iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/mm
History
Pavel Tatashin 3010f87650 mm: discard memblock data later 
There is existing use after free bug when deferred struct pages are
enabled:

The memblock_add() allocates memory for the memory array if more than
128 entries are needed.  See comment in e820__memblock_setup():

  * The bootstrap memblock region count maximum is 128 entries
  * (INIT_MEMBLOCK_REGIONS), but EFI might pass us more E820 entries
  * than that - so allow memblock resizing.

This memblock memory is freed here:
        free_low_memory_core_early()

We access the freed memblock.memory later in boot when deferred pages
are initialized in this path:

        deferred_init_memmap()
                for_each_mem_pfn_range()
                  __next_mem_pfn_range()
                    type = &memblock.memory;

One possible explanation for why this use-after-free hasn't been hit
before is that the limit of INIT_MEMBLOCK_REGIONS has never been
exceeded at least on systems where deferred struct pages were enabled.

Tested by reducing INIT_MEMBLOCK_REGIONS down to 4 from the current 128,
and verifying in qemu that this code is getting excuted and that the
freed pages are sane.

Link: http://lkml.kernel.org/r/1502485554-318703-2-git-send-email-pasha.tatashin@oracle.com
Fixes: 7e18adb4f80b ("mm: meminit: initialise remaining struct pages in parallel with kswapd")
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
Reviewed-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Reviewed-by: Bob Picco <bob.picco@oracle.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-08-18 15:32:01 -07:00
..
kasan
kasan: avoid -Wmaybe-uninitialized warning
2017-08-02 16:34:46 -07:00
backing-dev.c
bdi: Drop 'parent' argument from bdi_register[_va]()
2017-04-20 12:09:55 -06:00
balloon_compaction.c
mm/balloon_compaction.c: don't zero ballooned pages
2017-08-10 15:54:07 -07:00
bootmem.c
mm/bootmem.c: cosmetic improvement of code readability
2017-02-22 16:41:29 -08:00
cleancache.c
fs: switch ->s_uuid to uuid_t
2017-06-05 16:59:12 +02:00
cma_debug.c
cma: Store a name in the cma structure
2017-04-18 20:41:12 +02:00
cma.c
cma: fix calculation of aligned offset
2017-07-10 16:32:32 -07:00
cma.h
cma: Store a name in the cma structure
2017-04-18 20:41:12 +02:00
compaction.c
mm, compaction: skip over holes in __reset_isolation_suitable
2017-07-06 16:24:32 -07:00
debug_page_ref.c
mm/page_ref: add tracepoint to track down page reference manipulation
2016-03-17 15:09:34 -07:00
debug.c
mm: make tlb_flush_pending global
2017-08-10 15:54:07 -07:00
dmapool.c
lib/vsprintf.c: remove %Z support
2017-02-27 18:43:47 -08:00
early_ioremap.c
mm/early_ioremap: use offset_in_page macro
2015-11-05 19:34:48 -08:00
fadvise.c
mm: fadvise: avoid expensive remote LRU cache draining after FADV_DONTNEED
2016-12-20 09:48:46 -08:00
failslab.c
mm: fault-inject take over bootstrap kmem_cache check
2016-03-15 16:55:16 -07:00
filemap.c
mm: hugetlb: return immediately for hugetlb page in __delete_from_page_cache()
2017-07-10 16:32:30 -07:00
frame_vector.c
treewide: use kv[mz]alloc* rather than opencoded variants
2017-05-08 17:15:13 -07:00
frontswap.c
mm, frontswap: convert frontswap_enabled to static key
2016-07-26 16:19:19 -07:00
gup.c
mm, gup: ensure real head page is ref-counted when using hugepages
2017-07-06 16:24:34 -07:00
highmem.c
mm/highmem: make nr_free_highpages() handles all highmem zones by itself
2016-05-19 19:12:14 -07:00
huge_memory.c
Revert "mm: numa: defer TLB flush for THP migration as long as possible"
2017-08-10 15:54:07 -07:00
hugetlb_cgroup.c
mm, hugetlb_cgroup: round limit_in_bytes down to hugepage size
2016-05-20 17:58:30 -07:00
hugetlb.c
userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case
2017-08-10 15:54:06 -07:00
hwpoison-inject.c
mm: hwpoison: call shake_page() unconditionally
