{"id":2218959,"url":"http://patchwork.ozlabs.org/api/patches/2218959/?format=json","web_url":"http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260402072701.628293-6-ruanjinjie@huawei.com/","project":{"id":2,"url":"http://patchwork.ozlabs.org/api/projects/2/?format=json","name":"Linux PPC development","link_name":"linuxppc-dev","list_id":"linuxppc-dev.lists.ozlabs.org","list_email":"linuxppc-dev@lists.ozlabs.org","web_url":"https://github.com/linuxppc/wiki/wiki","scm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git","webscm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/","list_archive_url":"https://lore.kernel.org/linuxppc-dev/","list_archive_url_format":"https://lore.kernel.org/linuxppc-dev/{}/","commit_url_format":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id={}"},"msgid":"<20260402072701.628293-6-ruanjinjie@huawei.com>","list_archive_url":"https://lore.kernel.org/linuxppc-dev/20260402072701.628293-6-ruanjinjie@huawei.com/","date":"2026-04-02T07:26:51","name":"[v12,05/15] riscv: kexec_file: Fix potential buffer overflow in prepare_elf_headers()","commit_ref":null,"pull_url":null,"state":"handled-elsewhere","archived":false,"hash":"a3443582057531315f69d022ae7de1b81479dbfb","submitter":{"id":84791,"url":"http://patchwork.ozlabs.org/api/people/84791/?format=json","name":"Jinjie Ruan","email":"ruanjinjie@huawei.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260402072701.628293-6-ruanjinjie@huawei.com/mbox/","series":[{"id":498443,"url":"http://patchwork.ozlabs.org/api/series/498443/?format=json","web_url":"http://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=498443","date":"2026-04-02T07:26:46","name":"arm64/riscv: Add support for crashkernel CMA reservation","version":12,"mbox":"http://patchwork.ozlabs.org/series/498443/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2218959/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2218959/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linuxppc-dev@lists.ozlabs.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256\n header.s=dkim header.b=Hh6dkgZQ;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org\n (client-ip=112.213.38.117; helo=lists.ozlabs.org;\n envelope-from=linuxppc-dev+bounces-19196-incoming=patchwork.ozlabs.org@lists.ozlabs.org;\n receiver=patchwork.ozlabs.org)","lists.ozlabs.org;\n arc=none smtp.remote-ip=113.46.200.223","lists.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=huawei.com","lists.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256\n header.s=dkim header.b=Hh6dkgZQ;\n\tdkim-atps=neutral","lists.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=huawei.com\n (client-ip=113.46.200.223; helo=canpmsgout08.his.huawei.com;\n envelope-from=ruanjinjie@huawei.com; receiver=lists.ozlabs.org)"],"Received":["from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fmYLq4DXYz1yCs\n\tfor ; Thu, 02 Apr 2026 18:26:27 +1100 (AEDT)","from boromir.ozlabs.org (localhost [127.0.0.1])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 4fmYLL2qGBz2yv9;\n\tThu, 02 Apr 2026 18:26:02 +1100 (AEDT)","from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com\n [113.46.200.223])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 4fmYLK39Mpz2yYK\n\tfor ; Thu, 02 Apr 2026 18:26:01 +1100 (AEDT)","from mail.maildlp.com (unknown [172.19.163.15])\n\tby canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4fmYC71jnzzmVD8;\n\tThu, 2 Apr 2026 15:19:47 +0800 (CST)","from dggpemf500011.china.huawei.com (unknown [7.185.36.131])\n\tby mail.maildlp.com (Postfix) with ESMTPS id 10FCD40571;\n\tThu, 2 Apr 2026 15:25:59 +0800 (CST)","from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com\n (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 2 Apr\n 2026 15:25:55 +0800"],"ARC-Seal":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1775114762;\n\tcv=none;\n b=i+joPWKDqY8iMLPJlwFDTiz6Fgo3Cs6NMpqsVt9p9KJMuwcG8B66UCXBtCx+7Gm1xbqvsUV1GimaMRc0KBL/o+facWNtrxMcJFx6tDKoVPLRB+RH8dWbpk5FuC9G4tQlQRqCnvsfsXmh3XycPB6Gh1UTJGxPrivRYQFiSNxrGLQsP1oSy0ArVz2LgwTs09K1rxRCxPKYJw2oPkXdOzzXoAsVhbPwrW6LHkQTCWKDeyCNu5Ww9ddwdrHJnvi6JleObMys5qYvk8ZpHEXkPMdfwVBP/J05g+ouxXt+zIxjxZYzgpC8yp6pJC1V1vylok+UTAhfGYrHVb5d2u+FguPxYA==","ARC-Message-Signature":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707;\n\tt=1775114762; c=relaxed/relaxed;\n\tbh=2CVL6M7h4vY4kI4KzhS6vFtDcU8tP4DeufZv1p45yx8=;\n\th=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version:Content-Type;\n b=nWqNwcpT1+hwhOmHuxbAxSpRr32hpoCuq92v2i0akghbHTMaRDUxTsNmgA6XA902g595+v5nSw+7eObIZuGhXAVMA2nwkVa3nZKvV6vvurMEEti6DgTP5OE6MJ/daV45mPVxmPcBuT/NsPlTc1CEqsEmuJXRlT2b7V6LwFQ1TGU1NpJR2fpXBJN/ZhECbl45b2+tOsMuxWu8Bjmcq+ENkvIALQiNdFlAHReW+lf4c6BlVN5xcnVARzvNmhrdeBQiC9uKVJlz/e9qc1MTzK65lKTO8UUgyXfxDYrm37+n7E7I7fZrNpTFEgvxpWvpCD7MAofKGi53TZQ5QgB9XBBkNw==","ARC-Authentication-Results":"i=1; lists.