The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable@xxxxxxxxxxxxxxx>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x f0362a253606e2031f8d61c74195d4d6556e12a4 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable@xxxxxxxxxxxxxxx>' --in-reply-to '2023082642-catfight-gallantly-8b84@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: f0362a253606 ("mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer") 3ecc68349bba ("memblock: rename memblock_free to memblock_phys_free") fa27717110ae ("memblock: drop memblock_free_early_nid() and memblock_free_early()") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From f0362a253606e2031f8d61c74195d4d6556e12a4 Mon Sep 17 00:00:00 2001 From: Rik van Riel <riel@xxxxxxxxxxx> Date: Thu, 17 Aug 2023 13:57:59 -0400 Subject: [PATCH] mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer The code calling ima_free_kexec_buffer runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range. With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic. Switch ima_free_kexec_buffer over to memblock_free_late to avoid that issue. Fixes: fee3ff99bc67 ("powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c") Cc: stable@xxxxxxxxxx Signed-off-by: Rik van Riel <riel@xxxxxxxxxxx> Suggested-by: Mike Rappoport <rppt@xxxxxxxxxx> Link: https://lore.kernel.org/r/20230817135759.0888e5ef@xxxxxxxxxxxxxxxxxxxx Signed-off-by: Rob Herring <robh@xxxxxxxxxx> diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c index f26d2ba8a371..68278340cecf 100644 --- a/drivers/of/kexec.c +++ b/drivers/of/kexec.c @@ -184,7 +184,8 @@ int __init ima_free_kexec_buffer(void) if (ret) return ret; - return memblock_phys_free(addr, size); + memblock_free_late(addr, size); + return 0; } #endif
