Commit 8e0ddb4a6e for qemu.org

commit 8e0ddb4a6ebd1c3d2dfd067f82b6d92de5b23e30
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jul 20 16:32:40 2026 +0200

    hw/uefi: account variable policy entries against storage size

    uefi-vars already tracks (and limits) the memory footprint of UEFI
    variables.  Do that for variable policies too.

    Fixes: CVE-2026-61405
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3890
    Acked-by: Luigi Leonardi <leonardi@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260720143244.821889-5-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 0880bfe074..46c4ff2dac 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -283,7 +283,12 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv,
         return uefi_vars_mm_policy_error(mhdr, mchk, EFI_ALREADY_STARTED);
     }

+    if (uv->used_storage + pe->size > uv->max_storage) {
+        return uefi_vars_mm_policy_error(mhdr, mchk, EFI_OUT_OF_RESOURCES);
+    }
+
     uefi_vars_add_policy(uv, pe);
+    uv->used_storage += pe->size;

     mchk->result = EFI_SUCCESS;
     return sizeof(*mchk);
diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c
index 2c83130ebf..fd07782f1e 100644
--- a/hw/uefi/var-service-vars.c
+++ b/hw/uefi/var-service-vars.c
@@ -201,11 +201,15 @@ void uefi_vars_clear_all(uefi_vars_state *uv)
 void uefi_vars_update_storage(uefi_vars_state *uv)
 {
     uefi_variable *var;
+    uefi_var_policy *pol;

     uv->used_storage = 0;
     QTAILQ_FOREACH(var, &uv->variables, next) {
         uv->used_storage += variable_size(var);
     }
+    QTAILQ_FOREACH(pol, &uv->var_policies, next) {
+        uv->used_storage += pol->entry->size;
+    }
 }

 static gboolean check_access(uefi_vars_state *uv, uefi_variable *var)