• Rafael J. Wysocki's avatar
    ACPI: tables: x86: Reserve memory occupied by ACPI tables · 1a1c130a
    Rafael J. Wysocki authored
    The following problem has been reported by George Kennedy:
    
     Since commit 7fef431b ("mm/page_alloc: place pages to tail
     in __free_pages_core()") the following use after free occurs
     intermittently when ACPI tables are accessed.
    
     BUG: KASAN: use-after-free in ibft_init+0x134/0xc49
     Read of size 4 at addr ffff8880be453004 by task swapper/0/1
     CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0de #1
     Call Trace:
      dump_stack+0xf6/0x158
      print_address_description.constprop.9+0x41/0x60
      kasan_report.cold.14+0x7b/0xd4
      __asan_report_load_n_noabort+0xf/0x20
      ibft_init+0x134/0xc49
      do_one_initcall+0xc4/0x3e0
      kernel_init_freeable+0x5af/0x66b
      kernel_init+0x16/0x1d0
      ret_from_fork+0x22/0x30
    
     ACPI tables mapped via kmap() do not have their mapped pages
     reserved and the pages can be "stolen" by the buddy allocator.
    
    Apparently, on the affected system, the ACPI table in question is
    not located in "reserved" memory, like ACPI NVS or ACPI Data, that
    will not be used by the buddy allocator, so the memory occupied by
    that table has to be explicitly reserved to prevent the buddy
    allocator from using it.
    
    In order to address this problem, rearrange the initialization of the
    ACPI tables on x86 to locate the initial tables earlier and reserve
    the memory occupied by them.
    
    The other architectures using ACPI should not be affected by this
    change.
    
    Link: https://lore.kernel.org/linux-acpi/1614802160-29362-1-git-send-email-george.kennedy@oracle.com/Reported-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
    Tested-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
    Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
    Reviewed-by: default avatarMike Rapoport <rppt@linux.ibm.com>
    Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
    1a1c130a
boot.c 42.6 KB