This is a note to let you know that I've just added the patch titled RISC-V: Fix out-of-bounds accesses in init_resources() to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: risc-v-fix-out-of-bounds-accesses-in-init_resources.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From ce989f1472ae350e844b10c880b22543168fbc92 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> Date: Fri, 12 Mar 2021 16:46:34 +0100 Subject: RISC-V: Fix out-of-bounds accesses in init_resources() From: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> commit ce989f1472ae350e844b10c880b22543168fbc92 upstream. init_resources() allocates an array of resources, based on the current total number of memory regions and reserved memory regions. However, allocating this array using memblock_alloc() might increase the number of reserved memory regions. If that happens, populating the array later based on the new number of regions will cause out-of-bounds writes beyond the end of the allocated array. Fix this by allocating one more entry, which may or may not be used. Fixes: 797f0375dd2ef5cd ("RISC-V: Do not allocate memblock while iterating reserved memblocks") Signed-off-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> Reviewed-by: Atish Patra <atish.patra@xxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Palmer Dabbelt <palmerdabbelt@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/riscv/kernel/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/riscv/kernel/setup.c +++ b/arch/riscv/kernel/setup.c @@ -147,7 +147,8 @@ static void __init init_resources(void) bss_res.end = __pa_symbol(__bss_stop) - 1; bss_res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; - mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt) * sizeof(*mem_res); + /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */ + mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt + 1) * sizeof(*mem_res); mem_res = memblock_alloc(mem_res_sz, SMP_CACHE_BYTES); if (!mem_res) panic("%s: Failed to allocate %zu bytes\n", __func__, mem_res_sz); Patches currently in stable-queue which might be from geert@xxxxxxxxxxxxxx are queue-5.11/risc-v-fix-out-of-bounds-accesses-in-init_resources.patch