If we do arm_memblock_steal with a page which is not aligned with section size,
panic can happen during boot by page fault in map_lowmem.

Detail:

1) mdesc->reserve can steal a page which is allocated at 0x1ffff000 by memblock
? which prefers tail pages of regions.
2) map_lowmem maps 0x00000000 - 0x1fe00000
3) map_lowmem try to map 0x1fe00000 but it's not aligned by section due to 1.
4) calling alloc_init_pte allocates a new page for new pte by memblock_alloc
5) allocated memory for pte is 0x1fffe000 -> it's not mapped yet.
6) memset(ptr, 0, sz) in early_alloc_aligned got PANICed!

This patch fix it by limiting memblock to mapped memory range.

Reported-by: Jongsung Kim <redacted>
Suggested-by: Chanho Min <chanho.min@lge.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
---
?arch/arm/mm/mmu.c | ? 37 ++++++++++++++++++++++---------------
?1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e5dad60..a15aafe 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c

@@ -594,7 +594,7 @@ static void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,

?static void __init alloc_init_section(pud_t *pud, unsigned long addr,
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?unsigned long end, phys_addr_t phys,
- ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? const struct mem_type *type)
+ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? const struct mem_type *type, bool lowmem)
?{
? ? ? ?pmd_t *pmd = pmd_offset(pud, addr);

@@ -619,6 +619,8 @@ static void __init alloc_init_section(pud_t *pud, unsigned long addr,

? ? ? ? ? ? ? ?flush_pmd_entry(p);
? ? ? ?} else {
+ ? ? ? ? ? ? ? if (lowmem)
+ ? ? ? ? ? ? ? ? ? ? ? memblock_set_current_limit(__pa(addr));
? ? ? ? ? ? ? ?/*
? ? ? ? ? ? ? ? * No need to loop; pte's aren't interested in the
? ? ? ? ? ? ? ? * individual L1 entries.

@@ -628,14 +630,15 @@ static void __init alloc_init_section(pud_t *pud, unsigned long addr,

?}

?static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
- ? ? ? unsigned long end, unsigned long phys, const struct mem_type *type)
+ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? unsigned long end, unsigned long phys,
+ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? const struct mem_type *type, bool lowmem)
?{
? ? ? ?pud_t *pud = pud_offset(pgd, addr);
? ? ? ?unsigned long next;

? ? ? ?do {
? ? ? ? ? ? ? ?next = pud_addr_end(addr, end);
- ? ? ? ? ? ? ? alloc_init_section(pud, addr, next, phys, type);
+ ? ? ? ? ? ? ? alloc_init_section(pud, addr, next, phys, type, lowmem);
? ? ? ? ? ? ? ?phys += next - addr;
? ? ? ?} while (pud++, addr = next, addr != end);
?}

@@ -702,14 +705,7 @@ static void __init create_36bit_mapping(struct map_desc *md,

?}
?#endif /* !CONFIG_ARM_LPAE */

-/*
- * Create the page directory entries and any necessary
- * page tables for the mapping specified by `md'. ?We
- * are able to cope here with varying sizes and address
- * offsets, and we take full advantage of sections and
- * supersections.
- */
-static void __init create_mapping(struct map_desc *md)
+static inline void __create_mapping(struct map_desc *md, bool lowmem)
?{
? ? ? ?unsigned long addr, length, end;
? ? ? ?phys_addr_t phys;

@@ -759,7 +755,7 @@ static void __init create_mapping(struct map_desc *md)

? ? ? ?do {
? ? ? ? ? ? ? ?unsigned long next = pgd_addr_end(addr, end);

- ? ? ? ? ? ? ? alloc_init_pud(pgd, addr, next, phys, type);
+ ? ? ? ? ? ? ? alloc_init_pud(pgd, addr, next, phys, type, lowmem);

? ? ? ? ? ? ? ?phys += next - addr;
? ? ? ? ? ? ? ?addr = next;

@@ -767,6 +763,18 @@ static void __init create_mapping(struct map_desc *md)

?}

?/*
+ * Create the page directory entries and any necessary
+ * page tables for the mapping specified by `md'. ?We
+ * are able to cope here with varying sizes and address
+ * offsets, and we take full advantage of sections and
+ * supersections.
+ */
+static void __init create_mapping(struct map_desc *md)
+{
+ ? ? ? __create_mapping(md, false);
+}
+
+/*
?* Create the architecture specific mappings
?*/
?void __init iotable_init(struct map_desc *io_desc, int nr)

@@ -1111,7 +1119,7 @@ static void __init map_lowmem(void)

? ? ? ? ? ? ? ?map.length = end - start;
? ? ? ? ? ? ? ?map.type = MT_MEMORY;

- ? ? ? ? ? ? ? create_mapping(&map);
+ ? ? ? ? ? ? ? __create_mapping(&map, true);
? ? ? ?}
?}

@@ -1123,11 +1131,10 @@ void __init paging_init(struct machine_desc *mdesc)

?{
? ? ? ?void *zero_page;

- ? ? ? memblock_set_current_limit(arm_lowmem_limit);
-
? ? ? ?build_mem_type_table();
? ? ? ?prepare_page_table();
? ? ? ?map_lowmem();
+ ? ? ? memblock_set_current_limit(arm_lowmem_limit);
? ? ? ?dma_contiguous_remap();
? ? ? ?devicemaps_init(mdesc);
? ? ? ?kmap_init();
--
1.7.9.5