kernel_optimize_test/include
Rafael J. Wysocki cdd192a20b ACPI: tables: x86: Reserve memory occupied by ACPI tables
commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a upstream.

The following problem has been reported by George Kennedy:

 Since commit 7fef431be9 ("mm/page_alloc: place pages to tail
 in __free_pages_core()") the following use after free occurs
 intermittently when ACPI tables are accessed.

 BUG: KASAN: use-after-free in ibft_init+0x134/0xc49
 Read of size 4 at addr ffff8880be453004 by task swapper/0/1
 CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0d #1
 Call Trace:
  dump_stack+0xf6/0x158
  print_address_description.constprop.9+0x41/0x60
  kasan_report.cold.14+0x7b/0xd4
  __asan_report_load_n_noabort+0xf/0x20
  ibft_init+0x134/0xc49
  do_one_initcall+0xc4/0x3e0
  kernel_init_freeable+0x5af/0x66b
  kernel_init+0x16/0x1d0
  ret_from_fork+0x22/0x30

 ACPI tables mapped via kmap() do not have their mapped pages
 reserved and the pages can be "stolen" by the buddy allocator.

Apparently, on the affected system, the ACPI table in question is
not located in "reserved" memory, like ACPI NVS or ACPI Data, that
will not be used by the buddy allocator, so the memory occupied by
that table has to be explicitly reserved to prevent the buddy
allocator from using it.

In order to address this problem, rearrange the initialization of the
ACPI tables on x86 to locate the initial tables earlier and reserve
the memory occupied by them.

The other architectures using ACPI should not be affected by this
change.

Link: https://lore.kernel.org/linux-acpi/1614802160-29362-1-git-send-email-george.kennedy@oracle.com/
Reported-by: George Kennedy <george.kennedy@oracle.com>
Tested-by: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-07 15:00:08 +02:00
..
acpi ACPI: scan: Use unique number for instance_no 2021-03-30 14:32:06 +02:00
asm-generic static_call: Allow module use without exposing static_call_key 2021-03-30 14:31:53 +02:00
clocksource
crypto crypto - shash: reduce minimum alignment of shash_desc structure 2021-03-09 11:11:13 +01:00
drm drm/dp/mst: Export drm_dp_get_vc_payload_bw() 2021-02-10 09:29:18 +01:00
dt-bindings ASoC: dt-bindings: lpass: Fix and common up lpass dai ids 2021-02-03 23:28:46 +01:00
keys
kunit
kvm
linux ACPI: tables: x86: Reserve memory occupied by ACPI tables 2021-04-07 15:00:08 +02:00
math-emu
media media: rc: compile rc-cec.c into rc-core 2021-03-17 17:06:20 +01:00
memory
misc
net can: dev: Move device back to init netns on owning netns delete 2021-03-30 14:32:08 +02:00
pcmcia
ras
rdma RDMA: Lift ibdev_to_node from rds to common code 2021-02-26 10:12:59 +01:00
scsi scsi: libsas: Introduce a _gfp() variant of event notifiers 2021-03-25 09:04:11 +01:00
soc net: dsa: felix: implement port flushing on .phylink_mac_link_down 2021-02-17 11:02:27 +01:00
sound ALSA: hda: intel-nhlt: verify config type 2021-03-09 11:11:14 +01:00
target scsi: target: core: Add cmd length set before cmd complete 2021-03-17 17:06:25 +01:00
trace
uapi psample: Fix user API breakage 2021-03-30 14:31:53 +02:00
vdso
video
xen Xen/gntdev: correct error checking in gntdev_map_grant_pages() 2021-02-23 15:53:24 +01:00