1 files changed, 18 insertions, 11 deletions

diff --git a/arch/i386/kernel/e820.c b/arch/i386/kernel/e820.c
index 70f39560846a..31f4670ef740 100644
--- a/arch/i386/kernel/e820.c
+++ b/arch/i386/kernel/e820.c
@@ -161,26 +161,27 @@ static struct resource standard_io_resources[] = { {
 
 static int __init romsignature(const unsigned char *rom)
 {
+        const unsigned short * const ptr = (const unsigned short *)rom;
         unsigned short sig;
 
-        return probe_kernel_address((const unsigned short *)rom, sig) == 0 &&
-               sig == ROMSIGNATURE;
+        return probe_kernel_address(ptr, sig) == 0 && sig == ROMSIGNATURE;
 }
 
-static int __init romchecksum(unsigned char *rom, unsigned long length)
+static int __init romchecksum(const unsigned char *rom, unsigned long length)
 {
-        unsigned char sum;
+        unsigned char sum, c;
 
-        for (sum = 0; length; length--)
-                sum += *rom++;
-        return sum == 0;
+        for (sum = 0; length && probe_kernel_address(rom++, c) == 0; length--)
+                sum += c;
+        return !length && !sum;
 }
 
 static void __init probe_roms(void)
 {
+        const unsigned char *rom;
         unsigned long start, length, upper;
-        unsigned char *rom;
-        int           i;
+        unsigned char c;
+        int i;
 
         /* video rom */
         upper = adapter_rom_resources[0].start;
@@ -191,8 +192,11 @@ static void __init probe_roms(void)
 
                 video_rom_resource.start = start;
 
+                if (probe_kernel_address(rom + 2, c) != 0)
+                        continue;
+
                 /* 0 < length <= 0x7f * 512, historically */
-                length = rom[2] * 512;
+                length = c * 512;
 
                 /* if checksum okay, trust length byte */
                 if (length && romchecksum(rom, length))
@@ -226,8 +230,11 @@ static void __init probe_roms(void)
                 if (!romsignature(rom))
                         continue;
 
+                if (probe_kernel_address(rom + 2, c) != 0)
+                        continue;
+
                 /* 0 < length <= 0x7f * 512, historically */
-                length = rom[2] * 512;
+                length = c * 512;
 
                 /* but accept any length that fits if checksum okay */
                 if (!length || start + length > upper || !romchecksum(rom, length))