cmd: nvedit_efi: use efi_auth_var_get_guid() for the default GUID

do_env_set_efi() hand rolls the mapping from well known variable names
to their default vendor GUID and has already drifted from the canonical
name_type[] table in efi_var_common.c: it does not know "dbr", so
"env set -e dbr" operates on the variable under EFI_GLOBAL_VARIABLE_GUID
instead of the image security database GUID, silently creating a
variable that nothing will ever consume.

Convert the variable name to UTF-16 before selecting the GUID and let
efi_auth_var_get_guid() do the lookup. That function knows all
authenticated variables including "dbr" and falls back to
EFI_GLOBAL_VARIABLE_GUID for any other name, so behaviour is unchanged
for "db", "dbx", "dbt" and non-authenticated variables. Future
additions to the table now apply to the shell command automatically.

Since the conversion now happens before the value parsing loop, free
the UTF-16 name at the common exit label so the error path there does
not leak it.

Also drop the unmap_sysmem() call right after efi_set_variable_int():
the common exit path already unmaps the value for the -i case and frees
it otherwise, so the value was unmapped twice. On sandbox the second
call triggers a spurious "Address not mapped" warning for addresses
that get a tagged mapping.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

diff --git a/cmd/nvedit_efi.c b/cmd/nvedit_efi.c
index 3a36f94775b0b8438df4433b377facb6de6dee19..f38802e4f4d5e3759f9f45f632f3c447437ad608 100644 (file)
--- a/cmd/nvedit_efi.c
+++ b/cmd/nvedit_efi.c
@@ -448,13 +448,14 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
                return CMD_RET_USAGE;
 
        var_name = argv[0];
-       if (default_guid) {
-               if (!strcmp(var_name, "db") || !strcmp(var_name, "dbx") ||
-                   !strcmp(var_name, "dbt"))
-                       guid = efi_guid_image_security_database;
-               else
-                       guid = efi_global_variable_guid;
+       var_name16 = efi_convert_string(var_name);
+       if (!var_name16) {
+               printf("## Out of memory\n");
+               ret = CMD_RET_FAILURE;
+               goto out;
        }
+       if (default_guid)
+               guid = *efi_auth_var_get_guid(var_name16);
 
        if (verbose) {
                printf("GUID: %pUl (%pUs)\n", &guid, &guid);
@@ -479,16 +480,8 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
                               16, 1, value, size, true);
        }
 
-       var_name16 = efi_convert_string(var_name);
-       if (!var_name16) {
-               printf("## Out of memory\n");
-               ret = CMD_RET_FAILURE;
-               goto out;
-       }
        ret = efi_set_variable_int(var_name16, &guid, attributes, size, value,
                                   true);
-       free(var_name16);
-       unmap_sysmem(value);
        if (ret == EFI_SUCCESS) {
                ret = CMD_RET_SUCCESS;
        } else {
@@ -518,6 +511,7 @@ int do_env_set_efi(struct cmd_tbl *cmdtp, int flag, int argc,
                ret = CMD_RET_FAILURE;
        }
 out:
+       free(var_name16);
        if (value_on_memory)
                unmap_sysmem(value);
        else