From 6c60d5b1be3cd443f58bdefdf5898c5ca2176ab0 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Mon, 21 Jan 2019 16:55:31 +0800 Subject: [PATCH] arm64: memblock: don't permit memblock resizing until linear mapping is up mainline inclusion from mainline-4.20 commit 24cc61d8cb5a9232fadf21a830061853c1268fdd category: bugfix bugzilla: 5501 CVE: NA ------------------------------------------------- Bhupesh reports that having numerous memblock reservations at early boot may result in the following crash: Unable to handle kernel paging request at virtual address ffff80003ffe0000 ... Call trace: __memcpy+0x110/0x180 memblock_add_range+0x134/0x2e8 memblock_reserve+0x70/0xb8 memblock_alloc_base_nid+0x6c/0x88 __memblock_alloc_base+0x3c/0x4c memblock_alloc_base+0x28/0x4c memblock_alloc+0x2c/0x38 early_pgtable_alloc+0x20/0xb0 paging_init+0x28/0x7f8 This is caused by the fact that we permit memblock resizing before the linear mapping is up, and so the memblock_reserved() array is moved into memory that is not mapped yet. So let's ensure that this crash can no longer occur, by deferring to call to memblock_allow_resize() to after the linear mapping has been created. Reported-by: Bhupesh Sharma Acked-by: Will Deacon Tested-by: Marc Zyngier Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas Signed-off-by: Yang Yingliang Reviewed-by: Hanjun Guo --- arch/arm64/mm/init.c | 2 -- arch/arm64/mm/mmu.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c index 787e27964ab9..9985df839190 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -486,8 +486,6 @@ void __init arm64_memblock_init(void) high_memory = __va(memblock_end_of_DRAM() - 1) + 1; dma_contiguous_reserve(arm64_dma_phys_limit); - - memblock_allow_resize(); } void __init bootmem_init(void) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 8080c9f489c3..cad24a2551fd 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -657,6 +657,8 @@ void __init paging_init(void) memblock_free(__pa_symbol(swapper_pg_dir) + PAGE_SIZE, __pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir) - PAGE_SIZE); + + memblock_allow_resize(); } /* -- GitLab