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=huawei.com;\n dkim=pass (1024-bit key;\n unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256\n header.s=dkim header.b=Hh6dkgZQ; dkim-atps=neutral;\n spf=pass (client-ip=113.46.200.223; helo=canpmsgout08.his.huawei.com;\n envelope-from=ruanjinjie@huawei.com;\n receiver=lists.ozlabs.org) smtp.mailfrom=huawei.com","dkim-signature":"v=1; a=rsa-sha256; d=huawei.com; s=dkim;\n\tc=relaxed/relaxed; q=dns/txt;\n\th=From;\n\tbh=2CVL6M7h4vY4kI4KzhS6vFtDcU8tP4DeufZv1p45yx8=;\n\tb=Hh6dkgZQcTT1fQKxm1gP5TRn0Ugnr1hO9wW6ndbdksU/Dokcvl9DqG9mj5IhUFYQyRr6MBv6I\n\tquSBZOA4Eb8bx6CLRE0Gc/xp9qPblaGRburMfLWy5Dff6nsQC2yFAn386Ocl3CwKCnHWmkBVHAs\n\tZqkM3+yoksIFhlU8Cv8y86k=","From":"Jinjie Ruan ","To":", , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, , ,\n\t, ,\n\t, , ,\n\t, ,\n\t, ,\n\t, ,\n\t, ,\n\t","CC":"","Subject":"[PATCH v12 05/15] riscv: kexec_file: Fix potential buffer overflow in\n prepare_elf_headers()","Date":"Thu, 2 Apr 2026 15:26:51 +0800","Message-ID":"<20260402072701.628293-6-ruanjinjie@huawei.com>","X-Mailer":"git-send-email 2.34.1","In-Reply-To":"<20260402072701.628293-1-ruanjinjie@huawei.com>","References":"<20260402072701.628293-1-ruanjinjie@huawei.com>","X-Mailing-List":"linuxppc-dev@lists.ozlabs.org","List-Id":"","List-Help":"","List-Owner":"","List-Post":"","List-Archive":",\n ","List-Subscribe":",\n ,\n ","List-Unsubscribe":"","Precedence":"list","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Content-Type":"text/plain","X-Originating-IP":"[10.90.53.73]","X-ClientProxiedBy":"kwepems100002.china.huawei.com (7.221.188.206) To\n dggpemf500011.china.huawei.com (7.185.36.131)","X-Spam-Status":"No, score=-0.2 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,\n\tDKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=disabled\n\tversion=4.0.1 OzLabs 8","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org"},"content":"There is a race condition between the kexec_load() system call\n(crash kernel loading path) and memory hotplug operations that can lead\nto buffer overflow and potential kernel crash.\n\nDuring prepare_elf_headers(), the following steps occur:\n1. get_nr_ram_ranges_callback() queries current System RAM memory ranges\n2. Allocates buffer based on queried count\n3. prepare_elf64_ram_headers_callback() populates ranges from memblock\n\nIf memory hotplug occurs between step 1 and step 3, the number of ranges\ncan increase, causing out-of-bounds write when populating cmem->ranges[].\n\nThis happens because kexec_load() uses kexec_trylock (atomic_t) while\nmemory hotplug uses device_hotplug_lock (mutex), so they don't serialize\nwith each other.\n\nJust add bounds checking in prepare_elf64_ram_headers_callback() to prevent\nout-of-bounds (OOB) access.\n\nFixes: 8acea455fafa (\"RISC-V: Support for kexec_file on panic\")\nReviewed-by: Guo Ren \nSigned-off-by: Jinjie Ruan \n---\n arch/riscv/kernel/machine_kexec_file.c | 3 +++\n 1 file changed, 3 insertions(+)","diff":"diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/machine_kexec_file.c\nindex 3f7766057cac..773a1cba8ba0 100644\n--- a/arch/riscv/kernel/machine_kexec_file.c\n+++ b/arch/riscv/kernel/machine_kexec_file.c\n@@ -48,6 +48,9 @@ static int prepare_elf64_ram_headers_callback(struct resource *res, void *arg)\n {\n \tstruct crash_mem *cmem = arg;\n \n+\tif (cmem->nr_ranges >= cmem->max_nr_ranges)\n+\t\treturn -ENOMEM;\n+\n \tcmem->ranges[cmem->nr_ranges].start = res->start;\n \tcmem->ranges[cmem->nr_ranges].end = res->end;\n \tcmem->nr_ranges++;\n","prefixes":["v12","05/15"]}