In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/isolation: Defer freeing of cpumask memblock memory to initcall<\/p>\n
When testing a linux-next kernel with commit 59bd1d914bb5 (“memblock:
\nwarn when freeing reserved memory before memory map is initialized”),
\nthe following warning was hit when there was a “nohz_full” kernel boot
\nparameter.<\/p>\n
Cannot free reserved memory because of deferred initialization of the memory map
\n WARNING: mm\/memblock.c:904 at __free_reserved_area+0xde\/0xf0, CPU#0: swapper\/0\/0
\n :
\n Call Trace:<\/p>\n
memblock_phys_free+0xcb\/0x100
\n housekeeping_init+0x14c\/0x170
\n start_kernel+0x207\/0x450
\n x86_64_start_reservations+0x24\/0x30
\n x86_64_start_kernel+0xda\/0xe0
\n common_startup_64+0x13e\/0x141<\/p>\n
IOW, we shouldn’t free memblock allocated memory so early
\nin the boot process when memory map isn’t fully initialized in
\ndeferred_init_memmap().<\/p>\n
Fix it by saving the housekeeping cpumask memblock memory to be
\nfreed into a llist free list in housekeeping_init() and add a new
\nhousekeeping_late_init() helper to defer the actual freeing of memblock
\nmemory to when initcall’s are being processed. The cpumask memblock
\nmemory is treated as a llist_node with the size of a “long” type which
\nis also smallest cpumask size that can be allocated.<\/p>\n
The non-atomic version of the llist APIs are used as there is no
\ncontention.<\/p>\n
This commit depends on the presence of commit 7c2eee9c1367 (“memblock:
\ndon’t touch memblock arrays when memblock_free() is called late”)
\nto prevent a KASAN UAF bug report [1].<\/p>\n
[1] https:\/\/lore.kernel.org\/lkml\/20260505051821.1107133-1-longman@redhat.com\/<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/isolation: Defer freeing of cpumask memblock memory to initcall<\/p>\n
When testing a linux-next kernel with commit 59bd1d914bb5 (“<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28517","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}