From 8bf4744182148c8efc066770d9cb835054487dba Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 14 Jan 2026 11:47:45 +0100 Subject: [PATCH] hw/uefi: fix size negotiation Payload size is the variable request size, not the total buffer size. Take that into account and subtract header sizes. Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Signed-off-by: Gerd Hoffmann Message-ID: <20260114104745.3465860-1-kraxel@redhat.com> (cherry picked from commit 46dee71a945d50639586ca3365be29aa9f368bfd) Signed-off-by: Michael Tokarev --- hw/uefi/var-service-vars.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 8533533ea5..5607763525 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -592,7 +592,7 @@ uefi_vars_mm_get_payload_size(uefi_vars_state *uv, mm_header *mhdr, return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } - ps->payload_size = uv->buf_size; + ps->payload_size = uv->buf_size - sizeof(*mhdr) - sizeof(*mvar); mvar->status = EFI_SUCCESS; return length; }