mirror of
https://github.com/torvalds/linux
synced 2024-09-06 09:51:23 +00:00
memblock: reset memblock.reserved to system init state to prevent UAF
A call to memblock_free() or memblock_phys_free() issued after memblock data is discarded will result in use after free in memblock_isolate_range(). When CONFIG_KASAN is enabled, this will cause a panic early in boot. Without CONFIG_KASAN, there is a chance that memblock_isolate_range() might scribble on memory that is now in use by somebody else. Avoid those issues by making sure that memblock_discard points memblock.reserved.regions back at the static buffer. If memblock_free() or memblock_phys_free() is called after memblock memory is discarded, that will print a warning in memblock_remove_region(). -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmTB94cQHHJwcHRAa2Vy bmVsLm9yZwAKCRA5A4Ymyw79kesHB/4rNvGFGEI8LFxooARLt8glcv0Hn7oJ+z3L Xyczw1ZkglT3DEYsoY78bSriddWPqrV3wWkr+p2NYXPBJWgQZ6t3DRZviqzXcj2l Ew2XwLAfT6Vay1eqEFfJJvkGg27QLhnmJPnjDzCWweiXUaR5xOESwKCBmZBWeXUU t5EFJMIXLVEoBDLGW5kk+Q4RZDqhU/sJWDqf4ciWQ5vDS8OFTr56hfth7T8XoMxm BPlC21+cEJUWrbb1gAJUMbIERTzvYg8odZqSAESlHyNyDEtYjyLce5W6HA6zHK+H 2gqiti+Pd1OyHbJUc1lN7iRTE8FJ7DQcBr6H9sk81Po5af02Ky7m =FRx8 -----END PGP SIGNATURE----- Merge tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "A call to memblock_free() or memblock_phys_free() issued after memblock data is discarded will result in use after free in memblock_isolate_range(). Avoid those issues by making sure that memblock_discard points memblock.reserved.regions back at the static buffer" * tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm,memblock: reset memblock.reserved to system init state to prevent UAF
This commit is contained in:
commit
379e66711b
|
@ -374,6 +374,10 @@ void __init memblock_discard(void)
|
|||
kfree(memblock.reserved.regions);
|
||||
else
|
||||
memblock_free_late(addr, size);
|
||||
/* Reset to prevent UAF from stray frees. */
|
||||
memblock.reserved.regions = memblock_reserved_init_regions;
|
||||
memblock.reserved.cnt = 1;
|
||||
memblock_remove_region(&memblock.reserved, 0);
|
||||
}
|
||||
|
||||
if (memblock.memory.regions != memblock_memory_init_regions) {
|
||||
|
|
Loading…
Reference in a new issue