Merge remote-tracking branch 'origin/f24' into f24-user-thl-vanilla-fedorakernel-4.11.5-100.vanilla.knurd.1.fc24

3 files changed, 126 insertions, 3 deletions

diff --git a/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch b/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch
new file mode 100644
index 000000000..4a714e36d
--- /dev/null
+++ b/0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch
@@ -0,0 +1,114 @@
+From 87c19e8de4f56d803d133c3e38bbd7b069e06df3 Mon Sep 17 00:00:00 2001
+From: Dave Young <dyoung@redhat.com>
+Date: Fri, 9 Jun 2017 08:45:58 +0000
+Subject: [PATCH] efi: Fix boot panic because of invalid BGRT image address
+
+Maniaxx reported a kernel boot crash in the EFI code, which I emulated
+by using same invalid phys addr in code:
+
+  BUG: unable to handle kernel paging request at ffffffffff280001
+  IP: efi_bgrt_init+0xfb/0x153
+  ...
+  Call Trace:
+   ? bgrt_init+0xbc/0xbc
+   acpi_parse_bgrt+0xe/0x12
+   acpi_table_parse+0x89/0xb8
+   acpi_boot_init+0x445/0x4e2
+   ? acpi_parse_x2apic+0x79/0x79
+   ? dmi_ignore_irq0_timer_override+0x33/0x33
+   setup_arch+0xb63/0xc82
+   ? early_idt_handler_array+0x120/0x120
+   start_kernel+0xb7/0x443
+   ? early_idt_handler_array+0x120/0x120
+   x86_64_start_reservations+0x29/0x2b
+   x86_64_start_kernel+0x154/0x177
+   secondary_startup_64+0x9f/0x9f
+
+There is also a similar bug filed in bugzilla.kernel.org:
+
+  https://bugzilla.kernel.org/show_bug.cgi?id=195633
+
+The crash is caused by this commit:
+
+  7b0a911478c7 efi/x86: Move the EFI BGRT init code to early init code
+
+The root cause is the firmware on those machines provides invalid BGRT
+image addresses.
+
+In a kernel before above commit BGRT initializes late and uses ioremap()
+to map the image address. Ioremap validates the address, if it is not a
+valid physical address ioremap() just fails and returns. However in current
+kernel EFI BGRT initializes early and uses early_memremap() which does not
+validate the image address, and kernel panic happens.
+
+According to ACPI spec the BGRT image address should fall into
+EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document:
+
+  http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+
+Fix this issue by validating the image address in efi_bgrt_init(). If the
+image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just
+bail out with a warning message.
+
+Reported-by: Maniaxx <tripleshiftone@gmail.com>
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Fixes: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code")
+Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[labbott@redhat.com: Backport to 4.11]
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+---
+ arch/x86/platform/efi/efi-bgrt.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c
+index 04ca876..08ee795 100644
+--- a/arch/x86/platform/efi/efi-bgrt.c
++++ b/arch/x86/platform/efi/efi-bgrt.c
+@@ -27,6 +27,26 @@ struct bmp_header {
+ 	u32 size;
+ } __packed;
+ 
++static bool efi_bgrt_addr_valid(u64 addr)
++{
++	efi_memory_desc_t *md;
++
++	for_each_efi_memory_desc(md) {
++		u64 size;
++		u64 end;
++
++		if (md->type != EFI_BOOT_SERVICES_DATA)
++			continue;
++
++		size = md->num_pages << EFI_PAGE_SHIFT;
++		end = md->phys_addr + size;
++		if (addr >= md->phys_addr && addr < end)
++			return true;
++	}
++
++	return false;
++}
++
+ void __init efi_bgrt_init(struct acpi_table_header *table)
+ {
+ 	void *image;
+@@ -62,6 +82,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
+ 		goto out;
+ 	}
+ 
++	if (!efi_bgrt_addr_valid(bgrt->image_address)) {
++		pr_notice("Ignoring BGRT: invalid image address\n");
++		goto out;
++	}
+ 	image = early_memremap(bgrt->image_address, sizeof(bmp_header));
+ 	if (!image) {
+ 		pr_notice("Ignoring BGRT: failed to map image header memory\n");
+-- 
+2.7.5
+
diff --git a/kernel.spec b/kernel.spec
index 187332e85..a5164f9a2 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -59,7 +59,7 @@ Summary: The Linux kernel
 
 
 # Do we have a -stable update to apply?
-%define stable_update 4
+%define stable_update 5
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -653,6 +653,9 @@ Patch679: actual_udpencap_fix.patch
 Patch680: 0001-platform-x86-thinkpad_acpi-guard-generic-hotkey-case.patch
 Patch681: 0002-platform-x86-thinkpad_acpi-add-mapping-for-new-hotke.patch
 
+# rhbz 1461337
+Patch682: 0001-efi-Fix-boot-panic-because-of-invalid-BGRT-image-add.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2220,7 +2223,13 @@ fi
 #
 # 
 %changelog
-* Wed Jun 07 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.4-200
+* Wed Jun 14 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.5-100
+- Linux v4.11.5
+
+* Wed Jun 14 2017 Laura Abbott <labbott@fedoraproject.org>
+- Add fix for EFI BGRT crash (rhbz 1461337)
+
+* Wed Jun 07 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.4-100
 - Linux v4.11.4
 
 * Tue Jun 06 2017 Laura Abbott <labbott@redhat.com>
diff --git a/sources b/sources
index fda283c02..161469091 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (perf-man-4.11.tar.gz) = 0b070d2f10a743329de2f532e2d7e19ef385a3e6ef3c700b591ae2697604dbe542b36e31121b3e37517ee8071ab800386fa8663c24a5b36520a18e096c6eefc8
 SHA512 (linux-4.11.tar.xz) = 6610eed97ffb7207c71771198c36179b8244ace7222bebb109507720e26c5f17d918079a56d5febdd8605844d67fb2df0ebe910fa2f2f53690daf6e2a8ad09c3
-SHA512 (patch-4.11.4.xz) = d38c48994e852c51f126d362faae0ee939043917287223e68eac84c59b43cda5908e5a31af6aa6b0fc1aeecbbc6d89b6c6351fefbc51c0becb9a7223f38a2c7b
+SHA512 (patch-4.11.5.xz) = c337470c79961c88b806a449ee3bbb3b5428c1f1d6751133de00b67901a6ad8db2ed8899e0b5ca89ff902f29f58a6721053d25e286a2120e7cf2e578907c8645