Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9376906c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull EFI fix from Ingo Molnar:
 "A boot crash fix for certain systems where the kernel would trust a
  piece of firmware data it should not have"

* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  efi: Fix boot panic because of invalid BGRT image address
parents 179145e6 792ef14d

drivers/firmware/efi/efi-bgrt.c

+25 −1
Original line number Original line Diff line number Diff line
@@ -27,6 +27,26 @@ struct bmp_header { 
	u32 size;

	u32 size;

} __packed;

} __packed;





static bool efi_bgrt_addr_valid(u64 addr)

{

	efi_memory_desc_t *md;



	for_each_efi_memory_desc(md) {

		u64 size;

		u64 end;



		if (md->type != EFI_BOOT_SERVICES_DATA)

			continue;



		size = md->num_pages << EFI_PAGE_SHIFT;

		end = md->phys_addr + size;

		if (addr >= md->phys_addr && addr < end)

			return true;

	}



	return false;

}



void __init efi_bgrt_init(struct acpi_table_header *table)

void __init efi_bgrt_init(struct acpi_table_header *table)

{

{

	void *image;

	void *image;
@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_table_header *table) 
	if (acpi_disabled)

	if (acpi_disabled)

		return;

		return;





	if (!efi_enabled(EFI_BOOT))

	if (!efi_enabled(EFI_MEMMAP))

		return;

		return;





	if (table->length < sizeof(bgrt_tab)) {

	if (table->length < sizeof(bgrt_tab)) {
@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table) 
		goto out;

		goto out;

	}

	}





	if (!efi_bgrt_addr_valid(bgrt->image_address)) {

		pr_notice("Ignoring BGRT: invalid image address\n");

		goto out;

	}

	image = early_memremap(bgrt->image_address, sizeof(bmp_header));

	image = early_memremap(bgrt->image_address, sizeof(bmp_header));

	if (!image) {

	if (!image) {

		pr_notice("Ignoring BGRT: failed to map image header memory\n");

		pr_notice("Ignoring BGRT: failed to map image header memory\n");