diff options
| author | Ingo Molnar <mingo@kernel.org> | 2017-06-20 12:28:21 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-06-20 12:28:21 +0200 |
| commit | 902b31941327a0e9c0ca9eb7750414ae41bf8a89 (patch) | |
| tree | 300f4226c87e6df403cda861ab6766b23d278f09 /drivers/firmware/efi/efi-bgrt.c | |
| parent | c5ae366e12b2bd56fc7d7e9d484836bec9ddc110 (diff) | |
| parent | 2055da97389a605c8a00d163d40903afbe413921 (diff) | |
Merge branch 'WIP.sched/core' into sched/core
Conflicts:
kernel/sched/Makefile
Pick up the waitqueue related renames - it didn't get much feedback,
so it appears to be uncontroversial. Famous last words? ;-)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/firmware/efi/efi-bgrt.c')
| -rw-r--r-- | drivers/firmware/efi/efi-bgrt.c | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c index 04ca8764f0c0..b58233e4ed71 100644 --- a/drivers/firmware/efi/efi-bgrt.c +++ b/drivers/firmware/efi/efi-bgrt.c @@ -27,6 +27,26 @@ struct bmp_header { u32 size; } __packed; +static bool efi_bgrt_addr_valid(u64 addr) +{ + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { + u64 size; + u64 end; + + if (md->type != EFI_BOOT_SERVICES_DATA) + continue; + + size = md->num_pages << EFI_PAGE_SHIFT; + end = md->phys_addr + size; + if (addr >= md->phys_addr && addr < end) + return true; + } + + return false; +} + void __init efi_bgrt_init(struct acpi_table_header *table) { void *image; @@ -36,6 +56,9 @@ void __init efi_bgrt_init(struct acpi_table_header *table) if (acpi_disabled) return; + if (!efi_enabled(EFI_MEMMAP)) + return; + if (table->length < sizeof(bgrt_tab)) { pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n", table->length, sizeof(bgrt_tab)); @@ -62,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table) goto out; } + if (!efi_bgrt_addr_valid(bgrt->image_address)) { + pr_notice("Ignoring BGRT: invalid image address\n"); + goto out; + } image = early_memremap(bgrt->image_address, sizeof(bmp_header)); if (!image) { pr_notice("Ignoring BGRT: failed to map image header memory\n"); |