• Pavel Tatashin's avatar
    mm: discard memblock data later · 87395eeb
    Pavel Tatashin authored
    commit 3010f876 upstream.
    
    There is existing use after free bug when deferred struct pages are
    enabled:
    
    The memblock_add() allocates memory for the memory array if more than
    128 entries are needed.  See comment in e820__memblock_setup():
    
      * The bootstrap memblock region count maximum is 128 entries
      * (INIT_MEMBLOCK_REGIONS), but EFI might pass us more E820 entries
      * than that - so allow memblock resizing.
    
    This memblock memory is freed here:
            free_low_memory_core_early()
    
    We access the freed memblock.memory later in boot when deferred pages
    are initialized in this path:
    
            deferred_init_memmap()
                    for_each_mem_pfn_range()
                      __next_mem_pfn_range()
                        type = &memblock.memory;
    
    One possible explanation for why this use-after-free hasn't been hit
    before is that the limit of INIT_MEMBLOCK_REGIONS has never been
    exceeded at least on systems where deferred struct pages were enabled.
    ...
    87395eeb
page_alloc.c 203 KB