Rafael J. Wysocki cdd192a20b ACPI: tables: x86: Reserve memory occupied by ACPI tables ... commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a upstream. The following problem has been reported by George Kennedy: Since commit 7fef431be9 ("mm/page_alloc: place pages to tail in __free_pages_core()") the following use after free occurs intermittently when ACPI tables are accessed. BUG: KASAN: use-after-free in ibft_init+0x134/0xc49 Read of size 4 at addr ffff8880be453004 by task swapper/0/1 CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0d #1 Call Trace: dump_stack+0xf6/0x158 print_address_description.constprop.9+0x41/0x60 kasan_report.cold.14+0x7b/0xd4 __asan_report_load_n_noabort+0xf/0x20 ibft_init+0x134/0xc49 do_one_initcall+0xc4/0x3e0 kernel_init_freeable+0x5af/0x66b kernel_init+0x16/0x1d0 ret_from_fork+0x22/0x30 ACPI tables mapped via kmap() do not have their mapped pages reserved and the pages can be "stolen" by the buddy allocator. Apparently, on the affected system, the ACPI table in question is not located in "reserved" memory, like ACPI NVS or ACPI Data, that will not be used by the buddy allocator, so the memory occupied by that table has to be explicitly reserved to prevent the buddy allocator from using it. In order to address this problem, rearrange the initialization of the ACPI tables on x86 to locate the initial tables earlier and reserve the memory occupied by them. The other architectures using ACPI should not be affected by this change. Link: https://lore.kernel.org/linux-acpi/1614802160-29362-1-git-send-email-george.kennedy@oracle.com/ Reported-by: George Kennedy <george.kennedy@oracle.com> Tested-by: George Kennedy <george.kennedy@oracle.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Mike Rapoport <rppt@linux.ibm.com> Cc: 5.10+ <stable@vger.kernel.org> # 5.10+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-07 15:00:08 +02:00
..
acpi	ACPI: scan: Use unique number for instance_no	2021-03-30 14:32:06 +02:00
asm-generic	static_call: Allow module use without exposing static_call_key	2021-03-30 14:31:53 +02:00
clocksource
crypto	crypto - shash: reduce minimum alignment of shash_desc structure	2021-03-09 11:11:13 +01:00
drm	drm/dp/mst: Export drm_dp_get_vc_payload_bw()	2021-02-10 09:29:18 +01:00
dt-bindings	ASoC: dt-bindings: lpass: Fix and common up lpass dai ids	2021-02-03 23:28:46 +01:00
keys
kunit	kunit: fix display of failed expectations for strings	2020-11-10 13:45:15 -07:00
kvm
linux	ACPI: tables: x86: Reserve memory occupied by ACPI tables	2021-04-07 15:00:08 +02:00
math-emu
media	media: rc: compile rc-cec.c into rc-core	2021-03-17 17:06:20 +01:00
memory
misc
net	can: dev: Move device back to init netns on owning netns delete	2021-03-30 14:32:08 +02:00
pcmcia
ras
rdma	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
scsi	scsi: libsas: Introduce a _gfp() variant of event notifiers	2021-03-25 09:04:11 +01:00
soc	net: dsa: felix: implement port flushing on .phylink_mac_link_down	2021-02-17 11:02:27 +01:00
sound	ALSA: hda: intel-nhlt: verify config type	2021-03-09 11:11:14 +01:00
target	scsi: target: core: Add cmd length set before cmd complete	2021-03-17 17:06:25 +01:00
trace	trace: fix potenial dangerous pointer	2020-11-25 13:03:44 +01:00
uapi	psample: Fix user API breakage	2021-03-30 14:31:53 +02:00
vdso
video
xen	Xen/gntdev: correct error checking in gntdev_map_grant_pages()	2021-02-23 15:53:24 +01:00