Patch "arm64/efi: map the entire UEFI vendor string before reading it" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

arm64/efi: map the entire UEFI vendor string before reading it

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ard Biesheuvel <[email protected]>
Date: Sun, 26 Jul 2015 14:59:00 +0200
Subject: arm64/efi: map the entire UEFI vendor string before reading it

From: Ard Biesheuvel <[email protected]>

commit f91b1feada0b6f0a4d33648155b3ded2c4e0707e upstream.

At boot, the UTF-16 UEFI vendor string is copied from the system table into a char array with a size of 100 bytes. However, this size of 100 bytes is also used for memremapping() the source, which may not be sufficient if the vendor string exceeds 50 UTF-16 characters, and the placement of the vendor string inside a 4 KB page happens to leave the end unmapped.

So use the correct '100 * sizeof(efi_char16_t)' for the size of the mapping.

---
 arch/arm64/kernel/efi.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -122,12 +122,12 @@ static int __init uefi_init(void)
 
 	/* Show what we know for posterity */
 	c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
-			     sizeof(vendor));
+			     sizeof(vendor) * sizeof(efi_char16_t));
 	if (c16) {
 		for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
 			vendor[i] = c16[i];
 		vendor[i] = '\0';
-		early_memunmap(c16, sizeof(vendor));
+		early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
 	}
 
 	pr_info("EFI v%u.%.02u by %s\n",

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/arm64-efi-map-the-entire-uefi-vendor-string-before-reading-it.patch