Fix the efi serial console in the Arm models.

On some UEFI implementations the ConsOut EFI variable is not a device
path end type so we never move to the next node. Fix this by always
incrementing the device path node pointer, with a sanity check that
the node length is large enough so no two nodes overlap.

While here return failure on malloc failure rather than a NULL pointer
dereference.

Reviewed by:	tsoome, imp (previous version)
Sponsored by:	Innovate UK
Differential Revision:	https://reviews.freebsd.org/D25202

1 files changed, 9 insertions, 12 deletions

diff --git a/stand/efi/loader/efiserialio.c b/stand/efi/loader/efiserialio.c
index c881e23680d29..8b3f8e83e0b32 100644
--- a/stand/efi/loader/efiserialio.c
+++ b/stand/efi/loader/efiserialio.c
@@ -216,8 +216,9 @@ comc_get_con_serial_handle(const char *name)
 	status = efi_global_getenv(name, buf, &sz);
 	if (status == EFI_BUFFER_TOO_SMALL) {
 		buf = malloc(sz);
-		if (buf != NULL)
-			status = efi_global_getenv(name, buf, &sz);
+		if (buf == NULL)
+			return (NULL);
+		status = efi_global_getenv(name, buf, &sz);
 	}
 	if (status != EFI_SUCCESS) {
 		free(buf);
@@ -232,17 +233,13 @@ comc_get_con_serial_handle(const char *name)
 			free(buf);
 			return (handle);
 		}
-		if (IsDevicePathEndType(node) &&
-		    DevicePathSubType(node) ==
-		    END_INSTANCE_DEVICE_PATH_SUBTYPE) {
-			/*
-			 * Start of next device path in list.
-			 */
-			node = NextDevicePathNode(node);
-			continue;
-		}
-		if (IsDevicePathEnd(node))
+
+		/* Sanity check the node before moving to the next node. */
+		if (DevicePathNodeLength(node) < sizeof(*node))
 			break;
+
+		/* Start of next device path in list. */
+		node = NextDevicePathNode(node);
 	}
 	free(buf);
 	return (NULL);