Pavel Tatashin 3010f87650
mm: discard memblock data later ...
There is existing use after free bug when deferred struct pages are
enabled:
The memblock_add() allocates memory for the memory array if more than
128 entries are needed. See comment in e820__memblock_setup():
* The bootstrap memblock region count maximum is 128 entries
* (INIT_MEMBLOCK_REGIONS), but EFI might pass us more E820 entries
* than that - so allow memblock resizing.
This memblock memory is freed here:
free_low_memory_core_early()
We access the freed memblock.memory later in boot when deferred pages
are initialized in this path:
deferred_init_memmap()
for_each_mem_pfn_range()
__next_mem_pfn_range()
type = &memblock.memory;
One possible explanation for why this use-after-free hasn't been hit
before is that the limit of INIT_MEMBLOCK_REGIONS has never been
exceeded at least on systems where deferred struct pages were enabled.
Tested by reducing INIT_MEMBLOCK_REGIONS down to 4 from the current 128,
and verifying in qemu that this code is getting excuted and that the
freed pages are sane.
Link: http://lkml.kernel.org/r/[email protected]
Fixes: 7e18adb4f8[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2017-08-18 15:32:01 -07:00
2017-07-09 18:48:37 -07:00
2017-06-01 14:26:23 -07:00
2017-08-01 16:46:45 +02:00
2017-08-01 16:46:44 +02:00
2017-07-07 12:40:27 -07:00
2017-07-12 10:04:56 -07:00
2017-07-23 20:54:31 -07:00
2017-05-29 20:02:01 -07:00
2017-06-15 09:45:06 +01:00
2017-07-13 15:58:02 -04:00
2017-07-11 09:55:47 -07:00
2017-08-02 10:44:09 -07:00
2017-08-08 11:42:33 -07:00
2017-06-20 10:30:49 +02:00
2017-08-02 10:26:42 +02:00
2017-06-03 19:29:26 +09:00
2017-06-19 19:38:24 +02:00
2017-06-19 19:09:19 +02:00
2017-07-27 13:43:22 +01:00
2017-06-01 15:28:27 +05:30
2017-08-07 15:26:34 +02:00
2017-08-13 12:30:17 -07:00
2017-06-08 17:57:38 +02:00
2017-07-03 01:43:45 -07:00
2017-07-19 08:55:18 -07:00
2017-06-29 17:34:57 +02:00
2017-07-06 11:38:59 -07:00
2017-07-13 13:56:24 -07:00
2017-07-22 08:55:16 -07:00
2017-06-15 11:41:37 +01:00
2017-07-30 07:53:44 -07:00
2017-06-03 19:10:09 +09:00
2017-06-05 15:29:22 -04:00
2017-07-04 22:35:16 +01:00
2017-07-12 16:26:05 -07:00
2017-06-08 18:52:36 -07:00
2017-06-30 12:00:51 -07:00
2017-07-03 17:00:59 -06:00
2017-07-10 16:32:34 -07:00
2017-06-27 12:05:27 -06:00
2017-06-20 15:42:32 -04:00
2017-07-03 13:08:04 -07:00
2017-06-27 12:13:45 -06:00
2017-07-06 16:24:33 -07:00
2017-07-01 16:15:13 -07:00
2017-07-20 15:20:27 -07:00
2017-07-17 13:37:56 -07:00
2017-07-03 02:22:52 -07:00
2017-07-10 10:51:53 -07:00
2017-07-10 16:32:34 -07:00
2017-07-10 16:32:34 -07:00
2017-07-03 16:56:28 -06:00
2017-06-30 12:00:51 -07:00
2017-06-28 14:45:21 -04:00
2017-06-05 16:59:12 +02:00
2017-06-07 15:32:12 +02:00
2017-07-14 12:37:41 -07:00
2017-06-12 10:54:47 +02:00
2017-07-03 16:14:51 -07:00
2017-07-06 20:57:13 -07:00
2017-07-06 16:24:29 -07:00
2017-07-19 08:55:18 -07:00
2017-07-19 08:55:18 -07:00
2017-06-12 13:20:20 +02:00
