Re: [PATCH 1/2] s390/ipl: Fix NULL deref in kdump without re-IPL parm block

[Heiko Carstens <hca@linux.ibm.com>]

On Thu, Aug 13, 2026 at 01:06:54PM +0200, Vasily Gorbik wrote:
> Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might
> not provide an IPL parameter block. In this case, reipl_type_init()
> selects IPL_TYPE_UNKNOWN, and reipl_block_actual remains NULL.
> 
> kdump passes the re-IPL parameter block to the dump kernel through
> os_info. Before commit 3b9678472bab ("s390/ipl: correct kdump reipl
> block checksum calculation"), the os_info entry was added only for
> IPL types which initialized reipl_block_actual. That commit moved the
> os_info update to machine_crash_shutdown(), making it unconditional. As
> a result, set_os_info_reipl_block() dereferences reipl_block_actual for
> IPL_TYPE_UNKNOWN. This may happen to work by chance when address zero
> contains readable lowcore data and the resulting empty os_info entry is
> ignored by the dump kernel.
> 
> Skip the os_info update when no re-IPL parameter block is available.
> Kdump then collect the dump and reboot without setting re-IPL parameter
> block.
> 
> Fixes: 3b9678472bab ("s390/ipl: correct kdump reipl block checksum calculation")
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
> ---
>  arch/s390/kernel/ipl.c | 2 ++
>  1 file changed, 2 insertions(+)

Reviewed-by: Heiko Carstens <hca@linux.ibm.com>