[xen staging] efi: Limit Shim's Verify success to EFI_SUCCESS

[patchbot@xxxxxxx]

commit 38a5e0d0317b0f5a1143b3ec9cea7b757b26b935
Author:     Gerald Elder-Vass <gerald.elder-vass@xxxxxxxxx>
AuthorDate: Thu Sep 25 16:02:14 2025 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Sep 25 16:02:14 2025 +0200

    efi: Limit Shim's Verify success to EFI_SUCCESS
    
    Commit 59a1d6d3ea1e replaced the Verify status check with
    !EFI_ERROR(...), this changed the behaviour to consider any warnings
    (EFI_WARN_) to be considered a successful verification.
    
    This commit reverts that behaviour change.
    
    Fixes: 59a1d6d3ea1e ("efi: Support using Shim's LoadImage protocol")
    Reported-by: Jan Beulich <jbeulich@xxxxxxxx>
    Signed-off-by: Gerald Elder-Vass <gerald.elder-vass@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
---
 xen/common/efi/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/efi/boot.c b/xen/common/efi/boot.c
index 69fc022c18..5b84dbf26e 100644
--- a/xen/common/efi/boot.c
+++ b/xen/common/efi/boot.c
@@ -1089,7 +1089,7 @@ static void __init efi_verify_kernel(EFI_HANDLE 
ImageHandle)
     if ( !verified &&
          !EFI_ERROR(efi_bs->LocateProtocol(&shim_lock_guid, NULL,
                                            (void **)&shim_lock)) &&
-         !EFI_ERROR(shim_lock->Verify(kernel.ptr, kernel.size)) )
+         shim_lock->Verify(kernel.ptr, kernel.size) == EFI_SUCCESS )
         verified = true;
 
     if ( !verified )
--
generated by git-patchbot for /home/xen/git/xen.git#staging