2017-06-09 11:45:25 +02:00
2017-06-22 15:43:47 +01:00
2017-05-27 17:32:24 -07:00
2017-07-14 13:12:32 -07:00
2017-07-26 21:51:25 -04:00
2017-08-02 17:16:12 -07:00
2017-07-12 16:26:00 -07:00
2017-06-09 11:52:07 +02:00
2017-07-19 08:55:18 -07:00
2017-07-26 15:55:44 -04:00
2017-07-19 08:55:18 -07:00
2017-07-07 09:44:06 -07:00
2017-08-07 15:26:34 +02:00
2017-08-17 09:10:48 -07:00
2017-06-19 11:03:51 -04:00
2017-07-14 16:09:55 -03:00
2017-05-30 11:25:45 +02:00
2017-07-20 16:09:10 +02:00
2017-06-15 13:46:00 +02:00
2017-06-05 17:50:41 +02:00
2017-06-18 10:08:55 -06:00
2017-07-06 07:02:24 -04:00
2017-06-20 12:18:27 +02:00
2017-07-12 16:26:01 -07:00
2017-07-10 16:32:35 -07:00
2017-07-06 16:24:30 -07:00
2017-07-03 18:44:02 -04:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-09 09:31:22 -07:00
2017-06-23 19:59:08 -04:00
2017-06-09 11:52:08 +02:00
2017-07-07 20:09:10 -04:00
2017-07-20 09:27:29 -04:00
2017-07-12 13:32:46 +02:00
2017-06-05 16:59:10 +02:00
2017-07-12 16:26:03 -07:00
2017-06-30 13:49:53 -07:00
2017-07-10 11:11:25 +02:00
2017-06-15 14:25:38 +02:00
2017-06-30 04:14:14 -04:00
2017-07-10 16:32:31 -07:00
2017-07-15 12:00:42 -07:00
2017-06-12 20:48:05 -04:00
2017-07-31 17:33:53 +02:00
2017-06-09 09:27:32 -06:00
2017-06-30 09:47:24 +03:00
2017-05-26 15:18:44 -04:00
2017-06-02 10:20:49 -04:00
2017-06-16 11:48:40 -04:00
2017-07-01 07:39:08 -07:00
2017-06-21 14:37:12 -04:00
2017-06-20 07:25:17 -03:00
2017-07-01 07:39:08 -07:00
2017-07-05 09:54:15 +02:00
2017-07-10 16:32:34 -07:00
2017-07-09 10:24:46 -07:00
2017-07-10 10:51:53 -07:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-31 22:01:21 -07:00
2017-07-27 15:40:02 +02:00
2017-07-04 12:46:16 +02:00
2017-06-22 18:29:34 +02:00
2017-07-17 09:22:34 -07:00
2017-06-02 15:07:37 -07:00
2017-07-12 16:25:59 -07:00
2017-07-12 16:26:00 -07:00
2017-06-30 12:00:51 -07:00
2017-07-03 21:13:25 -07:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:34 -07:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-08 11:05:34 +02:00
2017-08-02 16:34:47 -07:00
2017-06-26 10:39:40 +02:00
2017-08-02 22:41:02 +02:00
2017-06-20 12:18:27 +02:00
2017-07-10 13:41:04 -04:00
2017-07-03 16:54:58 -07:00
2017-07-10 16:32:33 -07:00
2017-07-19 15:33:50 -07:00
2017-07-19 08:55:18 -07:00
2017-06-22 10:29:53 -04:00
2017-08-18 15:32:01 -07:00
2017-08-18 15:32:01 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:34 -07:00
2017-05-31 20:56:31 -04:00
2017-07-12 16:26:04 -07:00
2017-06-05 11:00:42 -04:00
2017-06-16 11:48:37 -04:00
2017-08-10 15:54:07 -07:00
2017-07-07 18:39:15 -07:00
2017-06-20 15:42:32 -04:00
2017-07-10 16:32:33 -07:00
2017-07-19 08:55:18 -07:00
2017-07-02 15:37:23 -07:00
2017-06-30 12:00:51 -07:00
2017-06-30 12:00:51 -07:00
2017-06-29 13:50:38 -07:00
2017-08-15 17:07:17 -07:00
2017-07-08 11:23:29 +01:00
2017-07-17 17:01:10 +02:00
2017-05-30 11:55:32 -04:00
2017-07-01 07:39:08 -07:00
2017-07-13 16:00:15 -04:00
2017-07-13 16:00:12 -04:00
2017-07-21 11:51:19 -04:00
2017-07-13 17:12:07 -04:00
