Skip to contentSkip to conversation

riscv: Fix a NULL pointer reference in machine_kexec_prepare

PATCH Superseded Tao Liu 2 participants 2 messages Jun 27 – Jun 29

Subsystems (3)
RISC-V Live update kexec handover (KHO)

v2 of 5 Superseded Latest is v5 →

lore
Share & tools
lore

Tao Liu

author
#0 lore raw

PATCH v2 1/1 riscv: Fix a NULL pointer reference in machine_kexec_prepare

A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare, where image->segment[i].buf might be NULL and copied unchecked.

The NULL buf comes from security/integrity/ima/ima_kexec.c:
ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL.

Fix this by simply adding a check before copy.

Acked-by Baoquan He <[email protected]>
Signed-off-by Tao Liu <[email protected]>

---

v2 -> v1: add code comments as suggested by Baoquan.
link to v1: https://lore.kernel.org/linux-riscv/[email protected]/

---
 arch/riscv/kernel/machine_kexec.c | 7 +++++++
 1 file changed, 7 insertions(+)
arch/riscv/kernel/machine_kexec.c +7 -0
index 2306ce3e5f22..afc68f6a4aa1 100644
@@ -41,6 +41,13 @@ machine_kexec_prepare(struct kimage *image)
 		if (image->segment[i].memsz <= sizeof(fdt))
 			continue;
 
+		/*
+		 * Some segments (e.g. IMA) reserve space but have no buffer
+		 * loaded yet. Skip them as they cannot contain an FDT.
+		 */
+		if (image->segment[i].buf == NULL)
+			continue;
+
 		if (image->file_mode)
 			memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
 		else if (copy_from_user(&fdt, image->segment[i].buf, sizeof(fdt)))
Signature · 1 line
2.54.0
maintainer Acked-by on v2 1/1
#1 lore raw
Quoted 11 lines · Tao Liu

A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare, where image->segment[i].buf might be NULL and copied unchecked.

The NULL buf comes from security/integrity/ima/ima_kexec.c:
ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(), but kbuf.buffer is NULL.

Fix this by simply adding a check before copy.

Acked-by Baoquan He <[email protected]>
Signed-off-by Tao Liu <[email protected]>
Acked-by Pratyush Yadav <[email protected]>

[...]

Signature · 2 lines
Regards,
Pratyush Yadav