🛡️ CVE-2024-56677 — kernel

powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()

In the Linux kernel, the following vulnerability has been resolved:

powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()

During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,

since pageblock_order is still zero and it gets initialized

later during initmem_init() e.g.

setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order()

One such use case where this causes issue is -

early_setup() -> early_init_devtree() -> fadump_reserve_mem() -> fadump_cma_init()

This causes CMA memory alignment check to be bypassed in

cma_init_reserved_mem(). Then later cma_activate_area() can hit

a VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory

area was not pageblock_order aligned.

Fix it by moving the fadump_cma_init() after initmem_init(),

where other such cma reservations also gets called.

<stack trace>

==============

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010

flags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA

raw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000

raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000

page dumped because: VM_BUG_ON_PAGE(pfn & ((1 << order) - 1))

------------[ cut here ]------------

kernel BUG at mm/page_alloc.c:778!

Call Trace:

__free_one_page+0x57c/0x7b0 (unreliable)

free_pcppages_bulk+0x1a8/0x2c8

free_unref_page_commit+0x3d4/0x4e4

free_unref_page+0x458/0x6d0

init_cma_reserved_pageblock+0x114/0x198

cma_init_reserved_areas+0x270/0x3e0

do_one_initcall+0x80/0x2f8

kernel_init_freeable+0x33c/0x530

kernel_init+0x34/0x26c

ret_from_kernel_user_thread+0x14/0x1c