2017-08-01 16:28:55 -04:00
2017-07-12 16:26:02 -07:00
2017-07-06 16:24:32 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 11:30:07 -04:00
2017-08-10 11:06:38 +02:00
2017-07-25 18:05:25 +02:00
2017-07-25 17:58:32 +02:00
2017-07-10 14:27:39 +02:00
2017-06-22 11:14:48 -05:00
2017-05-29 11:07:55 +02:00
2017-06-13 14:00:16 -04:00
2017-07-10 15:23:45 -07:00
2017-06-19 22:06:28 -04:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:31 -07:00
2017-08-02 17:16:13 -07:00
2017-06-30 12:00:51 -07:00
2017-07-07 13:41:28 -05:00
2017-06-07 12:20:49 +02:00
2017-05-30 15:40:50 -05:00
2017-08-15 18:52:28 -07:00
2017-06-20 15:42:32 -04:00
2017-07-05 12:31:59 -07:00
2017-07-25 12:33:43 -07:00
2017-06-30 12:00:51 -07:00
2017-07-03 08:31:43 +02:00
2017-06-13 15:15:08 +02:00
2017-06-24 01:41:55 +02:00
2017-06-28 01:52:52 +02:00
2017-06-28 01:52:52 +02:00
2017-06-11 17:08:19 -07:00
2017-06-20 12:18:27 +02:00
2017-06-04 15:40:22 +02:00
2017-06-25 21:58:46 -04:00
2017-06-08 16:29:28 +02:00
2017-06-30 12:00:51 -07:00
2017-06-28 22:49:11 +10:00
2017-06-22 02:55:34 +02:00
2017-05-31 10:13:44 -07:00
2017-08-01 15:22:55 -07:00
2017-07-03 15:12:52 -07:00
2017-06-06 20:01:15 +01:00
2017-06-22 11:46:48 -04:00
2017-07-15 12:44:02 -07:00
2017-06-29 10:48:57 +01:00
2017-06-08 18:52:26 -07:00
2017-06-08 18:52:26 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:18:19 +02:00
2017-07-02 11:24:36 +02:00
2017-07-03 16:20:28 +01:00
2017-06-14 00:00:42 +02:00
2017-07-12 23:11:23 +02:00
2017-06-08 10:35:49 +02:00
2017-05-27 18:51:41 -04:00
2017-06-07 17:15:46 +01:00
2017-06-15 14:30:14 +02:00
2017-07-19 08:55:18 -07:00
2017-06-05 11:14:35 +01:00
2017-07-01 09:08:42 -07:00
2017-06-23 11:55:57 +10:00
2017-07-19 08:55:18 -07:00
2017-07-06 16:24:30 -07:00
2017-06-30 12:00:51 -07:00
2017-07-06 20:57:13 -07:00
2017-07-05 12:31:59 -07:00
2017-07-12 16:26:03 -07:00
2017-07-06 16:24:30 -07:00
2017-06-15 12:12:40 -04:00
2017-06-08 08:25:29 -07:00
2017-06-08 18:52:42 -07:00
2017-06-08 18:52:35 -07:00
2017-06-08 18:52:38 -07:00
2017-06-01 14:53:04 -04:00
2017-07-15 12:00:42 -07:00
2017-06-09 11:00:46 +02:00
2017-06-15 00:55:44 +02:00
2017-07-06 16:24:31 -07:00
2017-07-10 16:32:33 -07:00
2017-07-10 16:32:30 -07:00
2017-07-31 10:55:24 -03:00
2017-05-27 15:38:06 -04:00
2017-07-19 08:55:18 -07:00
2017-07-03 16:56:25 -06:00
2017-06-29 22:21:21 -04:00
2017-07-06 20:57:13 -07:00
2017-06-20 22:13:59 -07:00
2017-06-01 12:55:58 +08:00
2017-07-20 09:27:29 -04:00
2017-06-13 17:10:57 -04:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-08 10:15:02 -07:00
2017-07-10 07:40:49 -04:00
2017-06-30 12:00:51 -07:00
2017-06-30 12:00:51 -07:00
2017-07-24 17:50:37 +02:00
2017-06-22 16:15:45 -07:00
2017-07-26 13:30:23 -06:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-05 09:54:14 +02:00
2017-06-09 11:54:54 +02:00
2017-06-20 12:19:14 +02:00
2017-08-18 15:32:01 -07:00
2017-06-06 10:15:20 -07:00
2017-07-25 13:28:56 -04:00
Pavel Tatashin
3010f87650