Commit 379e6671 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock 

Pull memblock fix from Mike Rapoport:
 "A call to memblock_free() or memblock_phys_free() issued after
  memblock data is discarded will result in use after free in
  memblock_isolate_range().

  Avoid those issues by making sure that memblock_discard points
  memblock.reserved.regions back at the static buffer"

* tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  mm,memblock: reset memblock.reserved to system init state to prevent UAF
parents 657b5146 9e46e4dc

mm/memblock.c

+4 −0
Original line number Diff line number Diff line
@@ -374,6 +374,10 @@ void __init memblock_discard(void) 
			kfree(memblock.reserved.regions);

		else

			memblock_free_late(addr, size);

		/* Reset to prevent UAF from stray frees. */

		memblock.reserved.regions = memblock_reserved_init_regions;

		memblock.reserved.cnt = 1;

		memblock_remove_region(&memblock.reserved, 0);

	}



	if (memblock.memory.regions != memblock_memory_init_regions) {