From bcc78fd4a35f8579550fd2b8e015fb22cb682a76 Mon Sep 17 00:00:00 2001 From: Alex Zenla Date: Sat, 26 Sep 2026 18:13:06 -0700 Subject: [PATCH] fix(shim): don't overwrite original handlers when already hooked If the security hook was installed while already installed, the protocols contained Sprout's own handlers, which were then saved as the "original" handlers. A verification failure would then call back into the hook forever. Keep the existing saved state in that case. --- crates/eficore/src/shim/hook.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/crates/eficore/src/shim/hook.rs b/crates/eficore/src/shim/hook.rs index 7404a8c..2aac139 100644 --- a/crates/eficore/src/shim/hook.rs +++ b/crates/eficore/src/shim/hook.rs @@ -216,6 +216,13 @@ impl SecurityHook { // Acquire the lock to the global state and replace it. let mut global_state = GLOBAL_HOOK_STATE.lock(); + + // If the hook is already installed, the protocols contain our hooks. + // Storing them as the original hooks would cause infinite recursion on + // verification failure, so keep the existing state instead. + if global_state.is_some() { + return Ok(true); + } global_state.replace(state); // Install the hooks into the UEFI stack.