A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(),
where image->segment[i].buf might be NULL and copied unchecked.
The NULL buf comes from ima_add_kexec_buffer(), where kbuf is added by
kexec_add_buffer(), but kbuf.buffer is NULL, then it is copied without
a check in machine_kexec_prepare():
kexec_file_load
-> kimage_file_alloc_init()
-> kimage_file_prepare_segments()
-> ima_add_kexec_buffer()
-> kexec_add_buffer()
-> machine_kexec_prepare()
-> memcpy()
Address this by adding a check before the data copy attempt.
Fixes: b7fb4d78a6ad ("RISC-V: use memcpy for kexec_file mode")
Cc: [email protected]
Closes:
https://lore.kernel.org/kexec/cao7dbbvftluhd2qrh7hmijtb3pepfzahykcgqefrpoocsrr...@mail.gmail.com/
Acked-by: Baoquan He <[email protected]>
Acked-by: Pratyush Yadav <[email protected]>
Reviewed-by: Nutty Liu <[email protected]>
Signed-off-by: Tao Liu <[email protected]>
---
v5 -> v4: 1) Add parentheses to function name in patch subject
link to v1:
https://lore.kernel.org/linux-riscv/[email protected]/
link to v2:
https://lore.kernel.org/linux-riscv/[email protected]/
link to v3:
https://lore.kernel.org/linux-riscv/[email protected]/
link to v4:
https://lore.kernel.org/linux-riscv/[email protected]/
---
arch/riscv/kernel/machine_kexec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/riscv/kernel/machine_kexec.c
b/arch/riscv/kernel/machine_kexec.c
index 2306ce3e5f22..738df176ff6f 100644
--- a/arch/riscv/kernel/machine_kexec.c
+++ b/arch/riscv/kernel/machine_kexec.c
@@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
if (image->segment[i].memsz <= sizeof(fdt))
continue;
+ if (!image->segment[i].buf)
+ continue;
+
if (image->file_mode)
memcpy(&fdt, image->segment[i].buf, sizeof(fdt));
else if (copy_from_user(&fdt, image->segment[i].buf,
sizeof(fdt)))
--
2.54.0
