Merge tag 'xfs-4.12-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

[karo-tx-linux.git] / drivers / firmware / efi / efi-bgrt.c

diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 8bf27323f7a37c34591c45f8b39d2091ae096260..b58233e4ed71ac41709318e03ce06c1d1b2c20ce 100644 (file)
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
        u32 size;
 } __packed;
 
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+       efi_memory_desc_t *md;
+
+       for_each_efi_memory_desc(md) {
+               u64 size;
+               u64 end;
+
+               if (md->type != EFI_BOOT_SERVICES_DATA)
+                       continue;
+
+               size = md->num_pages << EFI_PAGE_SHIFT;
+               end = md->phys_addr + size;
+               if (addr >= md->phys_addr && addr < end)
+                       return true;
+       }
+
+       return false;
+}
+
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
        void *image;
@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
        if (acpi_disabled)
                return;
 
-       if (!efi_enabled(EFI_BOOT))
+       if (!efi_enabled(EFI_MEMMAP))
                return;
 
        if (table->length < sizeof(bgrt_tab)) {
@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                goto out;
        }
 
+       if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+               pr_notice("Ignoring BGRT: invalid image address\n");
+               goto out;
+       }
        image = early_memremap(bgrt->image_address, sizeof(bmp_header));
        if (!image) {
                pr_notice("Ignoring BGRT: failed to map image header memory\n");