Skip to content

Commit 34cf99c

Browse files
rikvanrielIngo Molnar
authored andcommitted
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range(). With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic. Switch ima_free_kexec_buffer() over to memblock_free_late() to avoid that bug. Fixes: fee3ff9 ("powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c") Suggested-by: Mike Rappoport <rppt@kernel.org> Signed-off-by: Rik van Riel <riel@surriel.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://lore.kernel.org/r/20230817135558.67274c83@imladris.surriel.com
1 parent ce9ecca commit 34cf99c

File tree

1 file changed

+2
-6
lines changed

1 file changed

+2
-6
lines changed

arch/x86/kernel/setup.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -358,15 +358,11 @@ static void __init add_early_ima_buffer(u64 phys_addr)
358358
#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
359359
int __init ima_free_kexec_buffer(void)
360360
{
361-
int rc;
362-
363361
if (!ima_kexec_buffer_size)
364362
return -ENOENT;
365363

366-
rc = memblock_phys_free(ima_kexec_buffer_phys,
367-
ima_kexec_buffer_size);
368-
if (rc)
369-
return rc;
364+
memblock_free_late(ima_kexec_buffer_phys,
365+
ima_kexec_buffer_size);
370366

371367
ima_kexec_buffer_phys = 0;
372368
ima_kexec_buffer_size = 0;

0 commit comments

Comments
 (0)