From patchwork Wed Jul 19 19:41:37 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rik van Riel X-Patchwork-Id: 13319434 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 150FFC001DE for ; Wed, 19 Jul 2023 19:41:54 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7F751280088; Wed, 19 Jul 2023 15:41:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7A76C28004C; Wed, 19 Jul 2023 15:41:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 696D6280088; Wed, 19 Jul 2023 15:41:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 5BC3328004C for ; Wed, 19 Jul 2023 15:41:54 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 30653A02C2 for ; Wed, 19 Jul 2023 19:41:54 +0000 (UTC) X-FDA: 81029381748.07.03C4406 Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) by imf21.hostedemail.com (Postfix) with ESMTP id F3A921C0012 for ; Wed, 19 Jul 2023 19:41:50 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=none; dmarc=none; spf=none (imf21.hostedemail.com: domain of riel@shelob.surriel.com has no SPF policy when checking 96.67.55.147) smtp.mailfrom=riel@shelob.surriel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1689795712; a=rsa-sha256; cv=none; b=KkmD4gok8GXcR4ER/WStpAz+of+9eqJRH9vdlRcESIU9Y22aFOm2nnqkB7wmzwyV0kY12p c3DGRB7YiMe7ftHg3nt5QBd59amW5xWGeKbQNco4AgmI7cViOp5ixgQjCIwBxyfU2LcnY8 lStoQh94UbhYTllMi9uE+zk8f61K/V8= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=none; dmarc=none; spf=none (imf21.hostedemail.com: domain of riel@shelob.surriel.com has no SPF policy when checking 96.67.55.147) smtp.mailfrom=riel@shelob.surriel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1689795712; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=TxhwGEmi0DVq2VEH35CQcVlYItPea1jOnoeoemjif5Y=; b=ao3HGkR6UZwtCVRq4wLnG+06Aydi+NAeBhcZftDl9zKxqVbrPGIT3ogcfLvcLvfcpDYfGr CzR8lDWDdiYWE5Aqoo0OiqwqYLkbCcv2iaW1L2NMXsMQTPogpfubYkzToj4T7nCpkHZZi8 J9LSA0q3rfgXi9maBqypUd9OeRDGV+0= Received: from [2601:18c:8180:ac39:6e0b:84ff:fee2:98bb] (helo=imladris.surriel.com) by shelob.surriel.com with esmtpsa (TLS1.2) tls TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1qMD3N-0007gS-36; Wed, 19 Jul 2023 15:41:41 -0400 Date: Wed, 19 Jul 2023 15:41:37 -0400 From: Rik van Riel To: Mike Rapoport Cc: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@meta.com Subject: [PATCH] mm,memblock: reset memblock.reserved to system init state to prevent UAF Message-ID: <20230719154137.732d8525@imladris.surriel.com> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; x86_64-redhat-linux-gnu) MIME-Version: 1.0 X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: F3A921C0012 X-Stat-Signature: jnwi9heq13pzjppzh8jopau73wsgtftp X-Rspam-User: X-HE-Tag: 1689795710-843772 X-HE-Meta: U2FsdGVkX1/18omZ3QVwMse1MMi8AfBCa/D4RG+i+/ryqz76j1oi5x+U9lEdVQYnP3AA2rxpQJi5QmWmMoEfO75ARPo9Lj0gggsht58+oJnOu/RZAwotMjqFw2cQcqbizdyMA6MhcynAtTmVvC6sWTIPKlbNfhfHztKrEpap3/N1Asbxd+rN3Q1BF4W+2TM368aaKf99kg2ud7LXegbwj5+0jQX5AxsfICg7XunCRnhheOGEXoYltSYJzf41IQS29esUFXUklx/bjX/mwHm+shG6ryLB5oiTTKTw3oD0PIanqhWVZALcSnDiavbvJ/80J/WNr6aE608HWMlJRK+0eR525q/bUoP5HfWBPz6qG2N4PZPhuCBsY6vNS2NppqLHGsYMgO81sGPOExghdyv2PKjMLGFpzLU9Yw8Vyms9LhLNVgKrHJeW4D5m1j7SlumFrjn67guIHjiCoqi5qB8HXMLF5OHv6AKm/HwxqY5OEf0nbmf084ZQk3E3YvRwZloPTofPnEddebZrsB4Xl67F8zIBt5GHpf1WiWu4x0PaW+qugX2Kx7tteHmhvBSGUmdz59lXRGBTuXJY/IX6R2YqorBbpO6ExEhMWwHkmrW92r6rg3PFoBqAyF7R051c4WDcVVCF4uDpkr7ltQ9UlRYmOjlvA2YA4JZllwdxwqcNkWu4vV5ksc9K7MNmQDUkYBpqh/88OyAX/bWcpTjbPUswUKACVqQWcwV0OxuWhJ8qgk3F2c6gOC8zf80TnhKEC9xeh2vnNXWuD0MJgNKOZxSzjVspuvOHCUMStdQzG3wEuFkSm3ngmiMG9JqcUYAl9ho/QGAzFy9ndAFeovzzf3ZaAFFiK8xdAhrlCfF7kPR0B/yTk6P5zkRh1Tlk/tzrB8UQd8LvZdijY8bm+2VaQxg5Ojva+MmZFoS2U1ielUnaUUv/GbxNDaFCG+e0+nGV0I1ASz1lOWmHBhzD3W78bvC 4uWVqs3s 8br8JkNYz3cpMSKe+CYtDju6/Tla7nECp2/YRsJ9DHLE7NadqvyF9Lrvd+/o6IEMx+JoJ6KzkbLjztjV0mjIgMsUOkDhOgUwXO4T1uYicjXebdKTfohg27E5achxT/YqUtvaSgKLC1IXgU6B282im2b2eUK/0EEXUkA0/Kr40t39B6wJK4BuDCQeNfMPa12Es6T+aTny53wY5OAfdffHcnYnfyxr0gQhsNWOozk/B/+jhNPmnHJrK7h7m2Gk7WMCuRcXMRykGiQCanFPRbOfA7n4aEUQKPqMVbgiBMdoP9cPvMB0zolHq8AuZ0ih1+UmCkqth X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The memblock_discard function frees the memblock.reserved.regions array, which is good. However, if a subsequent memblock_free (or memblock_phys_free) comes in later, from for example ima_free_kexec_buffer, that will result in a use after free bug in memblock_isolate_range. When running a kernel with CONFIG_KASAN enabled, this will cause a kernel panic very early in boot. Without CONFIG_KASAN, there is a chance that memblock_isolate_range might scribble on memory that is now in use by somebody else. Avoid those issues by making sure that memblock_discard points memblock.reserved.regions back at the static buffer. If memblock_discard is called while there is still memory in the memblock.reserved type, that will print a warning in memblock_remove_region. Signed-off-by: Rik van Riel --- mm/memblock.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/memblock.c b/mm/memblock.c index 3feafea06ab2..068289a46903 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -374,6 +374,10 @@ void __init memblock_discard(void) kfree(memblock.reserved.regions); else memblock_free_late(addr, size); + /* Reset to prevent UAF from stray frees. */ + memblock.reserved.regions = memblock_reserved_init_regions; + memblock.reserved.cnt = 1; + memblock_remove_region(&memblock.reserved, 0); } if (memblock.memory.regions != memblock_memory_init_regions) {