2017-05-03 15:52:12 -07:00
init-mm.c
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
2016-11-22 11:49:48 -06:00
internal.h
mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
2017-08-02 16:34:46 -07:00
interval_tree.c
…
Kconfig
mm/kasan: add support for memory hotplug
2017-07-10 16:32:33 -07:00
Kconfig.debug
mm: enable page poisoning early at boot
2017-05-03 15:52:10 -07:00
khugepaged.c
mm: make PR_SET_THP_DISABLE immediately active
2017-07-10 16:32:31 -07:00
kmemcheck.c
mm: Rename SLAB_DESTROY_BY_RCU to SLAB_TYPESAFE_BY_RCU
2017-04-18 11:42:36 -07:00
kmemleak-test.c
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
kmemleak.c
mm: kmemleak: treat vm_struct as alternative reference to vmalloc'ed objects
2017-07-06 16:24:34 -07:00
ksm.c
mm: fix KSM data corruption
2017-08-10 15:54:07 -07:00
list_lru.c
mm/list_lru.c: fix list_lru_count_node() to be race free
2017-07-10 16:32:33 -07:00
maccess.c
x86: remove more uaccess_32.h complexity
2016-05-22 17:21:27 -07:00
madvise.c
mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
2017-08-02 16:34:46 -07:00
Makefile
percpu: expose statistics about percpu memory via debugfs
2017-06-20 15:31:38 -04:00
memblock.c
mm: discard memblock data later
2017-08-18 15:32:01 -07:00
memcontrol.c
mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()
2017-08-18 15:32:01 -07:00
memory_hotplug.c
mm/memory-hotplug: switch locking to a percpu rwsem
2017-07-10 16:32:33 -07:00
memory-failure.c
mm, hugetlb, soft_offline: use new_page_nodemask for soft offline migration
2017-07-10 16:32:32 -07:00
memory.c
mm: fix MADV_[FREE|DONTNEED] TLB flush miss problem
2017-08-10 15:54:07 -07:00
mempolicy.c
mm, migration: do not trigger OOM killer when migrating memory
2017-07-12 16:26:04 -07:00
mempool.c
sched/wait: Rename wait_queue_t => wait_queue_entry_t
2017-06-20 12:18:27 +02:00
memtest.c
memtest: remove unused header files
2015-09-08 15:35:28 -07:00
migrate.c
Revert "mm: numa: defer TLB flush for THP migration as long as possible"
2017-08-10 15:54:07 -07:00
mincore.c
mm: remove shmem_mapping() shmem_zero_setup() duplicates
2017-02-24 17:46:56 -08:00
mlock.c
mlock: fix mlock count can not decrease in race condition
2017-06-02 15:07:38 -07:00
mm_init.c
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mmap.c
mm: fix overflow check in expand_upwards()
2017-07-14 15:05:12 -07:00
mmu_context.c
sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
mmu_notifier.c
mm: Use static initialization for "srcu"
2017-04-18 11:38:22 -07:00
mmzone.c
mm/mmzone.c: swap likely to unlikely as code logic is different for next_zones_zonelist()
2017-02-22 16:41:29 -08:00
mprotect.c
mm: migrate: prevent racy access to tlb_flush_pending
2017-08-10 15:54:07 -07:00
mremap.c
userfaultfd: non-cooperative: notify about unmap of destination during mremap
2017-08-02 16:34:46 -07:00
msync.c
mm/msync: use offset_in_page macro
2015-11-05 19:34:48 -08:00
nobootmem.c
mm: discard memblock data later
2017-08-18 15:32:01 -07:00
nommu.c
mm, vmalloc: use __GFP_HIGHMEM implicitly
2017-05-08 17:15:13 -07:00
oom_kill.c
mm/oom_kill.c: add tracepoints for oom reaper-related events
2017-07-10 16:32:32 -07:00
page_alloc.c
mm: discard memblock data later
2017-08-18 15:32:01 -07:00
page_counter.c
mm: page_counter: let page_counter_try_charge() return bool
2015-11-05 19:34:48 -08:00
page_ext.c
mm: enable page poisoning early at boot
2017-05-03 15:52:10 -07:00
page_idle.c
mm: make rmap_one boolean function
2017-05-03 15:52:10 -07:00
page_io.c
mm/page_io.c: fix oops during block io poll in swapin path
2017-08-02 17:16:11 -07:00
page_isolation.c
mm: unify new_node_page and alloc_migrate_target
2017-07-10 16:32:31 -07:00
page_owner.c
mm: avoid taking zone lock in pagetypeinfo_showmixed()
2017-07-10 16:32:32 -07:00
page_poison.c
mm: enable page poisoning early at boot
2017-05-03 15:52:10 -07:00
page_vma_mapped.c
