diff options
| author | Tao Liu <ltao@redhat.com> | 2026-07-06 11:27:07 +1200 |
|---|---|---|
| committer | Paul Walmsley <pjw@kernel.org> | 2026-07-06 18:24:06 -0600 |
| commit | 81bbcff0c053c4f5c711c31a9b72fc492bd96c3f (patch) | |
| tree | 4f734318e86104ec3ad1609eeb827e194b2c3449 /rust/zerocopy/src/git@git.tavy.me:linux-stable.git | |
| parent | 8cdeaa50eae8dad34885515f62559ee83e7e8dda (diff) | |
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
A NULL pointer dereference issue is noticed in riscv's
machine_kexec_prepare(), where image->segment[i].buf might be NULL and
copied unchecked.
The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():
kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()
Address this by adding a check before the data copy attempt.
Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/kexec/CAO7dBbVftLUhd2qrh7hmijTB3PEPfZAhykCGqEfrPoOcSrrj-w@mail.gmail.com/
Acked-by: Baoquan He <bhe@redhat.com>
Acked-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Signed-off-by: Tao Liu <ltao@redhat.com>
Link: https://patch.msgid.link/20260705232706.30265-2-ltao@redhat.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Diffstat (limited to 'rust/zerocopy/src/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions
