diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-07-27 11:37:34 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-07-27 11:37:34 -0700 |
| commit | 379e66711b33f9fdc0513daee6cf3dd8d2f6f435 (patch) | |
| tree | e40ab485836aa06993f104ff0ffba608d387fa2c /mm | |
| parent | 657b5146955eba331e01b9a6ae89ce2e716ba306 (diff) | |
| parent | 9e46e4dcd9d6cd88342b028dbfa5f4fb7483d39c (diff) | |
Merge tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
Pull memblock fix from Mike Rapoport:
"A call to memblock_free() or memblock_phys_free() issued after
memblock data is discarded will result in use after free in
memblock_isolate_range().
Avoid those issues by making sure that memblock_discard points
memblock.reserved.regions back at the static buffer"
* tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
mm,memblock: reset memblock.reserved to system init state to prevent UAF
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/memblock.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/mm/memblock.c b/mm/memblock.c index f9e61e565a53..c39b36378f5d 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -374,6 +374,10 @@ void __init memblock_discard(void) kfree(memblock.reserved.regions); else memblock_free_late(addr, size); + /* Reset to prevent UAF from stray frees. */ + memblock.reserved.regions = memblock_reserved_init_regions; + memblock.reserved.cnt = 1; + memblock_remove_region(&memblock.reserved, 0); } if (memblock.memory.regions != memblock_memory_init_regions) { |