From: Thomas Huth <thuth@redhat.com>

The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses
sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be
causing an undersized allocation.

The allocation is also inconsistent with the initial array allocation in
efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),
and the efi_capsule_write() function that stores phys_addr_t values (not
pointers) via page_to_phys().

On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this
goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but
pointers are 32-bit, this allocates half the required space, which might
lead to a heap buffer overflow when storing physical addresses.

This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial
allocation site.

Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping")
Assisted-by: Claude:claude-sonnet-4-5
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 drivers/firmware/efi/capsule-loader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
index 2c628a1270919..8e8f81f0a5a0a 100644
--- a/drivers/firmware/efi/capsule-loader.c
+++ b/drivers/firmware/efi/capsule-loader.c
@@ -67,7 +67,7 @@ int __efi_capsule_setup_info(struct capsule_info *cap_info)
 	cap_info->pages = temp_page;
 
 	temp_page = krealloc(cap_info->phys,
-			     pages_needed * sizeof(phys_addr_t *),
+			     pages_needed * sizeof(phys_addr_t),
 			     GFP_KERNEL | __GFP_ZERO);
 	if (!temp_page)
 		return -ENOMEM;
-- 
2.53.0

On Fri, 10 Apr 2026, at 17:46, Thomas Huth wrote:
> From: Thomas Huth <thuth@redhat.com>
>
> The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses
> sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be
> causing an undersized allocation.
>
> The allocation is also inconsistent with the initial array allocation in
> efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),
> and the efi_capsule_write() function that stores phys_addr_t values (not
> pointers) via page_to_phys().
>
> On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this
> goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but
> pointers are 32-bit, this allocates half the required space, which might
> lead to a heap buffer overflow when storing physical addresses.
>
> This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
> fix incorrect allocation size") which fixed the same issue at the initial
> allocation site.
>
> Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping")
> Assisted-by: Claude:claude-sonnet-4-5
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>  drivers/firmware/efi/capsule-loader.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>

Thanks for the fix - I'll queue this up for the next cycle.

> diff --git a/drivers/firmware/efi/capsule-loader.c 
> b/drivers/firmware/efi/capsule-loader.c
> index 2c628a1270919..8e8f81f0a5a0a 100644
> --- a/drivers/firmware/efi/capsule-loader.c
> +++ b/drivers/firmware/efi/capsule-loader.c
> @@ -67,7 +67,7 @@ int __efi_capsule_setup_info(struct capsule_info 
> *cap_info)
>  	cap_info->pages = temp_page;
> 
>  	temp_page = krealloc(cap_info->phys,
> -			     pages_needed * sizeof(phys_addr_t *),
> +			     pages_needed * sizeof(phys_addr_t),
>  			     GFP_KERNEL | __GFP_ZERO);
>  	if (!temp_page)
>  		return -ENOMEM;
> -- 
> 2.53.0