Commit ff5a9eb13c for qemu.org

commit ff5a9eb13c862ed274ea0d0682a6573411e31543
Author: Gerd Hoffmann <kraxel@redhat.com>
Date:   Mon Jul 20 16:32:38 2026 +0200

    hw/uefi: remove debug function

    This was never meant to be present in production builds.  It's a code
    path not hit on a normal boot (OVMF wouldn't try variable updates which
    are not allowed), so this went unnoticed.

    Remove the function.  If needed for debugging the git log is your
    friend.

    Fixes: CVE-2026-58582
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615
    Acked-by: Luigi Leonardi <leonardi@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-ID: <20260720143244.821889-3-kraxel@redhat.com>

diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 989bf87ddb..0880bfe074 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -37,37 +37,6 @@ const VMStateDescription vmstate_uefi_var_policy = {
     },
 };

-static void print_policy_entry(variable_policy_entry *pe)
-{
-    uint16_t *name = (void *)pe + pe->offset_to_name;
-
-    fprintf(stderr, "%s:\n", __func__);
-
-    fprintf(stderr, "    name ´");
-    while (*name) {
-        fprintf(stderr, "%c", *name);
-        name++;
-    }
-    fprintf(stderr, "', version=%d.%d, size=%d\n",
-            pe->version >> 16, pe->version & 0xffff, pe->size);
-
-    if (pe->min_size) {
-        fprintf(stderr, "    size min=%d\n", pe->min_size);
-    }
-    if (pe->max_size != UINT32_MAX) {
-        fprintf(stderr, "    size max=%u\n", pe->max_size);
-    }
-    if (pe->attributes_must_have) {
-        fprintf(stderr, "    attr must=0x%x\n", pe->attributes_must_have);
-    }
-    if (pe->attributes_cant_have) {
-        fprintf(stderr, "    attr cant=0x%x\n", pe->attributes_cant_have);
-    }
-    if (pe->lock_policy_type) {
-        fprintf(stderr, "    lock policy type %d\n", pe->lock_policy_type);
-    }
-}
-
 static gboolean wildcard_str_equal(uefi_var_policy *pol,
                                    uefi_variable *var)
 {
@@ -173,7 +142,6 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv,
     pe = pol->entry;

     uefi_trace_variable(__func__, var->guid, var->name, var->name_size);
-    print_policy_entry(pe);

     if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) {
         trace_uefi_vars_policy_deny("must-have-attr");