Commit 792ef14d authored by Dave Young's avatar Dave Young Committed by Ingo Molnar
Browse files

efi: Fix boot panic because of invalid BGRT image address

Maniaxx reported a kernel boot crash in the EFI code, which I emulated
by using same invalid phys addr in code:

  BUG: unable to handle kernel paging request at ffffffffff280001
  IP: efi_bgrt_init+0xfb/0x153
  Call Trace:
   ? bgrt_init+0xbc/0xbc
   ? acpi_parse_x2apic+0x79/0x79
   ? dmi_ignore_irq0_timer_override+0x33/0x33
   ? early_idt_handler_array+0x120/0x120
   ? early_idt_handler_array+0x120/0x120

There is also a similar bug filed in

The crash is caused by this commit:

  7b0a9114 efi/x86: Move the EFI BGRT init code to early init code

The root cause is the firmware on those machines provides invalid BGRT
image addresses.

In a kernel before above commit BGRT initializes late and uses ioremap()
to map the image address. Ioremap validates the address, if it is not a
valid physical address ioremap() just fails and returns. However in current
kernel EFI BGRT initializes early and uses early_memremap() which does not
validate the image address, and kernel panic happens.

According to ACPI spec the BGRT image address should fall into
EFI_BOOT_SERVICES_DATA, see the section of below document:

Fix this issue by validating the image address in efi_bgrt_init(). If the
image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
bail out with a warning message.
Reported-by: default avatarManiaxx <>
Signed-off-by: default avatarDave Young <>
Signed-off-by: default avatarArd Biesheuvel <>
Cc: Linus Torvalds <>
Cc: Matt Fleming <>
Cc: Peter Zijlstra <>
Cc: Thomas Gleixner <>
Fixes: 7b0a9114 ("efi/x86: Move the EFI BGRT init code to early init code")

Signed-off-by: default avatarIngo Molnar <>
parent 0d22df90
......@@ -27,6 +27,26 @@ struct bmp_header {
u32 size;
} __packed;
static bool efi_bgrt_addr_valid(u64 addr)
efi_memory_desc_t *md;
for_each_efi_memory_desc(md) {
u64 size;
u64 end;
if (md->type != EFI_BOOT_SERVICES_DATA)
size = md->num_pages << EFI_PAGE_SHIFT;
end = md->phys_addr + size;
if (addr >= md->phys_addr && addr < end)
return true;
return false;
void __init efi_bgrt_init(struct acpi_table_header *table)
void *image;
......@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
if (acpi_disabled)
if (!efi_enabled(EFI_BOOT))
if (!efi_enabled(EFI_MEMMAP))
if (table->length < sizeof(bgrt_tab)) {
......@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
goto out;
if (!efi_bgrt_addr_valid(bgrt->image_address)) {
pr_notice("Ignoring BGRT: invalid image address\n");
goto out;
image = early_memremap(bgrt->image_address, sizeof(bmp_header));
if (!image) {
pr_notice("Ignoring BGRT: failed to map image header memory\n");
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment