5 files changed, 111 insertions, 56 deletions

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index bcb1126e3d00..153980be4ee6 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -585,14 +585,12 @@ int dmi_name_in_serial(const char *str)
 }
 
 /**
- *      dmi_name_in_vendors - Check if string is anywhere in the DMI vendor information.
+ *      dmi_name_in_vendors - Check if string is in the DMI system or board vendor name
  *      @str:   Case sensitive Name
  */
 int dmi_name_in_vendors(const char *str)
 {
-        static int fields[] = { DMI_BIOS_VENDOR, DMI_BIOS_VERSION, DMI_SYS_VENDOR,
-                                DMI_PRODUCT_NAME, DMI_PRODUCT_VERSION, DMI_BOARD_VENDOR,
-                                DMI_BOARD_NAME, DMI_BOARD_VERSION, DMI_NONE };
+        static int fields[] = { DMI_SYS_VENDOR, DMI_BOARD_VENDOR, DMI_NONE };
         int i;
         for (i = 0; fields[i] != DMI_NONE; i++) {
                 int f = fields[i];
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 8370f72d87ff..b0a81173a268 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -457,7 +457,8 @@ static int efi_pstore_close(struct pstore_info *psi)
 }
 
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
-                               struct timespec *timespec, struct pstore_info *psi)
+                               struct timespec *timespec,
+                               char **buf, struct pstore_info *psi)
 {
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         struct efivars *efivars = psi->data;
@@ -478,7 +479,11 @@ static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
                                 timespec->tv_nsec = 0;
                                 get_var_data_locked(efivars, &efivars->walk_entry->var);
                                 size = efivars->walk_entry->var.DataSize;
-                                memcpy(psi->buf, efivars->walk_entry->var.Data, size);
+                                *buf = kmalloc(size, GFP_KERNEL);
+                                if (*buf == NULL)
+                                        return -ENOMEM;
+                                memcpy(*buf, efivars->walk_entry->var.Data,
+                                       size);
                                 efivars->walk_entry = list_entry(efivars->walk_entry->list.next,
                                                    struct efivar_entry, list);
                                 return size;
@@ -576,7 +581,8 @@ static int efi_pstore_close(struct pstore_info *psi)
 }
 
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
-                               struct timespec *time, struct pstore_info *psi)
+                               struct timespec *timespec,
+                               char **buf, struct pstore_info *psi)
 {
         return -1;
 }
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index c811cb107904..2cce44a1d7d0 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -746,6 +746,37 @@ static void __exit ibft_exit(void)
         ibft_cleanup();
 }
 
+#ifdef CONFIG_ACPI
+static const struct {
+        char *sign;
+} ibft_signs[] = {
+        /*
+         * One spec says "IBFT", the other says "iBFT". We have to check
+         * for both.
+         */
+        { ACPI_SIG_IBFT },
+        { "iBFT" },
+};
+
+static void __init acpi_find_ibft_region(void)
+{
+        int i;
+        struct acpi_table_header *table = NULL;
+
+        if (acpi_disabled)
+                return;
+
+        for (i = 0; i < ARRAY_SIZE(ibft_signs) && !ibft_addr; i++) {
+                acpi_get_table(ibft_signs[i].sign, 0, &table);
+                ibft_addr = (struct acpi_table_ibft *)table;
+        }
+}
+#else
+static void __init acpi_find_ibft_region(void)
+{
+}
+#endif
+
 /*
  * ibft_init() - creates sysfs tree entries for the iBFT data.
  */
@@ -753,9 +784,16 @@ static int __init ibft_init(void)
 {
         int rc = 0;
 
+        /*
+           As on UEFI systems the setup_arch()/find_ibft_region()
+           is called before ACPI tables are parsed and it only does
+           legacy finding.
+        */
+        if (!ibft_addr)
+                acpi_find_ibft_region();
+
         if (ibft_addr) {
-                printk(KERN_INFO "iBFT detected at 0x%llx.\n",
-                       (u64)isa_virt_to_bus(ibft_addr));
+                pr_info("iBFT detected.\n");
 
                 rc = ibft_check_device();
                 if (rc)
diff --git a/drivers/firmware/iscsi_ibft_find.c b/drivers/firmware/iscsi_ibft_find.c
index bfe723266fd8..4da4eb9ae926 100644
--- a/drivers/firmware/iscsi_ibft_find.c
+++ b/drivers/firmware/iscsi_ibft_find.c
@@ -45,13 +45,6 @@ EXPORT_SYMBOL_GPL(ibft_addr);
 static const struct {
         char *sign;
 } ibft_signs[] = {
-#ifdef CONFIG_ACPI
-        /*
-         * One spec says "IBFT", the other says "iBFT". We have to check
-         * for both.
-         */
-        { ACPI_SIG_IBFT },
-#endif
         { "iBFT" },
         { "BIFT" },     /* Broadcom iSCSI Offload */
 };
@@ -62,14 +55,6 @@ static const struct {
 #define VGA_MEM 0xA0000 /* VGA buffer */
 #define VGA_SIZE 0x20000 /* 128kB */
 
-#ifdef CONFIG_ACPI
-static int __init acpi_find_ibft(struct acpi_table_header *header)
-{
-        ibft_addr = (struct acpi_table_ibft *)header;
-        return 0;
-}
-#endif /* CONFIG_ACPI */
-
 static int __init find_ibft_in_mem(void)
 {
         unsigned long pos;
@@ -94,6 +79,7 @@ static int __init find_ibft_in_mem(void)
                                  * the table cannot be valid. */
                                 if (pos + len <= (IBFT_END-1)) {
                                         ibft_addr = (struct acpi_table_ibft *)virt;
+                                        pr_info("iBFT found at 0x%lx.\n", pos);
                                         goto done;
                                 }
                         }
@@ -108,20 +94,12 @@ done:
  */
 unsigned long __init find_ibft_region(unsigned long *sizep)
 {
-#ifdef CONFIG_ACPI
-        int i;
-#endif
         ibft_addr = NULL;
 
-#ifdef CONFIG_ACPI
-        for (i = 0; i < ARRAY_SIZE(ibft_signs) && !ibft_addr; i++)
-                acpi_table_parse(ibft_signs[i].sign, acpi_find_ibft);
-#endif /* CONFIG_ACPI */
-
         /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
          * only use ACPI for this */
 
-        if (!ibft_addr && !efi_enabled)
+        if (!efi_enabled)
                 find_ibft_in_mem();
 
         if (ibft_addr) {
diff --git a/drivers/firmware/sigma.c b/drivers/firmware/sigma.c
index f10fc521951b..1eedb6f7fdab 100644
--- a/drivers/firmware/sigma.c
+++ b/drivers/firmware/sigma.c
@@ -14,13 +14,34 @@
 #include <linux/module.h>
 #include <linux/sigma.h>
 
-/* Return: 0==OK, <0==error, =1 ==no more actions */
+static size_t sigma_action_size(struct sigma_action *sa)
+{
+        size_t payload = 0;
+
+        switch (sa->instr) {
+        case SIGMA_ACTION_WRITEXBYTES:
+        case SIGMA_ACTION_WRITESINGLE:
+        case SIGMA_ACTION_WRITESAFELOAD:
+                payload = sigma_action_len(sa);
+                break;
+        default:
+                break;
+        }
+
+        payload = ALIGN(payload, 2);
+
+        return payload + sizeof(struct sigma_action);
+}
+
+/*
+ * Returns a negative error value in case of an error, 0 if processing of
+ * the firmware should be stopped after this action, 1 otherwise.
+ */
 static int
-process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
+process_sigma_action(struct i2c_client *client, struct sigma_action *sa)
 {
-        struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos);
         size_t len = sigma_action_len(sa);
-        int ret = 0;
+        int ret;
 
         pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__,
                 sa->instr, sa->addr, len);
@@ -29,44 +50,50 @@ process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
         case SIGMA_ACTION_WRITEXBYTES:
         case SIGMA_ACTION_WRITESINGLE:
         case SIGMA_ACTION_WRITESAFELOAD:
-                if (ssfw->fw->size < ssfw->pos + len)
-                        return -EINVAL;
                 ret = i2c_master_send(client, (void *)&sa->addr, len);
                 if (ret < 0)
                         return -EINVAL;
                 break;
-
         case SIGMA_ACTION_DELAY:
-                ret = 0;
                 udelay(len);
                 len = 0;
                 break;
-
         case SIGMA_ACTION_END:
-                return 1;
-
+                return 0;
         default:
                 return -EINVAL;
         }
 
-        /* when arrive here ret=0 or sent data */
-        ssfw->pos += sigma_action_size(sa, len);
-        return ssfw->pos == ssfw->fw->size;
+        return 1;
 }
 
 static int
 process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw)
 {
-        pr_debug("%s: processing %p\n", __func__, ssfw);
+        struct sigma_action *sa;
+        size_t size;
+        int ret;
+
+        while (ssfw->pos + sizeof(*sa) <= ssfw->fw->size) {
+                sa = (struct sigma_action *)(ssfw->fw->data + ssfw->pos);
+
+                size = sigma_action_size(sa);
+                ssfw->pos += size;
+                if (ssfw->pos > ssfw->fw->size || size == 0)
+                        break;
+
+                ret = process_sigma_action(client, sa);
 
-        while (1) {
-                int ret = process_sigma_action(client, ssfw);
                 pr_debug("%s: action returned %i\n", __func__, ret);
-                if (ret == 1)
-                        return 0;
-                else if (ret)
+
+                if (ret <= 0)
                         return ret;
         }
+
+        if (ssfw->pos != ssfw->fw->size)
+                return -EINVAL;
+
+        return 0;
 }
 
 int process_sigma_firmware(struct i2c_client *client, const char *name)
@@ -89,16 +116,24 @@ int process_sigma_firmware(struct i2c_client *client, const char *name)
 
         /* then verify the header */
         ret = -EINVAL;
-        if (fw->size < sizeof(*ssfw_head))
+
+        /*
+         * Reject too small or unreasonable large files. The upper limit has been
+         * chosen a bit arbitrarily, but it should be enough for all practical
+         * purposes and having the limit makes it easier to avoid integer
+         * overflows later in the loading process.
+         */
+        if (fw->size < sizeof(*ssfw_head) || fw->size >= 0x4000000)
                 goto done;
 
         ssfw_head = (void *)fw->data;
         if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic)))
                 goto done;
 
-        crc = crc32(0, fw->data, fw->size);
+        crc = crc32(0, fw->data + sizeof(*ssfw_head),
+                        fw->size - sizeof(*ssfw_head));
         pr_debug("%s: crc=%x\n", __func__, crc);
-        if (crc != ssfw_head->crc)
+        if (crc != le32_to_cpu(ssfw_head->crc))
                 goto done;
 
         ssfw.pos = sizeof(*ssfw_head);