diff options
| author | Geert Uytterhoeven <geert@linux-m68k.org> | 2021-03-12 18:46:34 +0300 |
|---|---|---|
| committer | Palmer Dabbelt <palmerdabbelt@google.com> | 2021-03-17 07:55:11 +0300 |
| commit | ce989f1472ae350e844b10c880b22543168fbc92 (patch) | |
| tree | 2fefbfccbc44de36c49b97887dfba8fa3a6d102e /arch/riscv/kernel | |
| parent | fa59030bf8555a4eb83342fd23c32e30d4f2fe7a (diff) | |
| download | linux-ce989f1472ae350e844b10c880b22543168fbc92.tar.xz | |
RISC-V: Fix out-of-bounds accesses in init_resources()
init_resources() allocates an array of resources, based on the current
total number of memory regions and reserved memory regions. However,
allocating this array using memblock_alloc() might increase the number
of reserved memory regions. If that happens, populating the array later
based on the new number of regions will cause out-of-bounds writes
beyond the end of the allocated array.
Fix this by allocating one more entry, which may or may not be used.
Fixes: 797f0375dd2ef5cd ("RISC-V: Do not allocate memblock while iterating reserved memblocks")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Atish Patra <atish.patra@wdc.com>
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Diffstat (limited to 'arch/riscv/kernel')
| -rw-r--r-- | arch/riscv/kernel/setup.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c index e85bacff1b50..f8f15332caa2 100644 --- a/arch/riscv/kernel/setup.c +++ b/arch/riscv/kernel/setup.c @@ -147,7 +147,8 @@ static void __init init_resources(void) bss_res.end = __pa_symbol(__bss_stop) - 1; bss_res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; - mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt) * sizeof(*mem_res); + /* + 1 as memblock_alloc() might increase memblock.reserved.cnt */ + mem_res_sz = (memblock.memory.cnt + memblock.reserved.cnt + 1) * sizeof(*mem_res); mem_res = memblock_alloc(mem_res_sz, SMP_CACHE_BYTES); if (!mem_res) panic("%s: Failed to allocate %zu bytes\n", __func__, mem_res_sz); |