Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare

From: Pratyush Yadav <pratyush@kernel.org>
To: Baoquan He <bhe@redhat.com>
Cc: Tao Liu <ltao@redhat.com>,
	 kexec@lists.infradead.org,  pjw@kernel.org, palmer@dabbelt.com,
	 aou@eecs.berkeley.edu,  alex@ghiti.fr,
	Mimi Zohar <zohar@linux.ibm.com>,
	Roberto Sassu <roberto.sassu@huawei.com>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	Eric Snowberg <eric.snowberg@oracle.com>,
	linux-integrity@vger.kernel.org, linux-riscv@lists.infradead.org,
	 linux-kernel@vger.kernel.org
Subject: Re: [PATCH] riscv: Fix a NULL pointer reference in machine_kexec_prepare
Date: Mon, 29 Jun 2026 13:12:54 +0200	[thread overview]
Message-ID: <2vxzh5mlk3bd.fsf@kernel.org> (raw)
In-Reply-To: <CAP_BRoQEM8Re1dT7JNQgO72o50GAnb2y7R1HWPd+E772GVYAJg@mail.gmail.com> (Baoquan He's message of "Fri, 26 Jun 2026 16:04:37 +0800")

+Cc IMA maintainers

On Fri, Jun 26 2026, Baoquan He wrote:

> Add kexec ML to CC.
>
> On Fri, Jun 26, 2026 at 7:46 AM Tao Liu <ltao@redhat.com> wrote:
>>
>> Kindly ping, any comments?
>>
>> Thanks,
>> Tao Liu
>>
>> On Fri, May 29, 2026 at 3:35 PM Tao Liu <ltao@redhat.com> wrote:
>> >
>> > A NULL pointer reference issue is noticed in riscv's machine_kexec_prepare,
>> > where image->segment[i].buf might be NULL and copied unchecked.
>> >
>> > The NULL buf comes from security/integrity/ima/ima_kexec.c:
>> > ima_add_kexec_buffer(), where kbuf is added by kexec_add_buffer(),
>> > but kbuf.buffer is NULL.
>> >
>> > Fix this by simply adding a check before copy.
>> >
>> > Signed-off-by: Tao Liu <ltao@redhat.com>
>> > ---
>> >  arch/riscv/kernel/machine_kexec.c | 3 +++
>> >  1 file changed, 3 insertions(+)
>> >
>> > diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
>> > index 2306ce3e5f22..d81d576f9cb5 100644
>> > --- a/arch/riscv/kernel/machine_kexec.c
>> > +++ b/arch/riscv/kernel/machine_kexec.c
>> > @@ -41,6 +41,9 @@ machine_kexec_prepare(struct kimage *image)
>> >                 if (image->segment[i].memsz <= sizeof(fdt))
>> >                         continue;
>> >
>> > +               if (image->segment[i].buf == NULL)
>> > +                       continue;
>> > +
>
> This is a good fix, maybe we can add code comments to explain it as
> below, just for reference.
>
>                /*
>                 * Some segments (e.g. IMA) reserve space but have no buffer
>                 * loaded yet. Skip them as they cannot contain an FDT.
>                 */
> And is there any other place where the similar issue exists? e.g on LoongArch?
>
> Other than above concerns, this patch looks good to me:
>
> Acked-by: Baoquan He <bhe@redhat.com>

Yeah, the patch LGTM to me too.

Acked-by: Pratyush Yadav <pratyush@kernel.org>

Although I think IMA can make this a bit easier to understand. First, in
ima_add_kexec_buffer() it should set kbuf.buffer to NULL and kbuf.bufsz
to 0 explicitly instead of using kexec_buffer and kexec_buffer_size
which are initialized to NULL and 0, but never updated. Using the
variables here adds an extra level of indirection.

Also, perhaps we should add a comment in ima_add_kexec_buffer() about
how this all works, since where the IMA buffer lives and where it gets
updated it fairly complicated and took me some time to piece together.

-- 
Regards,
Pratyush Yadav