mm/hugetlb: add size parameter to huge_pte_offset()
2017-07-06 16:24:34 -07:00
page-writeback.c
mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()
2017-08-18 15:32:01 -07:00
pagewalk.c
mm/hugetlb: add size parameter to huge_pte_offset()
2017-07-06 16:24:34 -07:00
percpu-internal.h
percpu: fix early calls for spinlock in pcpu_stats
2017-06-21 13:53:52 -04:00
percpu-km.c
percpu: fix static checker warnings in pcpu_destroy_chunk
2017-06-29 11:23:38 -04:00
percpu-stats.c
percpu: expose statistics about percpu memory via debugfs
2017-06-20 15:31:38 -04:00
percpu-vm.c
percpu: fix static checker warnings in pcpu_destroy_chunk
2017-06-29 11:23:38 -04:00
percpu.c
percpu: resolve err may not be initialized in pcpu_alloc
2017-06-21 12:00:45 -04:00
pgtable-generic.c
mm: convert generic code to 5-level paging
2017-03-09 11:48:47 -08:00
process_vm_access.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/mm.h>
2017-03-02 08:42:28 +01:00
quicklist.c
fix Christoph's email addresses
2016-03-17 15:09:34 -07:00
readahead.c
mm: don't cap request size based on read-ahead setting
2016-12-12 18:55:08 -08:00
rmap.c
rmap: do not call mmu_notifier_invalidate_page() under ptl
2017-08-10 15:54:07 -07:00
rodata_test.c
mm: remove rodata_test_data export, add pr_fmt
2017-05-03 15:52:09 -07:00
shmem.c
mm: fix list corruptions on shmem shrinklist
2017-08-10 15:54:07 -07:00
slab_common.c
mm: allow slab_nomerge to be set at build time
2017-07-06 16:24:31 -07:00
slab.c
mm: memcontrol: account slab stats per lruvec
2017-07-06 16:24:35 -07:00
slab.h
mm: memcontrol: account slab stats per lruvec
2017-07-06 16:24:35 -07:00
slob.c
mm: Rename SLAB_DESTROY_BY_RCU to SLAB_TYPESAFE_BY_RCU
2017-04-18 11:42:36 -07:00
slub.c
mm: memcontrol: account slab stats per lruvec
2017-07-06 16:24:35 -07:00
sparse-vmemmap.c
mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic
2017-07-12 16:26:03 -07:00
sparse.c
mm, memory_hotplug: do not associate hotadded memory to zones until online
2017-07-06 16:24:32 -07:00
swap_cgroup.c
mm, THP, swap: delay splitting THP during swap out
2017-07-06 16:24:31 -07:00
swap_slots.c
mm/swap_slots.c: don't disable preemption while taking the per-CPU cache
2017-07-10 16:32:32 -07:00
swap_state.c
swap: add block io poll in swapin path
2017-07-10 16:32:30 -07:00
swap.c
mm: swap: provide lru_add_drain_all_cpuslocked()
2017-07-10 16:32:33 -07:00
swapfile.c
swap: add block io poll in swapin path
2017-07-10 16:32:30 -07:00
truncate.c
mm/truncate.c: fix THP handling in invalidate_mapping_pages()
2017-07-10 16:32:32 -07:00
usercopy.c
mm/usercopy: Drop extra is_vmalloc_or_module() check
2017-04-05 12:30:18 -07:00
userfaultfd.c
mm: convert generic code to 5-level paging
2017-03-09 11:48:47 -08:00
util.c
mm: fix global NR_SLAB_.*CLAIMABLE counter reads
2017-08-10 15:54:06 -07:00
vmacache.c
sched/headers: Prepare to move 'init_task' and 'init_thread_union' from <linux/sched.h> to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
vmalloc.c
mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic
2017-07-12 16:26:03 -07:00
vmpressure.c
mm, vmpressure: pass-through notification support
2017-07-10 16:32:31 -07:00
vmscan.c
mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic
2017-07-12 16:26:03 -07:00
vmstat.c
mm: avoid taking zone lock in pagetypeinfo_showmixed()
2017-07-10 16:32:32 -07:00
workingset.c
mm: memcontrol: per-lruvec stats infrastructure
2017-07-06 16:24:35 -07:00
z3fold.c
z3fold: fix page locking in z3fold_alloc()
2017-04-13 18:24:20 -07:00
zbud.c
mm/zbud.c: use list_last_entry() instead of list_tail_entry()
2016-01-15 11:40:52 -08:00
zpool.c
mm: zsmalloc: constify struct zs_pool name
2015-11-06 17:50:42 -08:00
zsmalloc.c
zram: do not free pool->size_class
2017-08-02 16:34:47 -07:00
zswap.c
mm/zswap.c: delete an error message for a failed memory allocation in zswap_dstmem_prepare()
2017-07-06 16:24:35 -07:00