Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1282278e authored by Josh Triplett's avatar Josh Triplett Committed by Matt Fleming
Browse files

efi-bgrt: Add error handling; inform the user when ignoring the BGRT 



Gracefully handle failures to allocate memory for the image, which might
be arbitrarily large.

efi_bgrt_init can fail in various ways as well, usually because the
BIOS-provided BGRT structure does not match expectations.  Add
appropriate error messages rather than failing silently.

Reported-by: default avatarSrihari Vijayaraghavan <linux.bug.reporting@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81321


Signed-off-by: default avatarJosh Triplett <josh@joshtriplett.org>
Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
parent 5a17dae4

arch/x86/platform/efi/efi-bgrt.c

+30 −6
Original line number Diff line number Diff line
@@ -40,35 +40,59 @@ void __init efi_bgrt_init(void) 
	if (ACPI_FAILURE(status))

		return;



	if (bgrt_tab->header.length < sizeof(*bgrt_tab))

	if (bgrt_tab->header.length < sizeof(*bgrt_tab)) {

		pr_err("Ignoring BGRT: invalid length %u (expected %zu)\n",

		       bgrt_tab->header.length, sizeof(*bgrt_tab));

		return;

	if (bgrt_tab->version != 1 || bgrt_tab->status != 1)

	}

	if (bgrt_tab->version != 1) {

		pr_err("Ignoring BGRT: invalid version %u (expected 1)\n",

		       bgrt_tab->version);

		return;

	}

	if (bgrt_tab->status != 1) {

		pr_err("Ignoring BGRT: invalid status %u (expected 1)\n",

		       bgrt_tab->status);

		return;

	}

	if (bgrt_tab->image_type != 0) {

		pr_err("Ignoring BGRT: invalid image type %u (expected 0)\n",

		       bgrt_tab->image_type);

		return;

	if (bgrt_tab->image_type != 0 || !bgrt_tab->image_address)

	}

	if (!bgrt_tab->image_address) {

		pr_err("Ignoring BGRT: null image address\n");

		return;

	}



	image = efi_lookup_mapped_addr(bgrt_tab->image_address);

	if (!image) {

		image = early_memremap(bgrt_tab->image_address,

				       sizeof(bmp_header));

		ioremapped = true;

		if (!image)

		if (!image) {

			pr_err("Ignoring BGRT: failed to map image header memory\n");

			return;

		}

	}



	memcpy_fromio(&bmp_header, image, sizeof(bmp_header));

	if (ioremapped)

		early_iounmap(image, sizeof(bmp_header));

	bgrt_image_size = bmp_header.size;



	bgrt_image = kmalloc(bgrt_image_size, GFP_KERNEL);

	if (!bgrt_image)

	bgrt_image = kmalloc(bgrt_image_size, GFP_KERNEL | __GFP_NOWARN);

	if (!bgrt_image) {

		pr_err("Ignoring BGRT: failed to allocate memory for image (wanted %zu bytes)\n",

		       bgrt_image_size);

		return;

	}



	if (ioremapped) {

		image = early_memremap(bgrt_tab->image_address,

				       bmp_header.size);

		if (!image) {

			pr_err("Ignoring BGRT: failed to map image memory\n");

			kfree(bgrt_image);

			bgrt_image = NULL;

			return;