Re: [PATCH] efi/efi_test: bound capsule_count to what the int loop index can hold

[Dan Carpenter]

On Sun, Sep 20, 2026 at 12:24:10AM +0500, Muhammad Bilal wrote:
> efi_runtime_query_capsulecaps() only rejects capsule_count == ULONG_MAX
> (to stop "capsule_count + 1" wrapping the kzalloc_objs() count to
> zero), but then walks the array with
> "for (i = 0; i < qcaps.capsule_count; i++)"
> using a plain int i against an unsigned long bound. A capsule_count
> between INT_MAX and ULONG_MAX - 1 lets i wrap through INT_MIN instead
> of ever reaching the loop bound, and capsules[i] with a negative i
> indexes before the allocation.
> 
> kzalloc_objs() would have to succeed at that size for the loop to be
> reached at all, which bounds this in practice, but the check should
> not rely on the allocator failing first. Reject any capsule_count
> that would not fit in the int index up front.

No, the it's fine to rely on kzalloc failure.  Don't bother trying
to silence this false positive.  Fix your checker instead.

> 
> Fixes: 092e72c9edab ("efi/efi_test: Prevent an Oops in efi_runtime_query_capsulecaps()")

Certainly, don't add a Fixes tag.

> Signed-off-by: Muhammad Bilal <meatuni001@xxxxxxxxx>
> ---

Regards,
dan carpenter