name == NULL) err(1, "asprintf"); return name;