diff options
| author | Dave Airlie <airlied@redhat.com> | 2017-06-16 13:58:27 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2017-06-16 13:58:27 +1000 |
| commit | 925344ccc91d7a7fd84cab2dece1c34bbd86fd8c (patch) | |
| tree | bd4110dc5a3b70a5674b9d6d5340cc1889f5d6e8 /drivers/firmware/efi/efi-bgrt.c | |
| parent | a6821698918a579e7219d706092e83f367f01ba2 (diff) | |
| parent | 32c1431eea4881a6b17bd7c639315010aeefa452 (diff) | |
| download | linux-925344ccc91d7a7fd84cab2dece1c34bbd86fd8c.tar.gz | |
BackMerge tag 'v4.12-rc5' into drm-next
Linux 4.12-rc5 for nouveau fixes
Diffstat (limited to 'drivers/firmware/efi/efi-bgrt.c')
| -rw-r--r-- | drivers/firmware/efi/efi-bgrt.c | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c index 04ca8764f0c0..b58233e4ed71 100644 --- a/drivers/firmware/efi/efi-bgrt.c +++ b/drivers/firmware/efi/efi-bgrt.c @@ -27,6 +27,26 @@ struct bmp_header { u32 size; } __packed; +static bool efi_bgrt_addr_valid(u64 addr) +{ + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { + u64 size; + u64 end; + + if (md->type != EFI_BOOT_SERVICES_DATA) + continue; + + size = md->num_pages << EFI_PAGE_SHIFT; + end = md->phys_addr + size; + if (addr >= md->phys_addr && addr < end) + return true; + } + + return false; +} + void __init efi_bgrt_init(struct acpi_table_header *table) { void *image; @@ -36,6 +56,9 @@ void __init efi_bgrt_init(struct acpi_table_header *table) if (acpi_disabled) return; + if (!efi_enabled(EFI_MEMMAP)) + return; + if (table->length < sizeof(bgrt_tab)) { pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n", table->length, sizeof(bgrt_tab)); @@ -62,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table) goto out; } + if (!efi_bgrt_addr_valid(bgrt->image_address)) { + pr_notice("Ignoring BGRT: invalid image address\n"); + goto out; + } image = early_memremap(bgrt->image_address, sizeof(bmp_header)); if (!image) { pr_notice("Ignoring BGRT: failed to map image header memory\n"); |