git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-05-02 18:17:50 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock

Browse Source 
Pull memblock fix from Mike Rapoport:
 "A call to memblock_free() or memblock_phys_free() issued after
  memblock data is discarded will result in use after free in
  memblock_isolate_range().

  Avoid those issues by making sure that memblock_discard points
  memblock.reserved.regions back at the static buffer"

* tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  mm,memblock: reset memblock.reserved to system init state to prevent UAF
This commit is contained in:
Linus Torvalds
2023-07-27 11:37:34 -07:00
parent 657b514695 9e46e4dcd9
commit 379e66711b
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
mm/memblock.c
View File

@@ -374,6 +374,10 @@ void __init memblock_discard(void)
kfree(memblock.reserved.regions);
else
memblock_free_late(addr, size);
/* Reset to prevent UAF from stray frees. */
memblock.reserved.regions = memblock_reserved_init_regions;
memblock.reserved.cnt = 1;
memblock_remove_region(&memblock.reserved, 0);
}
if (memblock.memory.regions != memblock_memory_init_regions) {