--- /dev/null
+From 792ef14df5c585c19b2831673a077504a09e5203 Mon Sep 17 00:00:00 2001
+From: Dave Young <dyoung@redhat.com>
+Date: Fri, 9 Jun 2017 08:45:58 +0000
+Subject: efi: Fix boot panic because of invalid BGRT image address
+
+From: Dave Young <dyoung@redhat.com>
+
+commit 792ef14df5c585c19b2831673a077504a09e5203 upstream.
+
+Maniaxx reported a kernel boot crash in the EFI code, which I emulated
+by using same invalid phys addr in code:
+
+ BUG: unable to handle kernel paging request at ffffffffff280001
+ IP: efi_bgrt_init+0xfb/0x153
+ ...
+ Call Trace:
+ ? bgrt_init+0xbc/0xbc
+ acpi_parse_bgrt+0xe/0x12
+ acpi_table_parse+0x89/0xb8
+ acpi_boot_init+0x445/0x4e2
+ ? acpi_parse_x2apic+0x79/0x79
+ ? dmi_ignore_irq0_timer_override+0x33/0x33
+ setup_arch+0xb63/0xc82
+ ? early_idt_handler_array+0x120/0x120
+ start_kernel+0xb7/0x443
+ ? early_idt_handler_array+0x120/0x120
+ x86_64_start_reservations+0x29/0x2b
+ x86_64_start_kernel+0x154/0x177
+ secondary_startup_64+0x9f/0x9f
+
+There is also a similar bug filed in bugzilla.kernel.org:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=195633
+
+The crash is caused by this commit:
+
+ 7b0a911478c7 efi/x86: Move the EFI BGRT init code to early init code
+
+The root cause is the firmware on those machines provides invalid BGRT
+image addresses.
+
+In a kernel before above commit BGRT initializes late and uses ioremap()
+to map the image address. Ioremap validates the address, if it is not a
+valid physical address ioremap() just fails and returns. However in current
+kernel EFI BGRT initializes early and uses early_memremap() which does not
+validate the image address, and kernel panic happens.
+
+According to ACPI spec the BGRT image address should fall into
+EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:
+
+ http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+
+Fix this issue by validating the image address in efi_bgrt_init(). If the
+image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
+bail out with a warning message.
+
+Reported-by: Maniaxx <tripleshiftone@gmail.com>
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Fixes: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code")
+Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi-bgrt.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/platform/efi/efi-bgrt.c
++++ b/arch/x86/platform/efi/efi-bgrt.c
+@@ -27,6 +27,26 @@ struct bmp_header {
+ u32 size;
+ } __packed;
+
++static bool efi_bgrt_addr_valid(u64 addr)
++{
++ efi_memory_desc_t *md;
++
++ for_each_efi_memory_desc(md) {
++ u64 size;
++ u64 end;
++
++ if (md->type != EFI_BOOT_SERVICES_DATA)
++ continue;
++
++ size = md->num_pages << EFI_PAGE_SHIFT;
++ end = md->phys_addr + size;
++ if (addr >= md->phys_addr && addr < end)
++ return true;
++ }
++
++ return false;
++}
++
+ void __init efi_bgrt_init(struct acpi_table_header *table)
+ {
+ void *image;
+@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_ta
+ if (acpi_disabled)
+ return;
+
+- if (!efi_enabled(EFI_BOOT))
++ if (!efi_enabled(EFI_MEMMAP))
+ return;
+
+ if (table->length < sizeof(bgrt_tab)) {
+@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_ta
+ goto out;
+ }
+
++ if (!efi_bgrt_addr_valid(bgrt->image_address)) {
++ pr_notice("Ignoring BGRT: invalid image address\n");
++ goto out;
++ }
+ image = early_memremap(bgrt->image_address, sizeof(bmp_header));
+ if (!image) {
+ pr_notice("Ignoring BGRT: failed to map image header memory\n");
--- /dev/null
+From 223220356d5ebc05ead9a8d697abb0c0a906fc81 Mon Sep 17 00:00:00 2001
+From: Richard <richard@aaazen.com>
+Date: Sun, 21 May 2017 12:27:00 -0700
+Subject: partitions/msdos: FreeBSD UFS2 file systems are not recognized
+
+From: Richard <richard@aaazen.com>
+
+commit 223220356d5ebc05ead9a8d697abb0c0a906fc81 upstream.
+
+The code in block/partitions/msdos.c recognizes FreeBSD, OpenBSD
+and NetBSD partitions and does a reasonable job picking out OpenBSD
+and NetBSD UFS subpartitions.
+
+But for FreeBSD the subpartitions are always "bad".
+
+ Kernel: <bsd:bad subpartition - ignored
+
+Though all 3 of these BSD systems use UFS as a file system, only
+FreeBSD uses relative start addresses in the subpartition
+declarations.
+
+The following patch fixes this for FreeBSD partitions and leaves
+the code for OpenBSD and NetBSD intact:
+
+Signed-off-by: Richard Narron <comet.berkeley@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/partitions/msdos.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/block/partitions/msdos.c
++++ b/block/partitions/msdos.c
+@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_part
+ continue;
+ bsd_start = le32_to_cpu(p->p_offset);
+ bsd_size = le32_to_cpu(p->p_size);
++ if (memcmp(flavour, "bsd\0", 4) == 0)
++ bsd_start += offset;
+ if (offset == bsd_start && size == bsd_size)
+ /* full parent partition, we have it already */
+ continue;
projects / thirdparty / kernel / stable-queue.git / commitdiff
