Skip to content

Commit

Permalink
PM: hibernate: fix crashes with init_on_free=1
Browse files Browse the repository at this point in the history
Upon resuming from hibernation, free pages may contain stale data from
the kernel that initiated the resume. This breaks the invariant
inflicted by init_on_free=1 that freed pages must be zeroed.

To deal with this problem, make clear_free_pages() also clear the free
pages when init_on_free is enabled.

Fixes: 6471384 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")
Reported-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: 5.3+ <stable@vger.kernel.org> # 5.3+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  • Loading branch information
Alexander Potapenko authored and Rafael J. Wysocki committed Jan 16, 2020
1 parent b3a987b commit 18451f9
Showing 1 changed file with 10 additions and 10 deletions.
20 changes: 10 additions & 10 deletions kernel/power/snapshot.c
Original file line number Diff line number Diff line change
Expand Up @@ -1147,24 +1147,24 @@ void free_basic_memory_bitmaps(void)

void clear_free_pages(void)
{
#ifdef CONFIG_PAGE_POISONING_ZERO
struct memory_bitmap *bm = free_pages_map;
unsigned long pfn;

if (WARN_ON(!(free_pages_map)))
return;

memory_bm_position_reset(bm);
pfn = memory_bm_next_pfn(bm);
while (pfn != BM_END_OF_MAP) {
if (pfn_valid(pfn))
clear_highpage(pfn_to_page(pfn));

if (IS_ENABLED(CONFIG_PAGE_POISONING_ZERO) || want_init_on_free()) {
memory_bm_position_reset(bm);
pfn = memory_bm_next_pfn(bm);
while (pfn != BM_END_OF_MAP) {
if (pfn_valid(pfn))
clear_highpage(pfn_to_page(pfn));

pfn = memory_bm_next_pfn(bm);
}
memory_bm_position_reset(bm);
pr_info("free pages cleared after restore\n");
}
memory_bm_position_reset(bm);
pr_info("free pages cleared after restore\n");
#endif /* PAGE_POISONING_ZERO */
}

/**
Expand Down

0 comments on commit 18451f9

Please sign in to comment.